A namespace applies default-deny egress. Application Pods must resolve cluster DNS through the DNS Service. What additional rule is typically required?

1. Set the application's imagePullPolicy to Always
2. Allow ingress to the application only on TCP port 443
3. Add a readiness probe with a DNS hostname only
4. Allow egress to the appropriate DNS destinations on UDP and TCP port 53