A company runs a private Kubernetes API for administrators on its corporate network. Which pair of controls best reduces remote attack surface while maintaining authenticated management? Select 2.

1. Publish administrator credentials in a public repository for recovery
2. Restrict API network access to approved administrative networks
3. Require trusted TLS and strong client authentication
4. Enable anonymous access for all administrative operations