A security team creates a default-deny ingress NetworkPolicy, but traffic between selected Pods remains unrestricted. The cluster's network plugin does not implement NetworkPolicy enforcement. What is required?

1. Rename the policy to default-deny-all
2. Create a Secret with the same policy name
3. A networking implementation that enforces Kubernetes NetworkPolicy
4. Base64-encode the policy's selectors