An application has no legitimate need for cloud instance credentials. An assessment finds it can query the node's cloud metadata endpoint. Which action most directly reduces that credential-exposure path?

1. Restrict workload access to the metadata endpoint using supported network or platform controls
2. Store the same cloud credentials in a ConfigMap
3. Add a public DNS alias for the metadata endpoint
4. Set the Pod's display name to untrusted