An attacker with broad workload permissions should not be able to erase the only copy of API audit history. Which logging design best supports this objective?

1. Give every workload write access to the audit-log directory
2. Store the only copy in an application Pod's writable emptyDir
3. Record audit events only in the compromised application's environment variables
4. Export audit events to a protected external backend with separately controlled access