A team must reduce the risk that a deleted encryption key is immediately and permanently destroyed. Which vault protections should it evaluate?

1. A public DNS alias
2. A resource tag naming the retention period only
3. A longer secret value
4. Soft delete and purge protection with suitable lifecycle controls