A Linux server should accept incoming HTTPS but reject unneeded inbound services under a default-deny policy. Which control implements this requirement?

1. Filesystem mode 700 on the web document root
2. A DNS alias pointing to the server
3. A stateful host firewall ruleset allowing the required traffic
4. A process nice value for the web server