A company must prevent untrusted container images from deploying to supported runtime environments unless they meet attestation policy. Which approach best fits?

1. Use Cloud Deploy delivery pipelines and targets.
2. Use Cloud Build with reviewed build configuration.
3. Store images in Artifact Registry with scoped IAM.
4. Enforce Binary Authorization with the appropriate trusted attestations.