A firewall rule should identify target VMs through their workload service account rather than a broad subnet range. Which approach best fits?

1. Enable and inspect Firewall Rules Logging for the relevant rule.
2. Use supported service-account targeting in firewall rules.
3. Rely on connection tracking for permitted return traffic, subject to supported firewall behavior.
4. Use a supported Packet Mirroring configuration and a controlled collector.