A network design needs to reduce lateral movement between application tiers while allowing only documented service paths. Which approach best fits?

1. Choose and validate a supported encrypted connectivity topology.
2. Use network firewall policy for packet flows and service perimeters for the relevant managed-service boundary.
3. Plan explicit segmentation and narrowly scoped inter-tier firewall policy.
4. Restrict direct backend access to the intended proxy path and identities.