Administrators need identity-aware access to an internal web application without exposing unrestricted public access to its backend. Which approach best fits?

1. Configure appropriate firewall rules or firewall policies.
2. Apply appropriate Cloud Armor WAF and rate-limiting policies.
3. Use VPC Service Controls for supported services with appropriate ingress and egress rules.
4. Use Identity-Aware Proxy with suitable backend access restrictions.