An internet-facing web application needs HTTP-layer protection against common injection attacks and abusive request patterns at its supported load balancer. Which approach best fits?

1. Use Identity-Aware Proxy with suitable backend access restrictions.
2. Configure appropriate firewall rules or firewall policies.
3. Use VPC Service Controls for supported services with appropriate ingress and egress rules.
4. Apply appropriate Cloud Armor WAF and rate-limiting policies.