A deployment must use one exact immutable container image rather than whichever artifact a mutable tag points to later. Which approach best fits?

1. Deploy an image referenced by its digest.
2. Store credentials in Secret Manager and grant runtime read access narrowly.
3. Use customer-managed encryption keys through Cloud KMS.
4. Use Artifact Registry repositories with appropriate IAM roles.