A design must distinguish control of packet reachability from control of access to supported managed-service data APIs. Which approach best fits?

1. Restrict direct backend access to the intended proxy path and identities.
2. Choose and validate a supported encrypted connectivity topology.
3. Use network firewall policy for packet flows and service perimeters for the relevant managed-service boundary.
4. Plan explicit segmentation and narrowly scoped inter-tier firewall policy.