A firewall rule should identify target VMs through their workload service account rather than a broad subnet range. Which approach best fits?

1. Use supported service-account targeting in firewall rules.
2. Use a supported Packet Mirroring configuration and a controlled collector.
3. Enable and inspect Firewall Rules Logging for the relevant rule.
4. Rely on connection tracking for permitted return traffic, subject to supported firewall behavior.