A private service design must prevent clients from bypassing an approved proxy and reaching the backend directly. Which approach best fits?

1. Choose and validate a supported encrypted connectivity topology.
2. Restrict direct backend access to the intended proxy path and identities.
3. Plan explicit segmentation and narrowly scoped inter-tier firewall policy.
4. Use network firewall policy for packet flows and service perimeters for the relevant managed-service boundary.