A private workload needs Google API connectivity, but an engineer assumes a service perimeter creates its network route. Which approach best fits?

1. Configure the required private API path separately from the service perimeter.
2. Apply appropriate edge protection and Cloud Armor policy within the supported architecture.
3. Configure a VPC Service Controls perimeter and narrow ingress exceptions.
4. Enforce authenticated authorization through an appropriate application access control.