A public application should resist volumetric or application-edge attacks using supported protections. Which approach best fits?

1. Configure a VPC Service Controls perimeter and narrow ingress exceptions.
2. Apply appropriate edge protection and Cloud Armor policy within the supported architecture.
3. Enforce authenticated authorization through an appropriate application access control.
4. Configure the required private API path separately from the service perimeter.