A security finding is technically valid but concerns a low-impact test resource, while another exposes sensitive production data. Which approach best fits?

1. Separate log administration and protect required audit retention.
2. Prioritize remediation using exposure, asset criticality, and business impact.
3. Correct the infrastructure definition and validate deployed resources.
4. Use an appropriately scoped integration identity and controlled response workflow.