A security team needs to control allowed network flows between workload tiers using sources, targets, protocols, and ports. Which approach best fits?

1. Use VPC Service Controls for supported services with appropriate ingress and egress rules.
2. Apply appropriate Cloud Armor WAF and rate-limiting policies.
3. Configure appropriate firewall rules or firewall policies.
4. Use Identity-Aware Proxy with suitable backend access restrictions.