A supported data service must deny requests crossing an approved service perimeter unless an explicit ingress rule permits them. Which approach best fits?

1. Enforce authenticated authorization through an appropriate application access control.
2. Configure a VPC Service Controls perimeter and narrow ingress exceptions.
3. Configure the required private API path separately from the service perimeter.
4. Apply appropriate edge protection and Cloud Armor policy within the supported architecture.