Administrators need identity-aware access to an internal web application without exposing unrestricted public access to its backend. Which approach best fits?

1. Use Identity-Aware Proxy with suitable backend access restrictions.
2. Apply appropriate Cloud Armor WAF and rate-limiting policies.
3. Configure appropriate firewall rules or firewall policies.
4. Use VPC Service Controls for supported services with appropriate ingress and egress rules.