A self-managed Vault server starts in a sealed state. Which statement explains the limitation?

1. The root token alone automatically decrypts all stored data
2. Vault cannot perform normal secret operations until it can access its protected key material
3. All stored secrets have already been deleted
4. The HTTP listener must always be physically disconnected