A developer compares an application registration with an enterprise application's service principal. Which statement is correct?

1. Every service principal is a human user account
2. A registration automatically grants every API permission in every tenant
3. The application object defines the app, while a service principal represents its identity in a tenant
4. The two are only DNS names with no identity meaning