A security group should automatically include users whose department attribute matches Finance. Which group membership approach fits?

1. A supported dynamic membership rule based on the department attribute
2. A DNS group record
3. A static group with no membership process
4. A resource tag on each user's workstation