A critical process is protected by several controls that all depend on one identity service. What should the practitioner highlight?

1. A common dependency can weaken the assumed independence of the controls
2. Every control must be removed
3. Control count alone proves defense in depth is sufficient
4. Only the identity service's logo needs review