An organization grants a service account broad privileges because it is not used by a human. What should the practitioner explain?

1. Service accounts cannot be compromised
2. A longer account description is sufficient protection
3. Nonhuman identities also need least privilege, lifecycle control, and monitoring
4. Monitoring applies only to employees