A penetration test shows that network segmentation rules permit a sensitive database path that the architecture forbids. What should happen?

1. Add the permitted path to the architecture diagram without evaluating the exposure
2. Increase the scanning frequency while leaving the prohibited path open
3. Correct the rule gap and verify the intended trust boundary
4. Assume the diagram proves segmentation effective