A company encrypts sensitive files but stores the decryption keys in the same unrestricted shared folder. What should be reported?

1. Encryption is unnecessary whenever a shared folder is used
2. A longer filename would establish sufficient key protection
3. Weak key protection undermines the confidentiality provided by encryption
4. The files are automatically anonymous because they are encrypted