A cloud database stores sensitive values in encrypted columns, but an application user can issue unrestricted export queries. What is the principal remaining risk?

1. Column encryption inherently prevents all bulk exports
2. Authorized application access can expose decrypted data at scale
3. A database checksum will automatically prevent disclosure
4. The records become nonsensitive once encrypted at rest