A contractor needs access to one internal application. Which design best limits network exposure?

1. Source IP allowlisting without further authentication
2. A permanent network-wide VPN for every contractor
3. A shared administrator tunnel credential
4. Application-scoped access with identity and device checks