A Pod accesses the cloud instance metadata endpoint and obtains excessive permissions. Which control should be assessed?

1. Only the image's display name
2. Workload identity scope and metadata access restrictions
3. Only the application response's character encoding
4. A longer service DNS alias