An API server's anonymous access exposes more resources than intended. Which controls should be reviewed?

1. Only the scheduler's queue ordering
2. Authentication, authorization and anonymous access configuration
3. Only container image compression
4. Only the Service's target port