An auditor asks for evidence that production workloads meet the approved security baseline. What is strongest?

1. Current configuration evidence and repeatable policy assessment results
2. Only a statement that Kubernetes is secure by default
3. Only an unrelated vendor's marketing certification
4. Only the number of cluster nodes