DBAs should create VM clusters using prepared ODB Subnets but should not administer those subnets. Which role combination is appropriate?

1. Only odbNetworkAdmin with no database permissions.
2. Organization Owner for every application schema user.
3. The relevant database resource administration roles plus odbSubnetUser access.
4. Only a Cloud Storage Object Viewer role.