A regulated application requires customer-managed encryption keys. Which TWO design questions are essential? Select TWO.

1. Whether deleting active keys is a safe routine cost optimization.
2. How will key availability, rotation, and recovery be maintained?
3. Which principals and services may use or administer the keys?
4. Whether encryption removes the need for application authorization.