A security team must prevent resource operations that violate a compartment's mandatory security recipe. Which OCI capability best fits?

1. Security Zones with the applicable recipe.
2. Cloud Guard alone, assumed to deny every noncompliant request synchronously.
3. Budget alerts configured with the same compartment name.
4. A dashboard note asking users to comply.