Two applications share a subnet but need different network access rules. Which control can group selected VNICs rather than applying rules to every VNIC in the subnet?

1. An Object Storage lifecycle policy
2. The tenancy's billing budget
3. The subnet's common route table alone
4. Network security groups