A public application must defend against supported HTTP attack patterns. Which OCI capability should be evaluated?

1. A service gateway as a universal application attack detector.
2. Web Application Firewall with appropriately tuned policies and monitoring.
3. A block-volume backup schedule.
4. A compartment quota as a SQL injection filter.