A user can open an account but must not see its confidential credit-limit field through pages, reports, or API access. Which control is most appropriate?

1. Create a list view that omits the field but leave its permissions unchanged
2. Remove the field from one page layout only
3. Rename the field to discourage users from opening it
4. Field-level security restricting access to the field