A proposed attack surface reduction rule may affect a critical business application. Which rollout approach is appropriate?

1. Enforce globally with no testing regardless of impact
2. Evaluate supported audit behavior and representative impact before controlled enforcement
3. Judge only the rule's name
4. Disable all endpoint protection permanently