Which of the following is/are correct about preventing and detecting security vulnerabilities using VPNs in Web applications?

In this approach, all the admin functionality should be remapped onto internal IPs.

It allows SQL tables to be dropped, commands run on SQL servers or the Web server to have privilege escalation vulnerabilities.

This approach is used to identify the common coding errors might allow shell code to be uploaded to attack the server, or malicious files uploaded for other users.

Both (1) and (2)

Both (1) and (3)