A company deploys AWS Network Firewall endpoints in two AZs. Which routing principle preserves stateful inspection for each AZ workload?

1. Design both directions through the appropriate firewall endpoint and validate return routes.
2. Assume creating endpoints automatically replaces every VPC route.
3. Route outbound traffic through the firewall but all return traffic directly to the workload.
4. Use security group names to select the endpoint AZ automatically.