A company hosts a private API on premises and wants VPC clients to resolve its corporate name and reach it privately. Which dependencies must be designed together? Select 2 answers.

1. Only a public hosted zone, because DNS automatically creates VPN routes.
2. Only an inbound Resolver endpoint with no hybrid network path.
3. Private routing and security controls for both DNS and application traffic.
4. Only an S3 endpoint policy permitting the corporate domain.
5. Conditional outbound DNS forwarding to the corporate resolvers.