A network team deploys private IPv4 subnets with a NAT gateway but instances cannot reach the internet. Which two route requirements must be met? Select 2 answers.

1. Point the NAT subnet default route back to the same NAT gateway.
2. Route private-subnet internet traffic to the NAT gateway.
3. Attach the NAT gateway as a security group to every instance.
4. Configure a private hosted zone with the name internet.
5. Place the public NAT gateway in a subnet with an internet gateway route.