A new spoke can reach a Transit Gateway attachment but cannot reach shared services. Its subnet route is correct. Which distinction should the engineer check next?

1. The spoke association selects its lookup table; propagation determines which routes appear there.
2. The VPC subnet route alone installs a reciprocal route in every transit table.
3. Propagation automatically associates an attachment with every route table.
4. Security group outbound rules create missing Transit Gateway routes.