A regulated workload requires private connectivity to an AWS API. Which two statements correctly describe the additional security work? Select 2 answers.

1. Scope endpoint security groups and supported endpoint policies to the intended callers.
2. Publish endpoint credentials in a public DNS TXT record for discovery.
3. Allow all IAM actions because PrivateLink authenticates business authorization.
4. Retain least-privilege IAM permissions for API actions and resources.
5. Disable TLS because every private route automatically encrypts application payloads.