A team deploys Resolver endpoints into two AZs. What additional network configuration is required for reliable DNS forwarding over a hybrid connection?

1. Allow every internet source to query the corporate resolvers.
2. Permit only ICMP because successful ping proves DNS resolution works.
3. Permit only HTTPS to the AWS console from the DNS servers.
4. Permit UDP and TCP DNS traffic between endpoint IPs and the designated resolvers.