An application fails immediately after a security group change. Reachability Analyzer reports a valid path, but the service still refuses connections. What is the correct next step?

1. Make the database public without checking the service process.
2. Check live service listeners, host firewalls, and runtime evidence in addition to configuration analysis.
3. Treat the analysis as proof that every application request must succeed.
4. Delete all subnet routes because a successful analysis proves routes are unused.