An AWS Network Firewall policy is intended to inspect traffic between workloads and the internet. Which limitation must be addressed in the architecture?

1. Firewall endpoints replace all IAM authorization for AWS service calls.
2. Only traffic routed through the firewall endpoints is inspected; bypass paths must be removed or governed.
3. A firewall policy automatically decrypts every TLS connection without additional configuration.
4. Creating one firewall automatically protects every Region and account.