An internet-facing IPv6 workload must initiate outbound connections but must not accept unsolicited inbound IPv6 connections. Which VPC component is appropriate?

1. A VPC peering connection to the IPv6 internet.
2. A public NAT gateway because every IPv6 internet connection requires NAT44.
3. An egress-only internet gateway with the appropriate IPv6 default route.
4. An internet gateway plus an inbound security group rule allowing all IPv6.