An NLB using security groups fronts a PrivateLink endpoint service. Some consumer addresses overlap with internal networks and are blocked by NLB inbound rules. Which setting specifically controls evaluation of inbound rules for PrivateLink traffic?

1. Remove every target security group and rely on account names.
2. Configure whether the NLB enforces inbound security group rules on PrivateLink traffic.
3. Change the endpoint service name to a unique DNS label.
4. Enable an ALB path condition on the NLB TCP listener.