On-premises clients must resolve a Route 53 private hosted zone without making it public. Which architecture should the network engineer choose?

1. Advertise the VPC resolver reserved address through BGP as an on-premises DNS server.
2. Publish the private records in a public hosted zone and restrict them with a security group.
3. Create redundant Resolver inbound endpoint IPs and forward the private suffix to them.
4. Create only an outbound Resolver endpoint and direct on-premises queries to it.