Small requests succeed over a VPN, but large transfers stall after an MTU change. Which investigation is most appropriate?

1. Change every destination security group to allow ICMP only.
2. Increase the DNS TTL to permit larger IP packets.
3. Assume DNS is the sole cause because small requests resolve successfully.
4. Investigate path MTU, fragmentation behavior, and TCP MSS adjustment for tunnel overhead.