A team wants an application in a VPC to reach supported Bedrock APIs without using a public internet path. Which statements describe the needed security layers? Select 2 answers.

1. A private route guarantees that prompts contain no sensitive information.
2. Supported interface VPC endpoints can provide private service connectivity through AWS PrivateLink.
3. The application still requires appropriate IAM permissions and any applicable endpoint-policy authorization.
4. Using PrivateLink removes all need for application-level user access checks.
5. An interface endpoint automatically overrides every explicit IAM deny.