Instances in private subnets access S3 buckets in the same Region through a NAT gateway. Operations wants supported S3 requests to use a private gateway endpoint path and reduce NAT processing. Which actions are appropriate? Select 2 answers.

1. Replace S3 HTTPS with unencrypted HTTP so NAT processing is skipped automatically.
2. Create the endpoint but leave it associated only with an unrelated subnet route table.
3. Create an S3 gateway endpoint and associate it with the route tables used by the private subnets.
4. Assume the endpoint grants unrestricted access even when the bucket policy explicitly denies the request.
5. Verify that endpoint, IAM, and bucket policies allow the required requests, including any source-endpoint conditions.