On-premises DNS servers must resolve records in a Route 53 private hosted zone associated with a VPC. Private network connectivity to the VPC already exists. Which configuration should operations implement?

1. Set the public hosted-zone TTL to zero so private records become visible publicly.
2. Create only a Resolver outbound endpoint and forward on-premises queries to it.
3. Configure the on-premises servers to query the VPC base-plus-two resolver address directly over the private connection.
4. Create Route 53 Resolver inbound endpoint IPs reachable from on premises and configure conditional forwarding on the on-premises DNS servers.