A team deploys an interface endpoint for an AWS API. Which two controls remain necessary? Select 2 answers.

1. Allow all IAM actions because the endpoint authenticates every business operation.
2. Retain least-privilege IAM and supported endpoint-policy authorization.
3. Allow the intended clients through the endpoint network-interface security group.
4. Disable TLS because a private address guarantees encrypted payloads.
5. Publish the endpoint credentials in a public DNS record.