A central network account owns a Transit Gateway used by production and development VPCs. Both environments need a shared DNS VPC, but must not route to each other. Which design is appropriate?

1. Use VPC peering to the DNS VPC and rely on transitive peering for all other traffic.
2. Use different security group descriptions as the only transit routing control.
3. Use separate transit route tables with deliberate shared-services routes and controlled propagation.
4. Propagate every attachment into one common route table.