A company requires private connectivity from a colocation provider into Azure VNets. It wants to avoid carrying the connection over the public internet. Which service should it use?

1. A private DNS zone alone
2. Point-to-site VPN
3. A public Application Gateway listener
4. ExpressRoute with Azure private peering