A storage private endpoint has been approved, but a VM resolves the service hostname to its public address. Which change is the most direct first step?

1. Increase the subnet's NAT Gateway public IP count
2. Replace the storage account with a public DNS zone
3. Configure the appropriate Private DNS zone record and VNet resolution path
4. Rotate the storage account keys