A team assumes every ExpressRoute circuit automatically encrypts application payloads end to end. Which statement is accurate?

1. All traffic is automatically protected by application TLS regardless of the application
2. Encryption can never be added to ExpressRoute-based designs
3. Private connectivity is not the same as universal end-to-end payload encryption
4. Public DNS delegation supplies ExpressRoute encryption