A team creates a private endpoint for a service and assumes all public access is automatically disabled. What additional step should it validate?

1. Whether the endpoint and service share identical resource names
2. Whether its cost tag includes the word private
3. Whether a client has Reader instead of a data-plane role
4. The service's public network access settings and required client connectivity