Azure workloads must resolve an on-premises namespace through specified on-premises DNS servers. Which Private Resolver configuration supports this direction?

1. A storage service endpoint
2. An outbound endpoint and forwarding ruleset linked to the relevant VNet
3. Only an inbound endpoint with no forwarding rules
4. A public A record for every on-premises host