Private application VMs need predictable outbound public IP addresses for a vendor allowlist. They do not require unsolicited inbound internet access. Which subnet capability directly fits?

1. A public IP on every VM
2. A private DNS zone
3. A private endpoint to the vendor's ordinary public website
4. Azure NAT Gateway with assigned public IP resources