Traffic Manager switches to a healthy endpoint after the primary fails, but some clients continue using the old endpoint briefly. What is the most relevant explanation?

1. Traffic Manager always proxies existing TCP sessions to the failed endpoint
2. Adding an NSG rule makes DNS answers uncacheable
3. Clients or resolvers can retain the previous DNS answer until its cache lifetime expires
4. Any endpoint change automatically removes client resolver caches