A supported PaaS service must be accessible from a connected private network using a private IP, while public access is restricted. What should the architect include?

1. Only a resource tag labelled private
2. A private DNS record pointing to an unreachable arbitrary IP
3. A public service endpoint with no firewall rules
4. Private endpoints, appropriate DNS resolution, and service-specific public access restrictions