A regulated deployment needs supported private connectivity to relevant Azure Virtual Desktop service components. Which elements should be designed together?

1. A longer user password as a substitute for network configuration
2. A private profile share as proof all control-plane paths are private
3. A tag named Private on every host
4. Private Link configuration, DNS, client and host reachability, and public-access behavior