Security wants to avoid exposing session hosts with public inbound RDP ports. Which Azure Virtual Desktop connectivity characteristic supports this goal?

1. Remove all outbound access without checking required service endpoints
2. Use a file share as the RDP gateway
3. Supported reverse-connect service connectivity rather than public RDP listeners on every host
4. Open TCP 3389 from the entire internet on every VM