A network inspection design requires supported TLS inspection and intrusion detection/prevention in Azure Firewall. Which tier should be evaluated?

1. Standard assumed to expose identical Premium inspection features
2. A private DNS zone as IDPS
3. An NSG as a full TLS decryption engine
4. Premium with the required inspection configuration