A provider wants eligible consumers to reach its supported private load-balanced service through consumer private endpoints. Which provider-side feature fits?

1. A public SAS token
2. A DNS alias alone
3. A VM backup policy
4. Azure Private Link Service