Administrators need supported RDP or SSH management without public IPs and exposed management ports on each target VM. Which service fits?

1. A public DNS alias alone
2. Azure NAT Gateway as an inbound administration proxy
3. Azure Bastion
4. A storage access key