A private VM needs outbound internet access for updates while remaining without an external IP address. Unsolicited inbound internet access is unnecessary. Which approach best fits?

1. Configure Public Cloud NAT with suitable routing.
2. Use VPC Network Peering.
3. Use HA VPN with a supported redundant topology.
4. Use Private Service Connect endpoints and a published service attachment.