CedarHealth already has hybrid connectivity. On-premises systems must call supported Google APIs using an endpoint from its own RFC 1918 address space. Which design fits?

1. A VPC Service Controls perimeter assumed to create network connectivity.
2. A subnet Private Google Access toggle with no endpoint, route, or DNS design.
3. A Private Service Connect Google API endpoint with appropriate hybrid routes and DNS.
4. Public Cloud NAT used as an unsolicited inbound API endpoint.