A connection is allowed by a stateful VPC firewall rule. The team asks whether a separate reverse rule is normally required only for its response packets. Which approach best fits?

1. Use supported service-account targeting in firewall rules.
2. Enable and inspect Firewall Rules Logging for the relevant rule.
3. Rely on connection tracking for permitted return traffic, subject to supported firewall behavior.
4. Use a supported Packet Mirroring configuration and a controlled collector.