A networking team needs a private DNS zone usable by workloads in an authorized VPC without exposing its records publicly. Which approach best fits?

1. Configure supported inbound DNS forwarding and on-premises forwarding rules.
2. Add or adjust the narrowly scoped applicable ingress firewall rule.
3. Create a private Cloud DNS zone with the appropriate network authorization.
4. Configure an appropriate Cloud DNS forwarding zone or outbound forwarding policy.