A private VM needs outbound internet access for updates while remaining without an external IP address. Unsolicited inbound internet access is unnecessary. Which approach best fits?

1. Configure Public Cloud NAT with suitable routing.
2. Use Private Service Connect endpoints and a published service attachment.
3. Use HA VPN with a supported redundant topology.
4. Use VPC Network Peering.