A private VM needs supported Google API access without an external IP, using the documented Google API VIP path rather than a customer-owned endpoint. Which approach best fits?

1. Configure private services access with the required allocated range and service networking connection.
2. Configure Private Google Access with the required subnet, DNS, and route settings.
3. Reserve a compatible static IP address in the required scope.
4. Configure a Private Service Connect endpoint for supported Google APIs and the required DNS and routes.