A service must accept arbitrary unsolicited inbound internet connections. An engineer proposes using Public Cloud NAT as the inbound gateway. Which approach best fits?

1. Use an appropriate private API access design with explicit egress controls.
2. Treat Cloud Router as the managed control plane, not a data-plane forwarding VM.
3. Use an appropriate public frontend or load balancer rather than relying on outbound NAT.
4. Review NAT port allocation and scale the available translation capacity.