An on-premises system must call Google APIs through an endpoint using the organization's own RFC 1918 address. Hybrid routing is already available. Which approach best fits?

1. Reserve a compatible static IP address in the required scope.
2. Configure a Private Service Connect endpoint for supported Google APIs and the required DNS and routes.
3. Configure Private Google Access with the required subnet, DNS, and route settings.
4. Configure private services access with the required allocated range and service networking connection.