A connection is allowed by a stateful VPC firewall rule. The team asks whether a separate reverse rule is normally required only for its response packets. Which approach best fits?

1. Use supported service-account targeting in firewall rules.
2. Use a supported Packet Mirroring configuration and a controlled collector.
3. Enable and inspect Firewall Rules Logging for the relevant rule.
4. Rely on connection tracking for permitted return traffic, subject to supported firewall behavior.