A private-endpoint client resolves the correct private address but cannot establish an mTLS connection. Which control should be checked?

1. Only whether the database has enough free table space
2. Only whether the client uses uppercase SQL keywords
3. Only the model used by Select AI
4. Applicable security-list or NSG rules permitting the required database connection port