A connection uses neither a connectivity agent nor a private endpoint. Which network assumption should the security reviewer challenge?

1. That the connection necessarily uses an entirely private service path.
2. That the application must be reachable through the selected connection path.
3. That the adapter needs appropriate endpoint details.
4. That target authentication requirements still apply.