An architect connects remote-region VCNs through DRGs. The application can resolve remote hosts but connections time out. What is the strongest initial hypothesis to test?

1. Remote peering automatically permits every protocol between all subnets.
2. DNS success proves routing and packet filtering are correct.
3. Missing forward or return routes, or security rules, on the remote peering path.
4. Every remote host must be assigned the same subnet address.