Administrators need RDP access to an Azure Windows VM without assigning the VM a public IP. Which service should be assessed?

1. A public IP on the VM with unrestricted port 3389
2. Azure Backup as an interactive console
3. Azure Bastion
4. Azure Policy as the RDP transport