Your team deploys a private endpoint for an Azure SQL Database into a subnet named 'data-pe-subnet'. Security requires that an NSG applied to the subnet actually filters inbound traffic destined to the private endpoint, and the network team also wants a user-defined route with a next hop of an Azure Firewall to force traffic through inspection. Currently, neither the NSG rules nor the UDR appear to affect the private endpoint. What must you configure on the subnet to make both the NSG and the UDR take effect for the private endpoint?