You are deploying an Azure SQL Database private endpoint into a subnet named 'data-pe' within a VNet. You want traffic to the private endpoint to be filtered by a network security group (NSG) associated with that subnet, and you also plan to use user-defined routes (UDRs) to force private endpoint traffic through an Azure Firewall for inspection. When you first created the subnet, private endpoint network policies were disabled. What must you do so that both the NSG rules and the UDRs apply to the private endpoint?