A company currently encrypts traffic between an on-premises site and a single VPC using Site-to-Site VPN over two 1 Gbps Direct Connect links with public VIFs. The company will add 15 more VPCs in the same Region and needs the same encryption level for each on-prem to VPC connection. The new connections must not use public IP addresses and bandwidth per VPN will remain below the current provisioned speeds. Which combination of steps provides the required functionality with the least operational overhead? (Choose three.)

Creating a Transit Gateway (TGW) and a Direct Connect Gateway (DXGW) allows centralizing connectivity from on-premises to multiple VPCs. Associating the TGW with the DXGW enables routing between on-premises and all VPCs attached to the TGW. Attaching all new VPCs to the TGW simplifies management by avoiding individual connections for each VPC. Assigning a private IPv4 CIDR range to the Transit Gateway is necessary because Site-to-Site VPN private IP VPN connections use private IP addresses over a private VIF, fulfilling the requirement to avoid public IPs. A transit VIF to the DXGW, combined with a Site-to-Site VPN private IP VPN connection, provides encrypted communication without public IP addresses, leveraging the existing Direct Connect infrastructure. Incorrect options: Creating a new private VIF for each VPC and associating each VPC with the DXGW would be operationally complex and not scalable for 15+ VPCs. Assigning a public IPv4 CIDR range to the TGW would violate the requirement to not use public IP addresses. Creating a public VIF and a public IP VPN connection would also violate the requirement to avoid public IP addresses.