A company has a hybrid cloud with Direct Connect to AWS. VPCs are connected in a hub-and-spoke model via transit gateway and use a transit VIF with a Direct Connect gateway. The company uses a hybrid DNS model with Route 53 Resolver endpoints in the hub VPC for bidirectional DNS. A backend application in a VPC consumes messages via Amazon SQS over a private network. The network engineer wants an interface VPC endpoint for SQS that is reachable from on premises and from multiple VPCs. Which combination of steps should the engineer take so client applications can resolve DNS for the interface endpoint? (Choose three.)

When creating an interface endpoint, turning off private DNS names prevents automatic DNS resolution for the service's default DNS name within the VPC, which is necessary here because the goal is to resolve from on-premises as well. Manually creating a private hosted zone (e.g., for sqs.us-east-1.amazonaws.com) allows you to define custom DNS records that point to the interface endpoint's private IP addresses. This private hosted zone can then be associated with other VPCs, enabling consistent resolution across the hybrid environment. Clients should be configured to use the specific private DNS name of the interface endpoint (e.g., vpce-xxxx-xxxx.sqs.us-east-1.vpce.amazonaws.com) or the custom DNS name defined in the private hosted zone, ensuring traffic routes privately. Turning on private DNS names would automatically create a private hosted zone for the service's default DNS name, which is not ideal for on-premises resolution. Using the automatically created private hosted zone is incorrect because it would point to the public SQS endpoint unless private DNS was enabled for the endpoint, which we are avoiding. Accessing the SQS endpoint via its public DNS name would bypass the private connectivity provided by the interface endpoint.