A company has VPCs in us-east-1 connected via a transit gateway. A network engineer is configuring an AWS Direct Connect to the transit gateway for a workload migration. The Direct Connect ConnectionState metric is UP, but the virtual interface (VIF) is DOWN. The on-prem router BGP and transit VIF settings appear correct, yet the engineer cannot ping the Amazon peer IP. Which combination of actions should the engineer take to troubleshoot? (Select three.)

The VIF being DOWN while the Direct Connect connection is UP indicates a Layer 2 or Layer 3 configuration issue on the customer side. Verifying the correct IP address and subnet mask on the router's subinterface is crucial for Layer 3 connectivity. Checking for a MAC address entry from the AWS endpoint in the router's ARP table confirms successful Layer 2 communication. Ensuring the correct VLAN tag is applied on the subinterface is essential for the VIF to establish, as Direct Connect VIFs are VLAN-tagged. Disabling VLAN trunking is incorrect; VIFs rely on VLAN tagging. Checking optical signal is for physical layer issues, which are ruled out by the ConnectionState being UP. BGP port blocking is a Layer 4 issue, but the problem is at Layer 2/3.