A company is migrating an application server to AWS, but due to compliance the database must remain on premises. The database is highly sensitive to network latency, and all traffic between AWS and on premises must be encrypted with IPsec. Which combination of AWS services will satisfy these requirements? (Choose two.)

AWS Site-to-Site VPN establishes an encrypted IPsec tunnel over the public internet, satisfying the encryption requirement. AWS Direct Connect provides a dedicated, private network connection between your on-premises data center and AWS, which significantly reduces network latency compared to internet-based connections. The combination of Direct Connect for low latency and Site-to-Site VPN for IPsec encryption over that private link (or as a backup) meets all specified requirements. AWS VPN CloudHub is for connecting multiple on-premises networks to a single AWS VPC, not for a single connection with low latency. VPC peering connects two VPCs within AWS, not an on-premises network to AWS. A NAT gateway allows instances in a private subnet to connect to the internet, but it does not provide connectivity to on-premises networks or encryption.