A company needs to temporarily scale out on-premises application capacity by deploying servers on EC2. The EC2 servers must share data with on-premises servers, must not be internet-accessible, and all internet-bound traffic must go through the on-premises firewall. The EC2 servers also need to access a third-party web application. Which network configuration satisfies these requirements?

The correct option meets all requirements. A VPC with only private subnets ensures EC2 servers are not internet-accessible. The Site-to-Site VPN connects EC2 to on-premises servers for data sharing. Setting the default route to the virtual private gateway forces all internet-bound traffic (including for the third-party web application) through the on-premises firewall, satisfying the security policy. The first incorrect option creates public subnets and a NAT Gateway, which would allow direct internet access from private subnets, violating the requirement that all internet traffic goes through the on-premises firewall. The third incorrect option deploys applications to public subnets, making them internet-accessible, which is explicitly forbidden. The fourth incorrect option creates public subnets and does not route internet traffic through the on-premises firewall for the private subnets, only for on-premises data center subnets.