A company runs a real-time data ingestion solution using the latest Amazon Managed Streaming for Apache Kafka (Amazon MSK). The solution is deployed in private subnets across three Availability Zones. A solutions architect must redesign the ingestion solution to be publicly accessible over the internet, and data in transit must be encrypted. Which solution meets these requirements with the MOST operational efficiency?

The correct solution involves configuring public subnets in the existing VPC and deploying the MSK cluster there, then enabling mutual TLS (mTLS) for encryption. This directly exposes the MSK cluster to the internet via public subnets, and mTLS ensures data in transit is encrypted and authenticated, meeting both requirements with operational efficiency by modifying the existing infrastructure. Creating a new VPC is less operationally efficient as it introduces unnecessary complexity and management overhead compared to using the existing VPC. Application Load Balancers (ALBs) are designed for HTTP/S traffic and are not suitable for Kafka's TCP-based communication. Network Load Balancers (NLBs) can handle TCP traffic, but deploying it in private subnets would not make the MSK cluster publicly accessible. Additionally, an NLB alone doesn't provide the mTLS encryption for Kafka; that must be configured on the MSK cluster itself.