A company runs an on-premises intranet application and will use AWS Elastic Disaster Recovery to back it up to AWS. Replication traffic must not traverse the public internet, the application must not be accessible from the internet after recovery, and replication should not consume all available network bandwidth. Which combination of steps will meet these requirements? (Choose three.)

To prevent replication traffic from traversing the public internet, an AWS Direct Connect connection and a Direct Connect gateway are essential, providing a private, dedicated network path. A VPC with at least two private subnets and a virtual private gateway is necessary to host the recovered application privately and securely within AWS, ensuring it's not accessible from the internet. Using two NAT gateways is incorrect as NAT gateways are for outbound internet access from private subnets, which is not required for this scenario. When configuring replication servers, selecting the option to use private IP addresses for data replication ensures that data transfer occurs over the private network established by Direct Connect, further preventing public internet exposure. Creating a VPC with public subnets and an internet gateway would expose the application to the internet. An AWS Site-to-Site VPN is a valid option for private connectivity but Direct Connect offers higher bandwidth and lower latency, which is generally preferred for disaster recovery. Matching private IPs is not a primary requirement for disaster recovery and might not always be feasible or necessary.