A company will deploy an internal web application on AWS that must be accessible only from the company office. The application must download security patches from the internet. The company has a VPC and an AWS Site-to-Site VPN to the office. Which design meets these requirements securely?

This option correctly isolates the web application while allowing necessary outbound internet access. Deploying EC2 instances in private subnets behind an internal ALB ensures the application is not directly exposed to the public internet. Setting the ALB's security group inbound source to the company's office network CIDR block restricts access exclusively to the office via the Site-to-Site VPN. NAT gateways in public subnets, coupled with an internet gateway, provide the private EC2 instances with outbound internet connectivity for downloading security patches without allowing unsolicited inbound connections. Incorrect options: Deploying the ALB in public subnets with a 0.0.0.0/0 inbound rule makes the application publicly accessible, violating the requirement for internal access only. Deploying EC2 instances in public subnets exposes them directly to the internet, and setting the outbound destination of the ALB's security group for inbound access is incorrect. NAT gateways in private subnets are also not a standard or effective design for providing outbound internet access to private instances. A public ALB with an outbound destination rule for inbound access is misconfigured and would expose the application publicly.