A finance firm uses Amazon Redshift and Redshift Spectrum to query data stored in a shared Amazon S3 bucket. The data comes from certified third-party providers, and each provider has separate connection details. Regulations require that none of the data be reachable from outside the firm's AWS environment. Which combination of actions should the company take to satisfy these requirements? (Choose two.)

The correct options address the requirement that data not be reachable from outside the firm's AWS environment. Placing the Redshift cluster in a private subnet and using an interface VPC endpoint ensures internal access. A NAT Gateway allows Redshift to securely access S3 without exposing Redshift to the public internet. Turning on enhanced VPC routing for Redshift and setting up AWS Direct Connect with each provider establishes private, dedicated connections, preventing data exposure over the public internet. Incorrect options: AWS CloudHSM is for encryption key management, not for controlling network reachability. Defining table constraints is for data integrity within Redshift, not network security. Federated queries access external data but don't inherently secure the connection to meet the "not reachable from outside" requirement without additional networking controls. A gateway VPC endpoint is for S3, not for federated queries to external providers.