A financial company will migrate a web app to EC2 instances in an Auto Scaling group inside a dedicated VPC. The company uses a legacy third-party security appliance (no cloud-native offering) that must inspect all packets entering and leaving the VPC in real time without impacting application performance. The design must be highly available within the Region. Which combination of steps should the solutions architect take? (Choose two.)

To ensure all traffic is inspected by the legacy security appliance, a Gateway Load Balancer (GWLB) is essential. GWLB integrates with VPC routing to transparently redirect traffic to a fleet of security appliances, such as EC2 instances running the third-party tool. Provisioning a GWLB for each Availability Zone ensures high availability. The security tool itself must run on EC2 instances, and using an Auto Scaling group for these instances provides scalability and high availability for the security function. Deploying the web application behind a Network Load Balancer (NLB) or Application Load Balancer (ALB) directly for the web app doesn't address the requirement of inspecting all traffic via the security appliance. An ALB in front of the security tool instances is not the correct mechanism for transparent traffic inspection; GWLB is designed for this. A transit gateway facilitates inter-VPC communication but doesn't inherently redirect all ingress/egress traffic through a security appliance within a single VPC.