A healthcare company is moving workloads to AWS. All traffic to and from on-premises must be encrypted in transit, and all cloud traffic must be inspected before it leaves the cloud for on-premises or the internet. Parts of the workload will be internet-facing for patient appointment booking and must be protected from DDoS, including financial protection for services that might scale during an attack. Which combination of actions should the network engineer take to satisfy these requirements? (Choose three.)

The correct options address the requirements for encryption, inspection, and DDoS protection. AWS Direct Connect with MACsec support provides in-transit encryption for all traffic between on-premises and AWS, fulfilling the encryption requirement. Gateway Load Balancer (GLB) is designed to insert third-party virtual appliances, such as firewalls, into the network path, allowing for inline inspection of all cloud traffic before it leaves the cloud for on-premises or the internet. AWS Shield Advanced provides enhanced DDoS protection, including financial protection (DDoS cost protection), for internet-facing assets, which is crucial for the patient appointment booking system. Traffic Mirroring is for out-of-band analysis, not inline inspection. Deploying AWS WAF is good but Shield Advanced offers broader protection, including financial. Using Lambda to modify security groups is a reactive measure and not a primary, comprehensive inspection or protection strategy.