A healthcare company requires that Amazon SageMaker notebook instances access sensitive training data in S3 without any traffic traversing the public internet. Which combination of steps should an ML specialist perform to meet these requirements? (Choose two.)

To ensure sensitive data in S3 is accessed without traversing the public internet, the SageMaker notebook instance must be launched within a Virtual Private Cloud (VPC) and configured to prevent internet access. This isolates the notebook environment. An S3 VPC endpoint (specifically a Gateway endpoint) is then crucial because it allows private connectivity from instances within your VPC to S3 without requiring an internet gateway, NAT device, or VPN connection. This combination ensures that all traffic between the SageMaker notebook and S3 stays within the AWS network, never touching the public internet. Creating a VPN tunnel between SageMaker and S3 is not a standard or necessary configuration for this use case. An S3 bucket policy can restrict access but doesn't, by itself, guarantee private connectivity from a SageMaker instance. AWS Transit Gateway is for connecting multiple VPCs or on-premises networks and is not directly used to privatize S3 access for a single VPC.