A legacy application that uses MongoDB is being migrated to AWS. Company policy requires all EC2 instances to be in private subnets without internet access, all application-database communication to be encrypted, and the database to scale with demand. Which solution satisfies these constraints?

The correct solution uses Amazon DynamoDB with on-demand capacity and a gateway VPC endpoint. DynamoDB is a fully managed, scalable NoSQL database service that supports document data models, making it a suitable replacement for MongoDB. On-demand capacity automatically scales with demand, meeting the requirement. A gateway VPC endpoint allows EC2 instances in private subnets to securely access DynamoDB without traversing the internet, satisfying the company policy. Using an interface VPC endpoint for DynamoDB is incorrect because DynamoDB only supports gateway endpoints. Provisioning Amazon DocumentDB is incorrect because while it offers MongoDB compatibility and can scale, the question specifies all application-database communication must be encrypted. While DocumentDB supports encryption in transit, DynamoDB inherently encrypts all data at rest and in transit, and its serverless nature simplifies operations compared to managing DocumentDB instances and IOPS.