A network operations team must centrally manage a cloud networking environment for multiple teams. Each team needs to deploy and manage its own resources. The environment must support IPv4 and IPv6 (dual-stack) and provide dual-stack internet connectivity. The company has an AWS Organization with a workload account and the network engineer created a dedicated networking account. Which combination of steps should the network engineer perform next? (Choose three.)

The first correct step is to create a dual-stack VPC. Requesting an Amazon-provided IPv6 CIDR block is the standard and recommended practice for IPv6 in AWS, offering simplicity and ensuring global uniqueness. Using /24 for IPv4 subnets and /64 for IPv6 subnets are best practices for typical deployments. Assigning a specific IPv6 block (like 2001:db8:c5a:6000::/56) is incorrect as AWS does not allow customers to specify their own IPv6 CIDR blocks for VPCs; it must be Amazon-provided. The second correct step involves using AWS Resource Access Manager (RAM) to share resources. Sharing only the subnets (not the entire VPC) allows the workload account to launch resources within those pre-defined network segments while maintaining central control over the VPC structure in the networking account. Sharing the entire VPC would grant too much control to the workload account, undermining central management. The third correct step ensures dual-stack internet connectivity. An Internet Gateway (IGW) is needed for IPv4 internet access, and an Egress-Only Internet Gateway (EIGW) is required for IPv6 outbound-only internet access from private subnets. NAT Gateways provide IPv4 outbound internet access for private instances, and deploying them in public subnets is standard. NAT instances are an older, less scalable, and less resilient solution compared to NAT Gateways.