A SaaS provider runs its service on EC2 instances in a VPC. Customers also run in AWS, but their IP ranges overlap with the provider's VPC. Customers will not disclose their internal IP ranges and they do not want to connect over the public internet. Which combination of steps is part of a solution that satisfies these constraints? (Choose two.)

The core problem is overlapping IP ranges and the need for private connectivity. AWS PrivateLink (Endpoint Service) is designed specifically for this scenario. It allows consumers to access services hosted in other VPCs as if they were in their own VPC, without traversing the internet or requiring VPC peering, which fails with overlapping CIDRs. A Network Load Balancer (NLB) is required as the front-end for an Endpoint Service because PrivateLink only supports NLBs, not Application Load Balancers (ALBs). VPC peering would not work due to the overlapping IP ranges. AWS Transit Gateway also does not directly solve the overlapping IP range issue between separate VPCs without complex NAT configurations, which are not inherent to its design for this use case.