A security engineer is designing an ecommerce application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application uses an Amazon RDS DB instance. Only HTTP/HTTPS traffic to the application should be exposed to the internet. The application must call an external payment provider that allows traffic only from a predefined list of source IP addresses. Communications with the provider must not be disrupted as the environment scales. Which combination of actions should the security engineer recommend? (Choose three.)

To ensure only HTTP/HTTPS traffic is exposed and maintain security, the EC2 instances and the RDS DB instance should be placed in private subnets. This prevents direct internet access to these resources, reducing their attack surface. The ALB, which handles incoming internet traffic, would be in a public subnet (implied, as it's internet-facing) and forward requests to the private EC2 instances. For the EC2 instances in private subnets to communicate with the external payment provider, a NAT Gateway is required. Deploying a NAT Gateway in each private subnet for every Availability Zone ensures high availability and fault tolerance for outbound internet connectivity, preventing disruption as the environment scales. Placing the DB instance or EC2 instances in a public subnet would expose them directly to the internet, violating the security requirement. Deploying the ALB in a private subnet would prevent it from receiving internet traffic.