A solutions architect creates a VPC with two public subnets and two private subnets. A corporate security mandate requires launching all Amazon EC2 instances in private subnets. When the solutions architect launches an EC2 instance that runs a web server on ports 80 and 443 in a private subnet, no external internet traffic can reach the server. What should the solutions architect do to resolve this?

The correct solution is to provision an internet-facing Application Load Balancer (ALB) in a public subnet and add the EC2 instance to its target group. This allows external internet traffic to reach the ALB, which then forwards requests to the private EC2 instance. The DNS record should resolve to the ALB's DNS name. Attaching the EC2 instance to an Auto Scaling group in a private subnet doesn't directly solve the problem of external access; Auto Scaling groups manage instance scaling, not internet exposure. Launching a NAT gateway in a private subnet allows instances in private subnets to initiate outbound connections to the internet, but it