A solutions architect must ensure that API calls to Amazon DynamoDB from Amazon EC2 instances in a VPC never travel across the internet. Which combination of steps should the solutions architect take to meet this requirement? (Choose two.)

To ensure API calls to Amazon DynamoDB from EC2 instances in a VPC never traverse the internet, you need to use a VPC endpoint. Specifically, a gateway endpoint is required for DynamoDB. Creating a gateway endpoint for DynamoDB (a service that uses S3 as a dependency) allows private connectivity from your VPC. Once the gateway endpoint is created, a route table entry for the endpoint is automatically added to the route tables associated with the subnets where the endpoint is enabled. This entry directs traffic destined for DynamoDB through the private endpoint instead of the internet gateway. Creating an interface endpoint for Amazon EC2 is incorrect because DynamoDB uses gateway endpoints, not interface endpoints. Creating an elastic network interface for the endpoint is not applicable to gateway endpoints; ENIs are used for interface endpoints. Creating a security group entry in the endpoint's security group is incorrect because gateway endpoints do not use security groups.