A VPC spans two Availability Zones. Each AZ has one private subnet and one public subnet. There are three route tables: one shared by the public subnets and one private route table per AZ. All four subnets are attempting to route outbound traffic through the VPC’s internet gateway. Which actions should the security engineer take to remediate this? (Choose two.)

Private subnets cannot directly access the internet via an internet gateway. They require a Network Address Translation (NAT) gateway. To ensure high availability and proper routing, a NAT gateway should be provisioned in the public subnet of each Availability Zone. This allows instances in the private subnets to initiate outbound connections while remaining isolated from direct inbound internet traffic. Subsequently, each private subnet's route table must be updated to direct all outbound internet-bound traffic (0.0.0.0/0) to the NAT gateway located in its respective Availability Zone's public subnet. Incorrect options: Provisioning a NAT gateway in the private subnet is incorrect because NAT gateways require a public IP address and must be in a public subnet to route traffic to the internet gateway. Modifying public subnet route tables with a local route to the VPC CIDR is unnecessary and does not address private subnet internet access. Local routes are automatically handled. Targeting the internet gateway directly from a private subnet's route table is incorrect; private subnets cannot directly use an internet gateway.