AnyCompany (on premises) acquired Example Corp (entirely in AWS). They connect via Direct Connect and Transit Gateway. Example Corp has an app across two AZs in a VPC (10.0.0.0/16) with no internet gateway and must reach an on-premises app through a restricted contiguous source IP block 10.1.0.0/24 for compliance. The engineer added 10.1.0.0/24 as a secondary CIDR to the VPC. What is the next step to implement a highly available solution that ensures outbound traffic uses the approved IP addresses?

The correct option ensures high availability and compliance. Deploying a private NAT gateway in each AZ, within a subnet using the approved 10.1.0.0/24 range, provides redundancy. Private NAT gateways are necessary because the VPC has no internet gateway and traffic is destined for on-premises. Routing application traffic to the NAT gateway in the same AZ minimizes cross-AZ data transfer costs and latency. The NAT gateway then translates the source IP to an address from the 10.1.0.0/24 range before sending it to the Transit Gateway, satisfying the compliance requirement. Incorrect options: Public NAT gateways require an internet gateway, which is not present in this VPC. Using a single subnet or a single NAT gateway would create a single point of failure, violating the high availability requirement.