The company must move data between its VPC and an on-premises data center using a dedicated-bandwidth connection, and all in-transit data must be encrypted. The company has engaged an APN Partner to set up the connection. Which combination of steps satisfies these requirements? (Choose three.)

The company needs a dedicated, encrypted connection. A hosted connection, provisioned by an APN Partner, is a type of AWS Direct Connect connection that provides dedicated bandwidth. To encrypt data over Direct Connect, a Site-to-Site VPN connection must be established over the Direct Connect link. This VPN connection requires a public VIF to establish the IPsec tunnel endpoints. Incorrect options: A hosted public virtual interface (VIF) is not a connection type; it's a component of a Direct Connect connection. An AWS Client VPN connection is for end-user access to AWS resources, not for site-to-site connectivity. A private VIF is used for private IP space communication (e.g., to a VPC) and does not inherently provide the public IP addresses needed for a Site-to-Site VPN over Direct Connect.