You are designing subnet architecture for Azure virtual networks. Which three of the following resources require their own dedicated subnet? (Choose three.)

Azure Bastion, Azure Application Gateway v2, and VPN gateways each require their own dedicated subnet. Azure Bastion needs a subnet named AzureBastionSubnet with a minimum /27 prefix. Application Gateway v2 requires a dedicated subnet, and no other resources can be deployed within it. VPN gateways also need a dedicated subnet named GatewaySubnet with a minimum /27 prefix. Azure Active Directory Domain Services (Azure AD DS) does not require a dedicated subnet; it can be deployed into an existing subnet. Azure Private Link is a service that enables private connectivity to Azure services over a private endpoint, which is deployed within a regular subnet, not a dedicated one for Private Link itself.