Your data science team uses managed notebook instances to access data in secured object storage. Security policy requires that all notebooks run inside a private corporate network with no internet access, and all traffic to storage and managed ML services must stay within the cloud provider's network. How should notebook instances be configured to satisfy these requirements?

The correct answer ensures that notebooks run in a private network without internet access, and all traffic remains within the cloud provider's network. Placing notebooks in a private subnet and using VPC interface endpoints (powered by AWS PrivateLink) for object storage and managed ML services allows secure, private communication without traversing the public internet. The first incorrect option, hosting managed ML endpoints and object storage inside the same VPC, is not always feasible for managed services, which often reside in the cloud provider's service VPCs. The second incorrect option, relying solely on IAM policies, addresses authentication but not network isolation from the internet. The fourth incorrect option, using a NAT gateway, would provide outbound internet access, which violates the requirement of no internet access for the notebooks.