An organization's architecture consists of an Amazon Elastic Compute Cloud (Amazon EC2) instance running in a public subnet and a database instance running in a private subnet. A user must prevent their database tier from being accessed from the internet. However, they still need the instance to reach the internet to download updates and patches. What do they need to configure to meet these requirements? A network address translation (NAT) gateway that is located in the private subnet O A network address translation (NAT) gateway that is located in the public subnet O A virtual private cloud (VPC) endpoint O An internet gateway that is located in the private subnet