A hybrid application requires encrypted private-IP connectivity over Direct Connect to a Transit Gateway. The company cannot use public VPN endpoint addresses. Which design is appropriate?

1. Associate a private VIF directly with an internet gateway.
2. Use a public virtual interface alone and assume Direct Connect encrypts the payload.
3. Use a private IP Site-to-Site VPN over Direct Connect with a transit virtual interface.
4. Replace the Transit Gateway with an S3 gateway endpoint.