A retailer exports data daily from its transactional databases into an S3 bucket in the Sydney region. The retailer`s Data Warehousing team wants to import this data into an existing Amazon Redshift cluster in their VPC in Sydney. Corporate security policy mandates that data can only be transported within the AWS`s private network.
Which steps would satisfy the security policy? 
(SELECT TWO.)

Answer options:

A.Enable Amazon Redshift Enhanced VPC Routing.
B.Create a Cluster Security Group to allow the Amazon Redshift cluster to access Amazon S3.
C.Create a NAT gateway in a public subnet to allow the Amazon Redshift cluster to access Amazon S3. 
D.Create and configure an Amazon S3 VPC endpoint. 

Correct Answer – A and D
Amazon Redshift Enhanced VPC Routing provides VPC resources access to Redshift.
Redshift will not be able to access the S3 VPC endpoints without enabling Enhanced VPC routing. So one option will not support the scenario if another is not selected.
NAT instance (the proposed answer) cannot be reached by Redshift without enabling Enhanced VPC Routing.
https://aws.amazon.com/about-aws/whats-new/2016/09/amazon-redshift-now-supports-enhanced-vpc-routing/
Option D:
VPC Endpoints - It enables you to privately connect your VPC to the supported AWS Services and VPC Endpoint services powered by PrivateLink without requiring an IGW, NAT Device, VPN Connection or AWS Direct Connect connections. Instances in VPC do not require Public IP addresses to communicate with resources in the service and traffic between your VPC and other service does not leave the Amazon network.
S3 VPC Endpoint - it is a feature that will allow you to make even better use of VPC and S3.
I recommend you to look into the following URLs to know the concept further.
https://aws.amazon.com/blogs/aws/new-vpc-endpoint-for-amazon-s3/
https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-s3.html