A company creates a VPC that has one public subnet and one private subnet. The company attaches an internet gateway to the VPC. An Application Load Balancer (ALB) in the public subnet communicates with Amazon EC2 instances in the private subnet. The EC2 instances in the private subnet must be able to download operating system and application updates from the internet. The instances must not be accessible from the internet. Which combination of steps will meet these requirements? (Select THREE)