A company runs workloads on EC2 in multiple VPCs in a single Region. They also have anon-premises DNS server(via Direct Connect). All EC2 instances must resolve internal.company.com using private communication. What should a solutions architect do? (Select THREE)