A bank runs payment APIs in a private VPC without internet egress and must let on-premises analysts query them over Direct Connect without exposing traffic to the public internet, using private DNS. The solution must avoid VPN operational overhead and scale automatically. Which secure private access design connects analysts to these VPC resources?

The correct design works because interface endpoints create PrivateLink-powered elastic network interfaces inside the API subnets that scale automatically and stay reachable as private IPs over Direct Connect with Route 53 private hosted zone resolution, so analyst queries never traverse the public internet, need no internet gateway, NAT or egress, and incur no VPN tunnels to manage. A highly available EC2 reverse-proxy fleet otherwise meets private connectivity and DNS goals but violates automatic scaling because instances require manual scaling, patching, health management and lifecycle operations unlike AWS-managed endpoint infrastructure. Resolving otherwise identical PrivateLink endpoints through public hosted zones violates the private DNS constraint because public records expose internal names externally, depend on public resolvability and break isolated VPC resolution expected over Direct Connect. Using gateway endpoints violates endpoint-type scope because gateway endpoints provide only S3 and DynamoDB prefix-list routing and cannot front arbitrary private payment APIs, which require interface endpoints with PrivateLink endpoint services. As an exam caveat, distinguish gateway versus interface versus Gateway Load Balancer endpoints and remember PrivateLink scales horizontally without customer VPN overhead. As a practical check, validate end to end from on premises with nslookup and authenticated API calls over Direct Connect, confirm Resolver rules and endpoint policies allow only required principals and actions, and monitor endpoint throughput and Direct Connect virtual interface metrics.