A company runs a public-facing three-tier web application in a VPC across multiple Availability Zones

Amazon EC2 instances for the application tier running in private subnets need to download software patches from the internet. However, the instances cannot be directly accessible from the internet.

Which actions should be taken to allow the instances to download the needed patches? (Select TWO.)

1. Configure a NAT gateway in a public subnet.
2. Define a custom route table with a route to the NAT gateway for internet traffic and associate it with theprivate subnets for the application tier.
3. Assign Elastic IP addresses to the application instances.
4. Define a custom route table with a route to the internet gateway for internet traffic and associate it withthe private subnets for the application tier.
5. Configure a NAT instance in a private subnet.