A company has multiple web applications running on Amazon EC2 instances in private subnets. The EC2 instances require connectivity to the internet for patching purposes, but cannot be publicly accessible.
Which step will meet these requirements?

A. Add an internet gateway and update the route tables.
B. Add a NAT gateway to the VPC and update the route tables.
C. Add an interface endpoint and update the route tables.
D. Add a virtual gateway to the VPC and update the route tables.