How should this requirement be met?

An application running in a private subnet accesses an Amazon DynamoDB table. There is a security requirement that the data never leave the AWS network.

How should this requirement be met?
A . Configure a network ACL on DynamoDB to limit traffic to the private subnet
B . Enable DynamoDB encryption at rest using an AWS KMS key
C . Add a NAT gateway and configure the route table on the private subnet
D . Create a VPC endpoint for DynamoDB and configure the endpoint policy

Answer: D