AWS PrivateLink provides private connectivity between VPCs, AWS services, and on-premises networks, ensuring traffic does not traverse the public internet.

A is correct:

"AWS PrivateLink provides private connectivity to services across VPCs, keeping API traffic off the public internet."

(Reference: AWS PrivateLink Overview)

B (Amazon Q) is a generative AI assistant, not a network security/control tool.

C (CloudFront) is a CDN, not for private API calls.

D (CloudTrail) is for logging and monitoring, not secure connectivity.