You have an on-premises datacenter.

You have an Azure subscription named Sub1 that contains a virtual network named VNet1.

The datacenter is connected to VNet1 by using an ExpressRoute circuit.

You have an SAP RISE managed workload.

You need to integrate Sub1 with the managed workload. The solution must meet the following requirements:

• Minimize latency between the managed workload and the datacenter.

• Restrict the network ports that can be used between the managed workload and VNet1.

• Minimize costs.

What should you use to connect VNet1 and the managed workload, and what should you use to secure the connection? To answer, select the appropriate options in the answer area.