The correct choice is VPC Interface Endpoint. VPC Interface Endpoint uses AWS PrivateLink to place an elastic network interface with a private IP in your subnets so that applications in the VPC can reach Amazon SQS entirely over the AWS network without traversing the public internet.

With a VPC Interface Endpoint AWS provisions an ENI in your subnet that has a private IP and a private route to the service. Traffic to SQS stays on the AWS network and does not require internet gateways or NAT devices. This satisfies the requirement to use private IP addresses only.

AWS Direct Connect provides dedicated connectivity between on premises locations and AWS and it does not create a private endpoint inside the VPC for SQS. It is not used to expose SQS via a private IP inside your VPC.

NAT Gateway provides outbound internet access for resources in private subnets and will route traffic to services over the public internet via an internet gateway. It does not provide a private endpoint to SQS and so it will not keep SQS traffic entirely on private IP addresses.

VPC Gateway Endpoint is limited to Amazon S3 and DynamoDB and cannot be used for SQS. Gateway endpoints remain valid for S3 and DynamoDB but they do not support other services so they are not applicable to private connectivity to SQS.

Full AWS Practitioner Certification Question