Compute Engine instances run an app that uses BigQuery and writes results to Cloud Storage. No instance may have an external IP. Which two methods allow the instances to access Google services without external IPs? (Choose two.)

Private Google Access allows instances without external IP addresses on a subnet to reach Google APIs and services, including BigQuery and Cloud Storage, using internal IP addresses. This is enabled per subnet. Cloud NAT allows instances without external IP addresses to connect to the internet, including Google services, by translating their internal IP addresses to a public IP address managed by the NAT gateway. This provides outbound connectivity without assigning external IPs to individual instances. Enabling Private Google Access on the VPC is incorrect because it's a subnet-level setting. Private Services Access is for connecting to managed services in a Google-managed VPC, not for instances in your VPC accessing public Google services. Network peering is not used for direct access to BigQuery.