You are configuring the cloud network architecture for a newly created project in Google Cloud that will host applications in Compute Engine. Compute Engine virtual machine instances will be created in two different subnets (sub-a and sub-b) within a single region: • Instances in sub-a will have public IP addresses. • Instances in sub-b will have only private IP addresses. To download updated packages, instances must connect to a public repository outside the boundaries of Google Cloud. You need to allow sub-b to access the external repository. What should you do?

The correct solution is to configure Cloud NAT and select sub-b in the NAT mapping section. Cloud NAT allows instances with only private IP addresses (like those in sub-b) to initiate outbound connections to the internet, including public repositories, without exposing them directly to the internet. This meets the requirement for sub-b instances to download packages. Enabling Private Google Access on sub-b would allow instances to reach Google APIs and services using internal IP addresses, but not external public repositories. Configuring a bastion host in sub-a would primarily be for inbound SSH access to instances in sub-b, not for outbound internet access from sub-b. Enabling Identity-Aware Proxy for TCP forwarding is for secure inbound access to instances, not for outbound internet connectivity.