You enabled Private Google Access on subnets, but internet egress is hairpinned to on-prem and VPC Service Controls are in use. Which DNS and routing changes let instances reach Google APIs while keeping on-prem inspection?

The correct option ensures instances use the restricted.googleapis.com endpoint, which is compatible with VPC Service Controls and allows access to Google APIs over Google's internal network, bypassing the on-prem firewall for API traffic while still allowing on-prem inspection for general internet egress. The private DNS zone maps API requests to this restricted endpoint. The custom route for the restricted API address range directs this specific traffic to the default internet gateway, enabling connectivity to Google's internal network. The incorrect options either use private.googleapis.com, which is for instances without external IP addresses and doesn't align with the "hairpinned to on-prem" scenario, or incorrectly modify the default route, which would disrupt the existing on-prem inspection for general internet traffic.