You have Compute Engine VMs in a single region across two subnets: sub-a (public IPs) and sub-b (private IPs only). Instances in sub-b must download packages from external public repositories. How do you enable outbound internet access for sub-b?

Cloud NAT is the correct solution because it allows instances with only private IP addresses (like those in sub-b) to initiate outbound connections to the internet. It translates their private IPs to a public IP address managed by Cloud NAT, enabling access to external public repositories. Private Google Access allows VMs with private IPs to access Google APIs and services without public IPs, but it does not provide general internet access. A bastion host provides inbound SSH access to private instances, not outbound internet access for package downloads. Identity-Aware Proxy (IAP) TCP forwarding secures inbound access to private instances from external users, not outbound internet access from the instances themselves.