You must deploy a GKE cluster that can reach third-party Internet services while Compute Engine instances are not allowed public IPs. What networking configuration meets this requirement?

The correct option is to configure the GKE cluster as a private cluster and use Cloud NAT Gateway for the cluster subnet. A private GKE cluster ensures that nodes do not have public IP addresses, meeting the requirement. Cloud NAT allows instances without public IPs to initiate outbound connections to the internet, translating their private IPs to a public NAT IP. This enables access to third-party internet services while maintaining private node IPs. Configuring only Private Google Access on the VPC allows private instances to reach Google APIs and services, but not general third-party internet services. A route-based cluster refers to a routing mode, not a solution for outbound internet access without public IPs. Installing a NAT proxy on a Compute Engine instance is a manual, less scalable, and less resilient solution compared to Cloud NAT Gateway.