You need VMs that are reachable from the public internet via IPv6 while keeping IPv4 for internal services. Which configuration meets this requirement on Google Cloud?

Assigning external IPv6 addresses to VM NICs (dual-stack) directly enables public internet reachability via IPv6. This allows the VM to have both an external IPv6 address for public access and an internal IPv4 address for private network communication, fulfilling the requirement. Using internal IPv6 Unique Local Addresses (ULA) and advertising them to the internet is incorrect because ULAs are designed for private networks and are not globally routable; advertising them publicly would not work. Enabling IPv6 on a subnet provides private IPv6 routing within the VPC but does not automatically provide public internet egress without assigning external IPv6 addresses. Configuring alias IPv6 ranges is primarily for assigning multiple IPv6 addresses to a single NIC, not for enabling public internet reachability for the primary interface.