You route egress 0.0.0.0/0 to a third-party NGFW. Instances without external IPs must access BigQuery and Pub/Sub without traversing the firewall. Which two actions accomplish this?

Enabling Private Google Access (PGA) on the subnet allows instances without external IP addresses to reach Google APIs and services, including BigQuery and Pub/Sub, using internal IP addresses. This bypasses the third-party NGFW for Google services. Creating custom static routes for Google APIs' external IP ranges, directing them to the default internet gateway, ensures that traffic destined for these specific Google services also bypasses the NGFW. These two actions together provide the necessary connectivity without traversing the firewall. Enabling PGA at the VPC level is not an option; PGA is configured per subnet. Private Services Access is for connecting to managed services in a Google-managed VPC, not for general Google APIs. Directing internal IPs to the default internet gateway is incorrect as Google APIs use external IP ranges.