Question

Your team runs several Compute Engine VMs in a private subnet with no external IP addresses. These VMs need to download OS security patches from public repositories on the internet, but they must not be reachable from the internet inbound. You want a fully managed solution that requires minimal ongoing maintenance. What should you configure?

Accepted Answer

Configure Cloud NAT on a Cloud Router for the subnet's region

Answer

Assign ephemeral external IP addresses to each VM and create an egress firewall rule allowing outbound traffic

Answer

Deploy a Compute Engine instance as a NAT gateway and add a custom route with that instance as the next hop

Answer

Create an external HTTP(S) Load Balancer in front of the VMs to broker outbound connections