How should this be accomplished?

A customer wants to run a batch processing system on VMs and store the output files in a Cloud Storage bucket. The networking and security teams have decided that no VMs may reach the public internet.

How should this be accomplished?
A . Create a firewall rule to block internet traffic from the VM.
B . Provision a NAT Gateway to access the Cloud Storage API endpoint.
C . Enable Private Google Access on the VPC.
D . Mount a Cloud Storage bucket as a local filesystem on every VM.

Answer: C

Explanation:

https://cloud.google.com/vpc/docs/private-google-access