Which two methods can you use to accomplish this?

You have an application running on Compute Engine that uses BigQuery to generate some results that are stored in Cloud Storage. You want to ensure that none of the application instances have external IP addresses.

Which two methods can you use to accomplish this? (Choose two.)
A . Enable Private Google Access on all the subnets.
B . Enable Private Google Access on the VPC.
C . Enable Private Services Access on the VPC.
D . Create network peering between your VPC and BigQuery.
E . Create a Cloud NAT, and route the application traffic via NAT gateway.

Answer: A,E

Explanation:

https://cloud.google.com/nat/docs/overview#interaction-pga Specifications

https://cloud.google.com/vpc/docs/configure-private-google-access#specifications