You are designing the architecture for your organization so that clients can connect to certain Google APIs. Your plan must include a way to connect to Cloud Storage and BigQuery. You also need to ensure the traffic does not traverse the internet. You want your solution to be cloud-first and require the least amount of configuration steps. What should you do?

A. Configure Private Google Access on the VPC resource. Create a default route to the internet. B. Configure Private Google Access on the subnet resource. Create a default route to the internet. C. Configure Cloud NAT, and remove the default route to the internet. D. Configure a global Secure Web Proxy, and remove the default route to the internet.