You are configuring networking for a Dataflow job. The data pipeline uses custom container images with the libraries that are required for the transformation logic preinstalled. The data pipeline reads the data from Cloud Storage and writes the data to BigQuery. You need to ensure cost-effective and secure communication between the pipeline and Google APIs and services. What should you do?

A. Disable external IP addresses from worker VMs and enable Private Google Access. B. Leave external IP addresses assigned to worker VMs while enforcing firewall rules. C. Disable external IP addresses and establish a Private Service Connect endpoint IP address. D. Enable Cloud NAT to provide outbound internet connectivity while enforcing firewall rules.