Your Company Has Workloads Running on Compute Engine and On-Premises

Your company has workloads running on Compute Engine and on-premises. The Google Cloud Virtual Private Cloud (VPC) is connected to your WAN over a Virtual Private Network (VPN) . You need to deploy a new Compute Engine instance and ensure that no public Internet traffic can be routed to it. What should you do?

A) Create the instance without a public IP address.
B) Create the instance with Private Google Access enabled.
C) Create a deny-all egress firewall rule on the VPC network.
D) Create a route on the VPC to route all traffic to the instance over the VPN tunnel.