You are designing a secure data perimeter for a highly regulated project. You have implemented VPC Service Controls (VPC SC). You also have VMs in a private subnet (no external IPs) that need to access Cloud Storage buckets within the perimeter. Which TWO configurations are required to make this work? (Select TWO)

To securely access Google APIs from private VMs, you must enable Private Google Access on the subnet. This routes traffic to Google APIs internally. When VPC Service Controls is enabled, it blocks access to services like Cloud Storage. To allow the private VMs to access the storage, the VPC network hosting the VMs must be explicitly added to the VPC SC perimeter. This creates a trusted boundary containing both the VMs and the Storage buckets.