An administrative application is running on a virtual machine (VM) in a managed group at port 5601 inside a Virtual Private Cloud (VPC) instance without access to the internet currently. You want to…

A bastion host with OS Login is primarily used for secure SSH access to VMs, not for exposing a web interface with Google credential-based authentication for web users.

Modifying VPC routing to point to the default internet gateway would expose the VM directly to the internet, creating a significant security risk, and does not inherently enforce Google credentials for authentication at the web interface level.

Configuring an SSH bastion host in a public network is for secure shell access to VMs, not for exposing a web-based administrative interface and enforcing web authentication with Google credentials.

Configuring an HTTP(S) Load Balancing instance that points to the managed instance group and enabling Identity-Aware Proxy (IAP) allows you to securely expose the internal web interface. IAP provides fine-grained access control based on Google identities, enforcing authentication and authorization with Google credentials before users can reach the application, while keeping the backend VM private without direct internet access.