You want to set up a secure, internal network within Google Cloud for database servers. The servers must not have any direct communication with the public internet. What should you do?

Using a NAT gateway provides outbound internet access, which contradicts the requirement that database servers must not have any direct communication with the public internet (this implies both inbound and outbound).

Assigning static public IP addresses directly exposes the database servers to the public internet, even with firewall rules, thereby violating the requirement for no direct public internet communication.

Creating a Virtual Private Cloud (VPC) with a private subnet ensures that instances within it are assigned only internal private IP addresses by default. This configuration inherently prevents direct communication with the public internet, establishing a secure and isolated network suitable for sensitive database servers.

Assigning both a private and a public IP address would allow public internet communication, which is explicitly prohibited by the requirement for a secure, internal network without direct public internet access.