A customer, DataStreamX Inc. , is running an analytics workload on Google Cloud , where Compute Engine instances read data from Cloud Storage . The security team wants to ensure that these instances do not have access to the internet and also cannot be reached from the internet . Which two configurations should be applied to meet these security requirements? (Choose two.)