You're setting up the network architecture for a newly launched project at NovaEdge Technologies , which will host applications on Google Compute Engine. Virtual machine (VM) instances will be deployed in two different subnets within a single region: Instances in subnet-alpha will have public IP addresses. Instances in subnet-beta will use only private IP addresses. To keep their software up to date, all instances must be able to access a public package repository hosted outside of Google Cloud. How can you allow instances in subnet-beta to reach the external repository?