NAT is outbound-only, always — a genuine exam trap.
VPN sets up in minutes; Interconnect takes weeks for far more bandwidth.
OptionBandwidthSetup time
Cloud VPNSeveral Gbps/tunnelMinutes
Cloud Interconnect10-100+ GbpsDays to weeks
Cloud DNS: public zones for external records, private zones resolvable only inside your VPC. Cloud NAT: outbound-only internet for no-external-IP instances — never a mechanism for inbound access.