You are configuring the cloud network architecture for the newly created project in Google Cloud that will host applications in Compute Engine. Compute Engine virtual machine instances will be created in two different subnets (aub-a and sub-b) within a single region. Instances in sub-a will have public IP addresses. Instances in sub-a will have only private IP addresses. To download updated packages, instances must connect to a public repository outside the boundaries of Google Cloud. You need to allow sub-b to access the external repository. What should you do?