A is the correct choice because Cloud Identity-Aware Proxy (IAP) enables SSH access to VMs without external IPs or direct internet access, without requiring network configuration changes. This solution automatically applies to new VMs in the project. B and D are incorrect as SSH keypairs do not solve the lack of public IPs. C is incorrect because HTTPS configuration does not support SSH or TCP access. D is also a security risk due to the exposure of private keys. For more details, refer to Google Cloud IAP documentation and this Medium article.