A. Correct.
Cloud Run is serverless and supports routing percentages of traffic to revisions.

B. Incorrect.
GKE is not the simplest serverless option.

C. Incorrect.
App Engine versions can split traffic, but creating a separate service for each version is not the right approach.

D. Incorrect.
Changing function names does not provide controlled production traffic splitting.

A. Incorrect.
seek changes the subscription cursor; it does not fetch and acknowledge messages.

B. Incorrect.
topics describe shows metadata about the topic, not messages in the subscription.

C. Correct.
subscriptions pull retrieves messages from the subscription, and --auto-ack acknowledges them.

D. Incorrect.
Listing subscriptions does not pull messages.

A. Incorrect.
Cloud Logging exports are not controlled through VM metadata, and broad BigQuery write grants are unnecessary.

B. Correct.
A Cloud Logging sink can route matching logs directly to BigQuery with minimal management.

C. Incorrect.
Pub/Sub and Cloud Functions add unnecessary moving parts and cost.

D. Incorrect.
Batch copying logs from VMs is more operationally complex than a managed sink.

A. Incorrect.
Billing Account User alone allows using a billing account, but project billing linkage also needs project billing permissions.

B. Incorrect.
The requirement is for finance, not engineering.

C. Correct.
Billing Account User plus Project Billing Manager lets finance link projects to billing accounts without broader project administration.

D. Incorrect.
This grants the wrong team the billing linkage capability.

A. Incorrect.
There is no need to move platforms to test a small percentage of traffic.

B. Incorrect.
Compute Engine adds management overhead and does not use App Engine's built-in versioning.

C. Incorrect.
Traffic splitting is between versions of a service, not separate applications.

D. Correct.
App Engine supports splitting traffic across deployed versions.

A. Incorrect.
Metrics show aggregate behavior, not detailed data access identities.

B. Incorrect.
Admin Activity logs show administrative changes, not all object data access.

C. Correct.
Data Access audit logs record who accessed Cloud Storage data and can be queried in Logs Explorer.

D. Incorrect.
Admin Activity logs alone are not enough for data access auditing.

A. Correct.
Attaching the intended service account to the VM lets applications use metadata-server credentials without keys.

B. Incorrect.
Project metadata is not a secure place for service account keys.

C. Incorrect.
VM metadata can be read by processes on the VM and should not hold private keys.

D. Incorrect.
Long-lived key files on disk are less secure than attached service accounts.

A. Correct.
Without an external IP address, the VM cannot be reached directly from the public internet.

B. Incorrect.
Private Google Access controls private access to Google APIs, not public inbound access to the VM.

C. Incorrect.
Egress rules affect outbound traffic, not inbound public reachability.

D. Incorrect.
Routes do not remove the VM's public internet exposure if it has an external IP.

A. Incorrect.
The Browser role is right, but granting to a group is better for lifecycle management.

B. Incorrect.
Role Viewer shows IAM role definitions, not the resource hierarchy.

C. Correct.
roles/browser grants read access to browse the resource hierarchy, and groups are recommended for IAM management.

D. Incorrect.
roles/iam.roleViewer does not provide the needed hierarchy browsing access.

A. Incorrect.
Shorter-lived keys still violate the no-key requirement and add operational risk.

B. Incorrect.
A longer key exception is even less aligned with the policy.

C. Correct.
Workload Identity Federation for GKE lets Pods access Google Cloud APIs without service account keys.

D. Incorrect.
Kubernetes Secrets containing keys are exactly what the organization policy is trying to avoid.