A. Correct.
Apigee quota policies are built for API quota enforcement, and asynchronous quota enforcement prioritizes speed when exact counts are less important.

B. Incorrect.
Firestore can store counters, but synchronous updates on every API call add latency and contention.

C. Incorrect.
In-memory counters are not reliable across multiple instances, restarts, or scaling events.

D. Incorrect.
BigQuery is not designed for low-latency per-request quota checks.

A. Correct.
Cloud Run scales containerized services automatically, including scale-to-zero, which fits unpredictable request-driven workloads.

B. Incorrect.
Managed instance groups can autoscale, but VM capacity is slower to add and can leave more idle infrastructure.

C. Incorrect.
Unmanaged instance groups do not provide the desired automated scaling behavior.

D. Incorrect.
GKE can scale, but cluster capacity and operations add overhead for this simple spiky backend.

A. Incorrect.
Disk export is heavier than needed for initial boot troubleshooting.

B. Correct.
Serial port output and Cloud Logging are the fastest places to inspect boot and startup-script failures for Compute Engine images.

C. Incorrect.
Rebuilding without evidence does not identify the cause of the failed boot.

D. Incorrect.
Skipping startup scripts and production testing increases risk and avoids the root cause.

A. Incorrect.
VMs add management overhead for static content serving.

B. Incorrect.
Unmanaged groups increase operational burden and reduce reliability.

C. Incorrect.
A regional bucket is less globally resilient than a multi-region bucket for global static content.

D. Correct.
Cloud Storage with a backend bucket and Cloud CDN provides low-management, reliable global delivery.

A. Incorrect.
Audit-log-triggered functions do not provide a practical local development loop.

B. Incorrect.
Changing the trigger model just for testing can create differences from production behavior.

C. Correct.
Functions Framework is the recommended way to run and test Cloud Functions code locally.

D. Incorrect.
Testing changes in production traffic is risky and slower than local iteration.

A. Correct.
Git plus Cloud Build and Terraform provides versioned, auditable IaC, and Cloud Functions is a serverless managed platform.

B. Incorrect.
Self-managed Jenkins adds operational overhead and the option does not emphasize auditable infrastructure changes.

C. Incorrect.
Compute Engine is not serverless compute.

D. Incorrect.
Ad hoc gcloud commands are less auditable and repeatable than infrastructure as code.

A. Correct.
A separate KMS project helps separate key administration from workload administration.

B. Correct.
Avoiding project-level Owner on the KMS project reduces overly broad access to key administration.

C. Incorrect.
Putting keys in each workload project weakens separation between key and workload administrators.

D. Incorrect.
Workload owners should not automatically administer encryption keys.

E. Incorrect.
Using the same owner for both sides defeats separation of duties.

A. Incorrect.
Network Policies control traffic flow but do not encrypt allowed traffic.

B. Correct.
A supported service mesh can add mTLS between services with minimal application code changes.

C. Incorrect.
Network ranges do not encrypt traffic.

D. Incorrect.
Manual certificate handling and code changes increase operational work and are slower to implement safely.

A. Correct.
gsutil cp is the standard command-line tool pattern for copying local files to Cloud Storage.

B. Incorrect.
gcloud does not provide a generic gcloud cp command for this Cloud Storage copy pattern.

C. Incorrect.
hadoop fs commands are useful within Hadoop contexts, but gsutil is the direct upload tool from an on-premises VM.

D. Incorrect.
gcloud dataproc is for Dataproc management, not generic object upload.

A. Correct.
GKE cluster notifications publish relevant cluster events to Pub/Sub for automation and alerting.

B. Incorrect.
A scheduled query is indirect and does not use GKE's built-in event notification mechanism.

C. Incorrect.
Polling is less efficient and can miss contextual event types.

D. Incorrect.
RSS release notes are not targeted operational notifications for your clusters.