The setup requires a publicly accessible (External) and secure (HTTPS) Layer 7 load balancer that can perform URL-based routing to send different types of requests to different backends (Compute Engine for dynamic content, Cloud Storage for static content).
Global External Application Load Balancer is necessary for public access and global traffic distribution.
The URL Map is crucial for routing requests based on the URL path (e.g., /images/*) to a Cloud Storage backend bucket, a core feature of external Application Load Balancers.
A managed SSL certificate is the Google-recommended method to enable HTTPS securely and easily on the Load Balancer itself.
Reference: Google Cloud Documentation - External Application Load Balancer (Serving static content from Cloud Storage):
"You can use a backend bucket with a global external Application Load Balancer to serve static content from Cloud Storage buckets... The backend bucket is referenced by the URL map." Reference: Google Cloud Documentation - SSL certificates (Managed certificates):
"Google-managed SSL certificates are a recommended best practice because Google Cloud automatically manages the certificate for you."

To adhere to the most secure way and Google-recommended practices, you must avoid the creation and handling of service account key files.
Option B (Impersonation): This method allows the currently logged-in user to temporarily assume the identity and permissions of the service account. It is keyless, meaning no long-lived secret is downloaded or stored on the local machine, drastically improving security. The gcloud config command sets this behavior for all subsequent gcloud commands in the session.
Reference: Google Cloud Documentation - Best practices for using service accounts:
"Avoid creating service account keys... Instead, use service account impersonation or workload identity federation." Reference: Google Cloud Documentation - Service Account Impersonation (Overview):
"With service account impersonation, a user or service can temporarily gain the permissions of a service account... [This] helps you to avoid creating and downloading a service account key." Here are the verified answers and explanations for the questions provided, following the requested format.

A simple approach would be to use the command flags available when listing all the IAM policy for a given project. For instance, the following command: `gcloud projects get-iam-policy $PROJECT_ID --flatten=" bindings[].members" --format="table(bindings.members)" --filter="bindings.role:roles/owner"` outputs all the users and service accounts associated with the role 'roles/owner' in the project in question. https://groups.
google.com/g/google-cloud-dev/c/Z6sZs7TvygQ?pli=1

Best practices for persistent disk snapshots
You can create persistent disk snapshots at any time, but you can create snapshots more quickly and with greater reliability if you use the following best practices.
Creating frequent snapshots efficiently
Use snapshots to manage your data efficiently.
Create a snapshot of your data on a regular schedule to minimize data loss due to unexpected failure.
Improve performance by eliminating excessive snapshot downloads and by creating an image and reusing it.
Set your snapshot schedule to off-peak hours to reduce snapshot time.
Snapshot frequency limits
Creating snapshots from persistent disks
You can snapshot your disks at most once every 10 minutes. If you want to issue a burst of requests to snapshot your disks, you can issue at most 6 requests in 60 minutes.
If the limit is exceeded, the operation fails and returns the following error:
https://cloud.google.com/compute/docs/disks/snapshot-best-practices