https://cloud.google.com/run/docs/tutorials/gcloud
https://cloud.google.com/resource-manager/docs/creating-managing-projects
https://cloud.google.com/iam/docs/understanding-roles#primitive_roles
You can shut down projects using the Cloud Console. When you shut down a project, this immediately happens: All billing and traffic serving stops, You lose access to the project, The owners of the project will be notified and can stop the deletion within 30 days, The project will be scheduled to be deleted after 30 days.
However, some resources may be deleted much earlier.

The correct answer is D because Workload Identity Federation for GKE is the recommended way to let Kubernetes workloads access Google Cloud services without service account keys. It maps Kubernetes service accounts to Google service accounts and allows workloads to receive short-lived credentials automatically. This satisfies the security policy that prohibits key creation and avoids the operational risk of storing long-lived credentials inside containers, Secrets, or images. Personal user credentials are inappropriate for production workloads because they are tied to an individual and are difficult to audit and rotate. Creating keys in another project or overriding organization policy defeats the security requirement. Workload Identity Federation provides secure, auditable, keyless authentication for GKE workloads.

1. Create an ingress firewall rule with the following settings: " ¢ Targets: all instances with tier #2 service account " ¢ Source filter: all instances with tier #1 service account " ¢ Protocols: allow TCP:8080 2. Create an ingress firewall rule with the following settings: " ¢ Targets: all instances with tier #3 service account " ¢ Source filter: all instances with tier #2 service account " ¢ Protocols: allow TCP: 8080