Authorizing with a service account
gcloud auth activate-service-account authorizes access using a service account. As with gcloud init and gcloud auth login, this command saves the service account credentials to the local system on successful completion and sets the specified account as the active account in your Cloud SDK configuration.
https://cloud.google.com/sdk/docs/authorizing#authorizing_with_a_service_account

The correct answer is C because the requirement is strict least privilege. The operations team only needs three actions: start, stop, and reset existing Compute Engine VM instances. A custom IAM role is the correct mechanism when predefined roles are too broad. Google Cloud custom roles are designed so administrators can include only the permissions required for a specific operational task, and the role definition explicitly lists included permissions. Viewer cannot start, stop, or reset instances, so B is not functional. Instance Admin is too broad because it includes administrative permissions beyond the stated task. IAM Conditions cannot simply subtract a single permission from an overprivileged predefined role.

Coldline Storage is a very-low-cost, highly durable storage service for storing infrequently accessed data.
Coldline Storage is ideal for data you plan to read or modify at most once a quarter. Since we have a requirement to access data once a quarter and want to go with the most cost-efficient option, we should select Coldline Storage.
Ref: https://cloud.google.com/storage/docs/storage-classes#coldline

* Given that the new instance wants to access the application on the existing compute engine instance, these applications seem to be related so they should be within the same VPC. It is possible to have them in different VPCs and peer the VPCs but this is a lot of additional work and we can simplify this by choosing the option below (which is the answer)
1. Create a subnet in the same VPC, in europe-west1.
2. Create the new instance in the new subnet and use the first instance subnets private address as the endpoint.
is the right answer.
* We can create another subnet in the same VPC and this subnet is located in europe-west1. We can then spin up a new instance in this subnet. We also have to set up a firewall rule to allow communication between the two subnets. All instances in the two subnets with the same VPC can communicate through the internal IP Address Ref: https://cloud.google.com/vpc