Option A and Option B are the Correct choices because , a 429 error is caused by Too Many Requests.If your application tries to use more than its limit, additional requests will fail. Throttle your client's requests, and/or use truncated exponential backoff.
Option C is Incorrect choice because, a OAuth access token has expiry would result in error
401(Unauthorized)
Option D is Incorrect because, using wrong verb with /upload or /download URLs would lead to
405 (method not allowed error).

Invalidate the specific video path in Cloud CDN so cached copies of the old file are removed immediately and new requests fetch the updated version from the on-premises origin. Keep signed URLs in place for access control, and generate fresh signed URLs for users so authorized access continues cleanly with the updated content. Rotating keys is a security action, not a cache refresh mechanism.

https://cloud.google.com/load-balancing/docs/l7-internal/setting-up-l7-internal#configure-a-network

Enabling Cloud NAT logging surfaces NAT gateway events, like ephemeral port exhaustion or allocation failures, that can disrupt TCP sessions without affecting ICMP. Reviewing those logs for your SaaS provider's destination IP around the error window will reveal whether Cloud NAT is dropping or throttling connections, giving you direct insight into intermittent outbound TCP failures.

Shared VPC and DNS resolution:
In a Shared VPC model, the host project manages the network resources (e.g., VPCs), while the service projects contain workloads that use the Shared VPC. For private DNS resolution, DNS zones in service projects must be associated with the Shared VPC.
Cross-project binding:
- Cloud DNS cross-project binding allows private DNS zones created in service projects to be associated with the Shared VPC in the host project. This enables workloads in service projects to resolve private DNS zones independently while sharing the same network.
- Cross-project binding simplifies DNS management by allowing service project owners to manage their own private DNS zones without requiring direct access to the host project.
Workloads resolving all private zones:
- Using cross-project binding, all workloads in the Shared VPC (across service projects) can resolve private DNS zones defined in other service projects.
- This ensures full DNS resolution across the organization while maintaining independent DNS management for service project owners.
This solution meets the requirements of enabling service project owners to independently manage DNS zones while ensuring that all workloads can resolve private zones across the Shared VPC. It aligns with Google Cloud's best practices for Shared VPC and DNS management.