Every IAM answer requires the caller to have a Google identity, and the question says they do not — a signed URL carries its own time-limited authorization instead. allAuthenticatedUsers means any Google account on Earth rather than the partner's, allUsers is the public internet, and a mailed key file is a long-lived credential you cannot recall once it is out.

A remote repository is a pull-through cache: the first pull fetches from upstream, subsequent pulls are served locally, and your builds stop depending on anonymous upstream rate limits. A virtual repository only aggregates several repositories behind one endpoint and caches no upstream, a nightly copy job is the same idea rebuilt by hand, and machine size does not change where the bytes come from.

Stable per-replica identity with per-replica storage is a StatefulSet, and loading a kernel module means controlling the host — both sit below what Cloud Run gives you. Low latency, private-IP database access and scale-to-zero are all things Cloud Run does well: latency is a tuning question, private IP is Direct VPC egress, and scaling to zero is the one thing on that list Cloud Run does better than either alternative.

A resumable upload returns a session URI you can query for how many bytes have landed, so a dropped connection continues from that offset instead of restarting. A streaming upload is for when you do not know the final size, and it does not survive a broken connection any better than a single request does.

The guarantee is per key and per region, and it needs both halves — the publisher supplies an ordering key and the subscription is created with message ordering enabled, otherwise messages arrive in whatever order they arrive. There is no cross-key ordering, the serialisation per key costs throughput rather than adding it, and ordering says nothing about duplicates.

An API config is immutable, so every change already produced a new one and the previous config is still there — pointing the gateway back at it is a single command. That immutability is what makes the rollback trivial, which is the reason to stop resenting it. Deleting and recreating the gateway loses its hostname and its warm state, and the backend revision is a different layer entirely.

The strong claim — that Google forbids key downloads — is wrong, and the exam can test the difference between a default and a prohibition. Creation is on by default and is turned off with constraints/iam.disableServiceAccountKeyCreation. User-managed keys do not expire on their own; the keys that rotate automatically are SYSTEM_MANAGED, and those cannot be downloaded at all.

Admin Activity and System Event are always on, free and cannot be turned off — they record configuration writes and Google-initiated actions. Data Access is the one you have to enable, per service, and the one you pay for, which is why nobody can answer "who read this last month" after the fact. Policy Denied is on by default but chargeable.

Cloud Shell is an ephemeral VM with a persistent 5 GB $HOME. Anything installed outside that path disappears when the VM is recycled, which is why the fix is a startup script in $HOME or, for a team, Cloud Workstations with the tool baked into the image. Nothing was uninstalled and no quota was hit.

A downloaded key is a credential that never expires, travels as a file and eventually reaches a repository; Workload Identity Federation and impersonation exist to remove it. Encrypting it in a secret store changes where it lives, not what it is. The other three are current recommendations. When a key appears among the options, treat it as wrong unless the scenario has explicitly ruled out every federated alternative.