What should you do?

You are writing a Compute Engine hosted application in project A that needs to securely authenticate

to a Cloud Pub/Sub topic in project B.

What should you do?

A. Configure the instances with a service account owned by project B. Add the service account as a Cloud Pub/Sub publisher to project A.

B. Configure the instances with a service account owned by project A. Add the service account as a publisher on the topic.

C. Configure Application Default Credentials to use the private key of a service account owned by project B. Add the service account as a Cloud Pub/Sub publisher to project A.

D. Configure Application Default Credentials to use the private key of a service account owned by project A. Add the service account as a publisher on the topic

Answer: B

Explanation:

https://cloud.google.com/pubsub/docs/access-control

"For example, suppose a service account in Cloud Project A wants to publish messages to a topic in Cloud Project B. You could accomplish this by granting the service account Edit permission in Cloud Project B"