You are using your personal workstation to develop an application that will be hosted in...

The correct answer is C because the goal is to test permissions as the service account without downloading or handling long-lived secrets. The roles/iam.serviceAccountTokenCreator role allows a user to impersonate a service account by generating short-lived credentials or access tokens. That is the recommended secure approach for local testing because it avoids service account key files, which are sensitive and difficult to rotate safely once distributed. The serviceAccountKeyAdmin role would allow key creation and management, which directly conflicts with the requirement to avoid secret handling. The workloadIdentityUser role is mainly for workload identity federation scenarios, not local user impersonation. The serviceAccountUser role allows attaching service accounts to resources but does not provide token creation for local testing.