GCP Associate Cloud Engineer Practice Question

A firewall rule that targets a specific service account is automatically applied to every existing or future VM instance that runs with that service account, regardless of the subnet or zone in which the VM resides. Using a network tag would require administrators to remember to tag every new instance, and targeting an IP range or the entire VPC would expose more resources than required. Therefore, specifying the service account in the Targets field meets the requirement of limiting the rule to the intended VMs while keeping administration effortless as new instances are created.