Answer: 1. Use Cloud Logging and filter on BigQuery Insert Jobs. 2. Click on the email address in line with the App Engine Default Service Account in the authentication field. 3. Click Hide Matching Entries. 4. Make sure the resulting list is empty.

The question requires validating that ALL data written to BigQuery was done using the App Engine Default Service Account. Option A is correct because: 1) Using Cloud Logging to filter on BigQuery Insert Jobs captures all write operations; 2) Clicking on the App Engine Default Service Account email in the authentication field and selecting 'Hide Matching Entries' removes all entries associated with that service account; 3) If the resulting list is empty, it confirms that ONLY the App Engine Default Service Account performed the writes. Option B is incorrect because 'Show Matching Entries' would display only entries from that service account, but wouldn't verify there were no other accounts writing data. Options C and D focus on permission configuration rather than actual validation of past data writes, making them unsuitable for verifying historical activity.

Author: LeetQuiz Editorial Team