Before deploying, test a service account's BigQuery permissions from your local machine using the most secure Google‑recommended method. What should you do?

The most secure and recommended method for testing service account permissions locally is to use gcloud service account impersonation. This allows you to temporarily act as the service account without needing to download or manage a long-lived service account key, which is a security risk. You can then execute BigQuery requests as if you were the service account, verifying its permissions. Generating a long-lived service account key is discouraged due to security concerns; these keys can be compromised if not properly managed. Granting the BigQuery Administrator role is excessive and violates the principle of least privilege, as it provides far more permissions than typically needed for testing. Configuring Application Default Credentials with your user account tests your permissions, not the service account's.