Choose two: In Google Cloud, which methods can you use to target a VPC firewall rule so it applies only to a subset of VM instances?

Network tags and service accounts are the primary methods for targeting specific VM instances with VPC firewall rules. Network tags allow you to assign arbitrary labels to instances, and then reference these tags in firewall rules to define source or target instances. Service accounts, when attached to instances, provide an identity that can also be used as a source or target in firewall rules, enabling fine-grained control based on the instance's authorized identity. Instance names are not directly usable for targeting in firewall rules; rules operate on properties like tags or service accounts, not individual instance names. Subnet names define network segments, but firewall rules apply to instances within those subnets, not the subnets themselves as a targeting mechanism.