Cloud Function func_display must invoke func_query; ensure func_query only accepts calls from func_display and follow Google best practices. What should you do?

The correct approach leverages Google Cloud's built-in authentication and authorization mechanisms for secure function-to-function communication. By making funcquery require authentication, you ensure only authorized callers can invoke it. Associating a unique service account with funcdisplay and granting it the Cloud Functions Invoker role specifically for funcquery establishes the necessary permission. When funcdisplay invokes funcquery, it generates an ID token signed by Google, which funcquery then validates, ensuring the call originates from the authorized service account. The first incorrect option relies on a shared secret (token), which is less secure and harder to manage than IAM-based authentication. The third and fourth incorrect options focus on VPC and firewall rules for "internal traffic," which are not the primary or most secure method for authenticating serverless function invocations. Cloud Functions are typically serverless and don't inherently reside within a VPC in a way that allows for simple firewall rules between them for authentication purposes. While VPC access can be configured for Cloud Functions, it's not the mechanism for authenticating one function to another.