D is correct

Use Policy Analyzer to query the permissions compute.firewalls.create or compute.firewalls.update or compute.firewalls.delete.

D is the option it's a direct question

Must be D

D- To identify all principals who can change firewall rules, you should use Policy Analyzer to query for the permissions related to creating, updating, or deleting firewall rules. These permissions are usually associated with compute.firewalls.create, compute.firewalls.update, and compute.firewalls.delete. By checking which principals have these permissions, you can determine who has the ability to change firewall rules in your Google Cloud project.

D. You can use the Policy Analyzer to check which resources within your organization a principal has a certain roles or permissions on. To get this information, create a query that includes the principal whose access you want to analyze and one or more permissions or roles that you want to check for. https://cloud.google.com/policy-intelligence/docs/analyze-iam-policies#:~:text=You%20can%20use%20the%20Policy%20Analyzer%20to%20check%20which%20resources,you%20want%20to%20check%20for.

D is correct!