You have an application running on-premises (outside of GCP) that needs to write data to Cloud Pub/Sub. You have created a service account for this application and generated a JSON key file.

Which TWO practices should you follow to secure this service account key? (Select TWO)

Commit the JSON key to your Git repository so the application can always find it.

Store the JSON key securely (e.g., in a secret manager) and restrict access to it.

Implement a process to regularly rotate the service account keys.

Assign the 'Owner' role to the service account so it doesn't face permission errors.

Disable the service account when the application is running.