https://cloud.google.com/solutions/pci-dss-compliance-in-gcp find "To simplify access restriction and compliance auditing, create a production-quality, payment-processing environment that is fully isolated from your standard production environment and any dev/QA environments (requirement 6.4.1). To ensure isolation, create and use a GCP account that is separate from your core production environment account. Users experienced with Cloud Identity and Access Management (Cloud IAM) configuration can accomplish equivalent isolation by using separate projects for in-scope work." Therefore C

Answer is C
I Agree with you Eikistein

That's a really trick question (in reality tricky possible answers). In my opinion C is the correct answer and I agree with Kris.

Here are my thoughts:

I think we can all agree neither A nor B are the correct answer.

About D:
When I read this https://cloud.google.com/solutions/time-series/bigquery-financial-forex (provided by Salim Masani below) I was sure the answer was D however the article does not specifically say how the PII (personally identifiable information) is encrypted in transit and at rest. Having said that, the text of the answer is not "use BigQuery", it is "Enable Logging export to Google BigQuery...", so what is this ? No special protection over PII data, but a way to allow auditor to catch any PII data leak. That's not exactlly a safe setup.

About E:
I work for a Financial institution and we implemented PII using Tokenization + separate projects. So we used C + E.
Why don't I think E is correct? For 2 reasons:
1) Tokenization could be seen with a solution that is "compromising the ability to analyze transactional data...". you can't exactly query tokenized data
2) The article in https://cloud.google.com/solutions/pci-dss (provided by Kris) is so complete that would be crazy to think that is not the right answer

Correct Answer if C
https://cloud.google.com/solutions/pci-dss
To simplify access restriction and compliance auditing, you must create a production-quality payment-processing environment that is fully isolated from your standard production environment. To ensure full isolation, create and use a Google Cloud Platform account that is separate from your core production environment account.

They want to reduce their PCI compliance scope, so that means not storing PII where not necessary. If they use tokens they can store the actual PII in a centralized secure store and still use tokens to analyze trends. So E is right.

besides BigQuery uses ACLs to manage permissions on projects and datasets . Kindly refer the below link
https://cloud.google.com/bigquery/docs/concepts

According to me Google BigQuery is PCI compliant and D is the right answere
https://cloud.google.com/solutions/time-series/bigquery-financial-forex

D not right, ACLs not for BigQuery. https://cloud.google.com/bigquery/docs/access-control

I agree with stonewealth: https://cloud.google.com/dlp/docs/deidentify-sensitive-data. It should be E

I think answer should be E?
See https://www.sans.org/reading-room/whitepapers/compliance/ways-reduce-pci-dss-audit-scope-tokenizing-cardholder-data-33194