GCP Associate Cloud Engineer Practice Question

Granting the contractor the Storage Object Creator role at the bucket level allows them to create objects in that specific bucket only. They can list the names of objects they upload but cannot delete or overwrite objects they do not own, nor can they read the contents of existing objects. Assigning the role at the project level would give access to every bucket in the project, which violates the principle of least privilege. The Storage Object Admin role would allow full control (including delete and overwrite) on the bucket, and the legacy Bucket Writer IAM-compatible role is broader than necessary because it implicitly permits deletions. Therefore, bucket-level roles/storage.objectCreator is the most restrictive role that still satisfies the requirements.