GCP Associate Cloud Engineer Practice Question

A custom role defined at the organization level can include exactly the permissions interns need-such as storage.objects.get, storage.objects.list, logging.logEntries.list, and logging.logs.list. Because organization-level custom roles are visible to every project in the organization, you only have to create the role once. You then grant that role to the interns' Google Group on each project (or at a higher level, if appropriate). A project-level custom role would have to be duplicated in every project, and combining multiple predefined roles would either miss required permissions or introduce unnecessary ones. Basic roles are far too permissive.