GCP Associate Cloud Engineer Practice Question

Granting the Storage Object Viewer role (roles/storage.objectViewer) on the specific bucket gives Alice permission to list objects and read their data in that bucket only. Because the binding is applied at the bucket level, it does not cascade to other buckets or project resources, preserving least-privilege. Granting the same role or any broader role (such as Viewer or Storage Admin) at the project level would allow Alice to read objects in every bucket in the project. Granting Storage Admin on the bucket would let her create, overwrite, or delete objects, violating the read-only requirement.