You have two GCP projects: 'Project-App' and 'Project-Data'. A Compute Engine VM in 'Project-App' needs to read data from a Cloud Storage bucket located in 'Project-Data'.

Which TWO steps are required to configure this cross-project access securely? (Select TWO)

Create a custom Service Account in 'Project-App' and attach it to the VM.

Create a custom Service Account in 'Project-Data' and attach it to the VM in 'Project-App'.

In 'Project-Data', grant the Storage Object Viewer role to the Service Account created in 'Project-App'.

Set up VPC Peering between 'Project-App' and 'Project-Data'.

Move the Cloud Storage bucket into 'Project-App'.