Examkin

Question

Difficulty: HardDeploying and Configuring Cloud Storage Buckets and Objects

A cloud engineer is preparing an automated deployment script to create and configure a Google Cloud Storage bucket for ingesting real-time telemetry data. According to Google Cloud security and operational best practices, infrastructure must be created first, bucket-level configurations and policies applied next, access control granted third, and data ingestion validated last. In what sequence should the engineer execute these operational steps?

  1. 1Execute `gcloud storage buckets create gs://telemetry-ingest-logs --location=us-east1 --uniform-bucket-level-access` to provision the bucket.
  2. 2Execute `gcloud storage buckets update gs://telemetry-ingest-logs --lifecycle-file=lifecycle-config.json` to enforce object lifecycle management.
  3. 3Execute `gcloud storage buckets add-iam-policy-binding gs://telemetry-ingest-logs --member=serviceAccount:[email protected] --role=roles/storage.objectCreator` to grant access.
  4. 4Execute `gcloud storage cp test-telemetry.log gs://telemetry-ingest-logs/` using the service account credentials to validate bucket accessibility.

Answer

The correct operational sequence is: 1) Provision the Cloud Storage bucket with uniform bucket-level access, 2) Apply the lifecycle management rule configuration file to the bucket, 3) Bind the Storage Object Creator IAM role to the ingestion service account, and 4) Perform a test object upload using `gcloud storage cp` to verify configuration.
The deployment sequence follows standard infrastructure-as-code and cloud operational principles: first provision the core storage resource, next apply bucket configurations and governance rules (lifecycle policies), then establish access security by binding least-privilege IAM roles (`roles/storage.objectCreator`), and finally execute an end-to-end write test with object upload.

Step-by-Step Solution

1
Provision the bucket resource using `gcloud storage buckets create`
The Cloud Storage bucket `gs://telemetry-ingest-logs` exists in `us-east1` with uniform bucket-level access enabled.
You cannot set lifecycle rules, bind IAM roles, or upload objects until the underlying Cloud Storage bucket resource is created.
2
Apply lifecycle rules using `gcloud storage buckets update`
The bucket is configured with automated storage class transition rules prior to data ingestion.
Applying bucket governance and lifecycle management rules immediately after bucket creation guarantees compliance before any data is ingested.
3
Grant application access using `gcloud storage buckets add-iam-policy-binding`
The target service account is assigned `roles/storage.objectCreator` on the bucket.
IAM permissions must be explicitly configured on the ready bucket before applications or service accounts attempt data writes.
4
Verify upload capability using `gcloud storage cp`
Object upload succeeds, confirming end-to-end operational readiness.
Data upload is the final verification step to confirm that bucket setup and IAM authorization are functioning correctly.

Key Concept

Cloud Storage Deployment & Operational Sequencing
Rate this question

Topics

Deploying and Configuring Cloud Storage Buckets and Objects