Examkin

Question

Difficulty: HardDeploying and Configuring Cloud Storage Buckets and Objects

A financial analytics company needs to configure an existing Cloud Storage bucket named `fin-transactions-cold-2026` located in `europe-west3` to hold archived transaction logs for compliance. The compliance policy mandates that objects must be locked for a retention duration of 7 years (220,752,000220,752,000 seconds) and per-object Access Control Lists (ACLs) must be completely disabled to enforce unified Access Control through IAM roles across the bucket. Which `gcloud storage` command correctly applies both the 7-year retention policy and enforces uniform bucket-level access?

  1. gcloud storage buckets update gs://fin-transactions-cold-2026 --retention-period=220752000s --uniform-bucket-level-accessAnswer
  2. B
    gsutil retention set 7y gs://fin-transactions-cold-2026 && gsutil uniformbucketlevelaccess set on gs://fin-transactions-cold-2026
  3. C
    gcloud storage buckets update gs://fin-transactions-cold-2026 --default-storage-class=archive --no-uniform-bucket-level-access
  4. D
    gcloud storage objects update gs://fin-transactions-cold-2026/* --retention-period=220752000s --grant-roles=roles/storage.objectAdmin

Answer

The command 'gcloud storage buckets update gs://fin-transactions-cold-2026 --retention-period=220752000s --uniform-bucket-level-access' correctly configures both compliance locking and bucket-level security controls.
The correct command utilizes `gcloud storage buckets update` to simultaneously configure the retention period (220,752,000220,752,000 seconds, corresponding to 7 years) and enable `--uniform-bucket-level-access`. This enforces compliance locking and ensures object access is governed strictly by IAM roles rather than legacy object ACLs.

Step-by-Step Solution

1
Identify the target resource and configuration scope
The target is an existing Cloud Storage bucket requiring bucket-level policy flags rather than object-level edits.
Retention policies and access control boundaries (Uniform Bucket-Level Access) are defined at the bucket resource layer.
2
Determine the correct CLI utility and flag parameter for object retention
Use `--retention-period=220752000s` with `gcloud storage buckets update`.
Google Cloud CLI requires retention durations to be specified using standard duration suffixes (such as seconds 's').
3
Determine the correct flag parameter for disabling ACLs
Include `--uniform-bucket-level-access` in the update command.
Enabling Uniform Bucket-Level Access disables per-object ACLs and ensures IAM policies exclusively manage permissions.

Key Concept

Cloud Storage Bucket Configuration and Security Policies via gcloud storage CLI
Estimated Time:2m 0s
Rate this question

Topics

Deploying and Configuring Cloud Storage Buckets and Objects