Examkin

Question

Difficulty: HardManaging Storage and Database Solutions

A cloud operations team manages a Google Cloud Storage bucket containing regulatory financial records. To satisfy strict compliance requirements, all uploaded records must remain unmodified and undeletable for a mandatory retention duration of five years. The team has already set a retention period of 1,825 days on the bucket. Now, they must ensure that no user—including administrators and project owners—can reduce the retention period or remove the policy. Which operational action must the engineer perform to fulfill this requirement?

  1. Execute `gcloud storage buckets update gs://[BUCKET_NAME] --lock-retention-policy` and confirm the action.Answer
  2. B
    Deploy a Cloud Storage Lifecycle Management rule with an action of `Delete` and an `age` condition of 1,825 days.
  3. C
    Execute `gcloud storage objects update gs://[BUCKET_NAME]/** --event-hold` to lock every individual object.
  4. D
    Enable Uniform Bucket-Level Access on the bucket and grant the Storage Object Viewer role to all project users.

Answer

Execute the command `gcloud storage buckets update gs://[BUCKET_NAME] --lock-retention-policy` and confirm the prompt.
Locking a bucket retention policy irreversibly enforces Write Once Read Many (WORM) storage compliance. Once locked, the retention policy cannot be removed, and the retention duration cannot be reduced by any user or service account, guaranteeing compliance against accidental or malicious deletion.

Step-by-Step Solution

1
Identify the compliance requirement
The requirement demands irreversible immutability (WORM compliance) for stored objects so that retention settings cannot be lowered or deleted by any identity.
Regulatory frameworks often require immutable data retention where administrative overrides are impossible.
2
Evaluate Cloud Storage Retention Policy lifecycle states
An unlocked retention policy allows bucket administrators to remove or shorten the retention duration. Locking the policy renders it permanent and irreversible.
Once locked, only object retention expiration allows deletion; the retention period itself cannot be modified or removed.
3
Select the proper `gcloud` operational command
Using `gcloud storage buckets update gs://[BUCKET_NAME] --lock-retention-policy` directly locks the retention policy at the bucket level.
This command enforces bucket retention locking via the standard Google Cloud SDK CLI.

Key Concept

Cloud Storage Bucket Retention Policy Locking
Estimated Time:2m 0s
Rate this question

Topics

Managing Storage and Database Solutions