A financial enterprise stores regulated transaction records in Cloud Storage. Compliance mandates require that: All uploaded records must adhere to Write-Once-Read-Many (WORM) compliance and cannot be deleted or overwritten by any user or administrator for seven years. Individual transaction records subject to pending legal audits must be indefinitely protected from deletion, even if their standard retention duration expires during an investigation. Audit protections on specific records must be easily removable once legal proceedings conclude, without altering the underlying bucket configuration. Which storage configuration strategy should the cloud architect implement to meet these requirements?

Configure a bucket retention policy of seven years, permanently lock the policy with Bucket Lock, and apply individual object legal holds for records under active audit.: ### What Cloud Storage Retention Policies and Bucket Lock Are **Cloud Storage retention policies** define the minimum duration that objects must remain unmodified and un-deleted within a bucket. When a retention policy is defined, any object uploaded to the bucket inherits this retention period. **Bucket Lock** allows an administrator to permanently lock the retention policy on a bucket, rendering the policy immutable and irreversible, even by project owners or Google Cloud administrators, fulfilling strict **Write-Once-Read-Many (WORM)** compliance standards. ### How It Meets the Requirements - **WORM Compliance (7-year retention)**: Setting a seven-year retention policy and permanently locking it via **Bucket Lock** guarantees that objects cannot be overwritten, modified, or deleted until seven years have passed from their upload timestamp. Once locked, the policy duration cannot be reduced or removed. - **Indefinite Protection for Legal Audits**: **Object legal holds** can be placed on individual objects to block modification or deletion independently of the bucket retention period. While a legal hold is active, the object cannot be deleted even after its seven-year retention period expires. - **Flexible Removal Post-Audit**: Legal holds can be added and removed individually per object via API or console without altering the bucket's overall locked retention policy. ### Key Advantages and Capabilities - **SEC 17a-4 and FINRA Compliance**: Locked retention policies provide formal regulatory compliance for financial and healthcare storage workloads. - **Granular Control**: Object legal holds operate at the object level rather than enforcing global freezes across unaffected records. - **Immutability Enforcement**: Prevents accidental administrative deletion and mitigates insider threat risks. - **Lifecycle Integration**: Works cooperatively with Object Lifecycle Management to clean up objects only after retention periods and legal holds have cleared. ### Why This Is Optimal This architecture directly fulfills both regulatory WORM standards and flexible eDiscovery legal hold requirements using native Cloud Storage governance primitives without custom scripts or complex IAM architectures.

StudyCerts

Cloud Storage Bucket Lock Legal Holds Worm | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Storage Bucket Lock Legal Holds Worm

Section: Data retention and data lifecycle management

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial enterprise stores regulated transaction records in Cloud Storage. Compliance mandates require that:

All uploaded records must adhere to Write-Once-Read-Many (WORM) compliance and cannot be deleted or overwritten by any user or administrator for seven years.
Individual transaction records subject to pending legal audits must be indefinitely protected from deletion, even if their standard retention duration expires during an investigation.
Audit protections on specific records must be easily removable once legal proceedings conclude, without altering the underlying bucket configuration.

Which storage configuration strategy should the cloud architect implement to meet these requirements?

Store records in BigLake Iceberg tables using Customer-Managed Encryption Keys (CMEK), and revoke KMS key access permissions during active audit holds.

Enable Object Versioning with an Object Lifecycle Management rule to expire noncurrent versions after seven years, and enforce IAM Deny policies on storage.objects.delete for audited files.

Set a Soft Delete retention duration of seven years on the bucket, and disable the Soft Delete policy at the project level whenever legal holds must be released.

Configure a bucket retention policy of seven years, permanently lock the policy with Bucket Lock, and apply individual object legal holds for records under active audit.

Professional Cloud Architect

Cloud Storage Bucket Lock Legal Holds Worm

Related questions