A financial services organization is migrating transaction archive data to Google Cloud Storage to satisfy SEC and FINRA regulatory compliance mandates. The compliance team outlines the following mandatory storage requirements: All uploaded archive files must be retained immutably for exactly seven years, with no possibility of modification or premature deletion by any user, including administrators. The retention policy duration must not be capable of being shortened, removed, or bypassed under any circumstance. Objects should be automatically deleted once their mandatory seven-year retention period has elapsed to minimize ongoing storage costs. Which Cloud Storage configuration should you implement to satisfy these requirements?

Configure a bucket retention policy of seven years, lock the retention policy using Bucket Lock, and configure an Object Lifecycle Management rule to delete objects older than seven years.: ### What Bucket Lock and Object Lifecycle Management Provide **Bucket Lock** is a Cloud Storage compliance feature that allows you to configure a **retention policy** on a bucket and permanently lock it. When a retention policy is locked, Cloud Storage enforces **WORM (Write Once, Read Many)** storage behavior across all existing and future objects in the bucket, preventing any object from being modified, overwritten, or deleted until its age exceeds the defined retention period. ### How It Meets the Requirements - **Immutable retention:** Setting a 7-year retention policy ensures all objects cannot be deleted or replaced before reaching 7 years of age (`403 - retentionPolicyNotMet`). - **Irreversible protection:** Permanently locking the bucket retention policy prevents anyone—including Project Owners and Storage Admins—from decreasing the retention period or removing the policy. - **Automated deletion after expiration:** **Object Lifecycle Management** integrates directly with Bucket Lock. A lifecycle rule set to delete objects with an `Age` condition of 7 years will automatically purge objects as soon as their retention expiration date is satisfied. ### Key Advantages and Capabilities - **Regulatory compliance:** Meets stringent requirements for SEC Rule 17a-4(f), FINRA, and CFTC regulations. - **Retroactive enforcement:** The locked bucket policy uniformly protects all current objects and incoming data. - **Coordinated lifecycle operations:** Lifecycle management deletion actions are automatically deferred until retention conditions are completely fulfilled. - **Admin tamper resistance:** The retention duration can only be increased, never reduced or deleted. ### Why This Is Optimal This solution meets every compliance and operational requirement natively within Cloud Storage without custom scripts, external orchestrators, or risk of accidental administrative data deletion.

StudyCerts

Cloud Storage Bucket Lock Lifecycle Compliance | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Storage Bucket Lock Lifecycle Compliance

Section: Data protection (e.g., backup and recovery)

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial services organization is migrating transaction archive data to Google Cloud Storage to satisfy SEC and FINRA regulatory compliance mandates. The compliance team outlines the following mandatory storage requirements:

All uploaded archive files must be retained immutably for exactly seven years, with no possibility of modification or premature deletion by any user, including administrators.
The retention policy duration must not be capable of being shortened, removed, or bypassed under any circumstance.
Objects should be automatically deleted once their mandatory seven-year retention period has elapsed to minimize ongoing storage costs.

Which Cloud Storage configuration should you implement to satisfy these requirements?

Place an event-based hold on all bucket objects and configure a Cloud Key Management Service (Cloud KMS) customer-managed encryption key with scheduled key destruction after seven years.

Configure a bucket retention policy of seven years, lock the retention policy using Bucket Lock, and configure an Object Lifecycle Management rule to delete objects older than seven years.

Enable Object Versioning on the bucket, configure an Object Lifecycle Management rule to delete noncurrent versions after seven years, and enforce public access prevention.

Configure Object Retention Lock in Unlocked mode for each object and set a Soft Delete retention duration of seven years on the bucket.

Professional Cloud Architect

Cloud Storage Bucket Lock Lifecycle Compliance

Related questions