A financial services organization is migrating transaction archive data to Google Cloud Storage to satisfy SEC and FINRA regulatory compliance mandates. The compliance team outlines the following mandatory storage requirements: All uploaded archive files must be retained immutably for exactly seven years, with no possibility of modification or premature deletion by any user, including administrators. The retention policy duration must not be capable of being shortened, removed, or bypassed under any circumstance. Objects should be automatically deleted once their mandatory seven-year retention period has elapsed to minimize ongoing storage costs. Which Cloud Storage configuration should you implement to satisfy these requirements?

Configure a bucket retention policy of seven years, lock the retention policy using Bucket Lock, and configure an Object Lifecycle Management rule to delete objects older than seven years.: What Bucket Lock and Object Lifecycle Management Provide Bucket Lock is a Cloud Storage compliance feature that allows you to configure a retention policy on a bucket and permanently lock it. When a retention policy is locked, Cloud Storage enforces WORM (Write Once, Read Many) storage behavior across all existing and future objects in the bucket, preventing any object from being modified, overwritten, or deleted until its age exceeds the defined retention period. How It Meets the Requirements Immutable retention: Setting a 7-year retention policy ensures all objects cannot be deleted or replaced before reaching 7 years of age (403 - retentionPolicyNotMet). Irreversible protection: Permanently locking the bucket retention policy prevents anyone—including Project Owners and Storage Admins—from decreasing the retention period or removing the policy. Automated deletion after expiration: Object Lifecycle Management integrates directly with Bucket Lock. A lifecycle rule set to delete objects with an Age condition of 7 years will automatically purge objects as soon as their retention expiration date is satisfied. Key Advantages and Capabilities Regulatory compliance: Meets stringent requirements for SEC Rule 17a-4(f), FINRA, and CFTC regulations. Retroactive enforcement: The locked bucket policy uniformly protects all current objects and incoming data. Coordinated lifecycle operations: Lifecycle management deletion actions are automatically deferred until retention conditions are completely fulfilled. Admin tamper resistance: The retention duration can only be increased, never reduced or deleted. Why This Is Optimal This solution meets every compliance and operational requirement natively within Cloud Storage without custom scripts, external orchestrators, or risk of accidental administrative data deletion.

Cloud Storage Bucket Lock Lifecycle Compliance | Professional Cloud Architect

StudyCerts

Explanations

What Bucket Lock and Object Lifecycle Management Provide

Bucket Lock is a Cloud Storage compliance feature that allows you to configure a retention policy on a bucket and permanently lock it. When a retention policy is locked, Cloud Storage enforces WORM (Write Once, Read Many) storage behavior across all existing and future objects in the bucket, preventing any object from being modified, overwritten, or deleted until its age exceeds the defined retention period.

How It Meets the Requirements

Immutable retention: Setting a 7-year retention policy ensures all objects cannot be deleted or replaced before reaching 7 years of age (403 - retentionPolicyNotMet).
Irreversible protection: Permanently locking the bucket retention policy prevents anyone—including Project Owners and Storage Admins—from decreasing the retention period or removing the policy.
Automated deletion after expiration: Object Lifecycle Management integrates directly with Bucket Lock. A lifecycle rule set to delete objects with an Age condition of 7 years will automatically purge objects as soon as their retention expiration date is satisfied.

Key Advantages and Capabilities

Regulatory compliance: Meets stringent requirements for SEC Rule 17a-4(f), FINRA, and CFTC regulations.
Retroactive enforcement: The locked bucket policy uniformly protects all current objects and incoming data.
Coordinated lifecycle operations: Lifecycle management deletion actions are automatically deferred until retention conditions are completely fulfilled.
Admin tamper resistance: The retention duration can only be increased, never reduced or deleted.

Why This Is Optimal

This solution meets every compliance and operational requirement natively within Cloud Storage without custom scripts, external orchestrators, or risk of accidental administrative data deletion.

View source documentation

Professional Cloud Architect

Cloud Storage Bucket Lock Lifecycle Compliance