A financial enterprise stores regulated transaction records in Cloud Storage. Compliance mandates require that: All uploaded records must adhere to Write-Once-Read-Many (WORM) compliance and cannot be deleted or overwritten by any user or administrator for seven years. Individual transaction records subject to pending legal audits must be indefinitely protected from deletion, even if their standard retention duration expires during an investigation. Audit protections on specific records must be easily removable once legal proceedings conclude, without altering the underlying bucket configuration. Which storage configuration strategy should the cloud architect implement to meet these requirements?

Configure a bucket retention policy of seven years, permanently lock the policy with Bucket Lock, and apply individual object legal holds for records under active audit.: What Cloud Storage Retention Policies and Bucket Lock Are Cloud Storage retention policies define the minimum duration that objects must remain unmodified and un-deleted within a bucket. When a retention policy is defined, any object uploaded to the bucket inherits this retention period. Bucket Lock allows an administrator to permanently lock the retention policy on a bucket, rendering the policy immutable and irreversible, even by project owners or Google Cloud administrators, fulfilling strict Write-Once-Read-Many (WORM) compliance standards. How It Meets the Requirements WORM Compliance (7-year retention): Setting a seven-year retention policy and permanently locking it via Bucket Lock guarantees that objects cannot be overwritten, modified, or deleted until seven years have passed from their upload timestamp. Once locked, the policy duration cannot be reduced or removed. Indefinite Protection for Legal Audits: Object legal holds can be placed on individual objects to block modification or deletion independently of the bucket retention period. While a legal hold is active, the object cannot be deleted even after its seven-year retention period expires. Flexible Removal Post-Audit: Legal holds can be added and removed individually per object via API or console without altering the bucket's overall locked retention policy. Key Advantages and Capabilities SEC 17a-4 and FINRA Compliance: Locked retention policies provide formal regulatory compliance for financial and healthcare storage workloads. Granular Control: Object legal holds operate at the object level rather than enforcing global freezes across unaffected records. Immutability Enforcement: Prevents accidental administrative deletion and mitigates insider threat risks. Lifecycle Integration: Works cooperatively with Object Lifecycle Management to clean up objects only after retention periods and legal holds have cleared. Why This Is Optimal This architecture directly fulfills both regulatory WORM standards and flexible eDiscovery legal hold requirements using native Cloud Storage governance primitives without custom scripts or complex IAM architectures.

Cloud Storage Bucket Lock Legal Holds Worm | Professional Cloud Architect

IntermediateProfessional Cloud Architect

A financial services organization stores transaction audit files in a Cloud Storage bucket with Object Versioning enabled. The files are written under the prefix audit-logs/ and follow specific access patterns: Files are accessed frequently during the first 30 days after creation. Files are accessed roughly once a month between 30 and 90 days. Files are accessed once a quarter between 90 and 365 days. Files must be permanently deleted after 365 days. To optimize costs, any overwritten or deleted noncurrent object versions under the audit-logs/ prefix should be permanently removed 14 days after becoming noncurrent. Which Object Lifecycle Management (OLM) configuration meets these requirements with the least operational overhead?

Data retention and data lifecycle management

IntermediateProfessional Cloud Architect

An organization ingests streaming telemetry data into a Google Cloud BigQuery dataset for real-time monitoring and reporting. The incoming records are stored in a table named telemetry_logs partitioned daily by ingestion timestamp. The data architecture team establishes the following retention and operational requirements: Telemetry data older than 60 days must automatically be purged to reduce ongoing storage costs. The telemetry_logs table structure, schema, and current partition data must remain continuously available for analytical queries and streaming ingestion. The configuration must be applied directly to the existing table using GoogleSQL Data Definition Language (DDL) without scheduled maintenance scripts. Which statement should you execute to satisfy these requirements?

Data retention and data lifecycle management

IntermediateProfessional Cloud Architect

An enterprise is designing its Google Cloud resource hierarchy. The organization consists of multiple business units, including a Finance division that manages several sensitive workloads across multiple projects grouped under a Finance folder. The cloud architecture must satisfy the following security and governance requirements: A dedicated Finance security team must be able to administer IAM allow policies exclusively for all resources under the Finance folder. Members of the Finance security team must NOT have direct read, write, or administrative access to the underlying application data or virtual machines. Multiple microservices deployed within the Finance projects require distinct Google Cloud API permissions. Administrative overhead for onboarding and offboarding team members must be minimized. Which combination of IAM and resource governance practices should the cloud architect recommend?

Security and compliance

IntermediateProfessional Cloud Architect

Error Budget Policy

Evaluating quality control measures

IntermediateProfessional Cloud Architect

A financial enterprise is deploying proprietary machine learning models for online inference on Vertex AI. The security team requires a multi-layered security architecture that accomplishes the following: Prevents unauthorized access and data exfiltration of training datasets, model artifacts, and inference requests across network boundaries. Ensures encryption at rest using customer-controlled keys with strict separation of duties between security administrators and AI developers. Enforces least privilege for model execution and provides visibility into all model read and prediction operations. Which architecture should you implement to satisfy these security requirements?

Securing AI (e.g., Model Armor, Sensitive Data Protection, and secure model deployment)

AdvancedProfessional Cloud Data Engineer

A financial services organization is architecting its Google Cloud environment to support automated data pipelines and analytics workloads. The company has distinct compliance requirements across its environments and needs to design a resource hierarchy that enforces strict data governance. The architecture must satisfy the following requirements: Centralize strict security baselines, resource location constraints, and access policies consistently across all production workloads while permitting developers to iterate quickly with fewer restrictions in development. Enable centralized audit log aggregation across all child resources without configuring individual sinks in every data project. Prevent unauthorized egress and cross-boundary data exfiltration from sensitive production analytics data stores (such as BigQuery and Cloud Storage). How should the organization structure its resource hierarchy and security boundaries?

Designing the project, dataset, and table architecture to ensure proper data governance

Professional Cloud Architect

Cloud Storage Bucket Lock Legal Holds Worm

Related questions

Error Budget Policy

Professional Cloud Architect

Cloud Storage Bucket Lock Legal Holds Worm

What Cloud Storage Retention Policies and Bucket Lock Are

How It Meets the Requirements

Key Advantages and Capabilities

Why This Is Optimal

Related questions

Error Budget Policy

What Cloud Storage Retention Policies and Bucket Lock Are

How It Meets the Requirements

Key Advantages and Capabilities

Why This Is Optimal