Home Microsoft Exams Google Cloud Exams

Loading page

Curious about new developments and updates? Follow our social media.

Get a free certification question every week.

Microsoft Exams

AZ-104 Administrator
AZ-204 Developer
AZ-900 Fundamentals
All Microsoft Exams

Google Cloud Exams

Associate Data Practitioner
All Google Cloud Exams

Terms Privacy Cookies About Pricing

© 2026 StudyCerts. All rights reserved.

StudyCerts is an independent service and is not affiliated with, endorsed by, or sponsored by any certification body or cloud provider.

Loading page

Home
Google Cloud Exams
Professional Cloud Security Engineer
Configuring object lifecycle policies for Cloud Storage.
An enterprise stores millions of compliance audit logs and s…

Professional Cloud Security Engineer

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Description
Sample Question
Free Trial
Practice Test

Advanced

Prepare and test your skills

Description
Sample Question
Free Trial
Practice Test

Cloud Storage Lifecycle Coldline Size Transition

Section: Configuring object lifecycle policies for Cloud Storage.

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

...

...

...

...

...

Explanations

...

View source documentation

Related questions

Keep the momentum going with these hand-picked practice scenarios

AdvancedProfessional Cloud Security Engineer

A security engineer is configuring lifecycle management for an enterprise Google Cloud Storage bucket containing regulatory audit records. Object Versioning is enabled on the bucket. The organization mandates the following retention and cleanup requirements: Active, current (live) objects must never be automatically deleted by lifecycle rules. To prevent storage sprawl, retain a maximum of 3 noncurrent versions; any older noncurrent version beyond the 3 newest must be permanently deleted immediately. Any noncurrent version that has been superseded for more than 90 days must be permanently deleted, even if fewer than 3 noncurrent versions exist. Which lifecycle configuration should the security engineer implement to satisfy these requirements?

Configuring object lifecycle policies for Cloud Storage.

AdvancedProfessional Cloud Security Engineer

A financial enterprise uses Google Cloud Storage to store sensitive audit logs and transaction records. The bucket is configured with Customer-Managed Encryption Keys (CMEK) managed in Cloud Key Management Service (Cloud KMS). To align with internal data governance and cost optimization frameworks, the security team implements the following configurations: An Object Lifecycle Management policy with a SetStorageClass action to transition objects from Standard to Archive storage after 90 days. An Object Lifecycle Management policy with a Delete action for objects older than 7 years. An active Legal Hold applied to specific objects involved in ongoing regulatory inquiries. An automated annual key rotation schedule configured in Cloud KMS for the CMEK CryptoKey. How do these lifecycle actions and security controls affect object availability, legal holds, and encryption states?

Configuring object lifecycle policies for Cloud Storage.

AdvancedProfessional Cloud Security Engineer

A financial services organization must implement a centralized log export architecture across all Google Cloud resources to comply with strict regulatory frameworks. The compliance and security requirements are: Comprehensive Audit Coverage: All audit logs from existing and future folders and projects across the organization must be captured automatically. Data Residency: Log archives must strictly reside in a designated geographic region (europe-west3). Tamper Resistance & Least Privilege: The log delivery mechanism must be restricted to write-only permissions on the destination archive to prevent exfiltration, modification, or deletion, while project administrators in child projects must have no access to alter or delete centralized logs. Which log export and IAM configuration should the security team implement?

Configuring log exports (log sinks and aggregated sinks).

AdvancedProfessional Cloud Security Engineer

A security engineer is designing an automated CI/CD pipeline in Google Cloud to build and publish hardened base container images. The pipeline must enforce security guardrails by shifting vulnerability detection left. The pipeline must fulfill the following requirements: Build container images locally within the build environment using a hardened Dockerfile. Inspect the container image for known operating system and language package vulnerabilities before it is published. Automatically fail the build pipeline and prevent pushing the image to the production Artifact Registry repository if any CRITICAL or HIGH severity vulnerabilities are detected. Use native Google Cloud CLI tools and services within the build workflow. Which pipeline workflow should the security engineer implement in Cloud Build?

Automating virtual machine and container image creation (e.g., hardening, maintenance, VM patch management).

AdvancedProfessional Cloud Security Engineer

An enterprise integrates an external Identity Provider (IdP) with Google Cloud Identity for Single Sign-On (SSO) and enforces OS Login organization-wide for all Compute Engine instances. A security audit discovers that when departing employees are disabled in the external IdP, they can still establish SSH sessions to Linux VMs via OS Login. How should the security team automate user lifecycle management to immediately revoke both Google Cloud console and OS Login SSH access upon employee departure?

Administering user accounts and groups programmatically.

IntermediateProfessional Cloud Architect

An enterprise is planning to migrate a fleet of standard web services and background processing microservices to Google Kubernetes Engine (GKE). The platform architecture must satisfy the following technical and operational criteria: Provide high availability for the Kubernetes API control plane during maintenance and single-zone infrastructure disruptions Eliminate the operational overhead of configuring node pools, OS patching, scaling parameters, and bin-packing Optimize cloud spend by billing compute based on container resource requests rather than paying for unused worker node VM capacity Which GKE cluster configuration should you recommend?

Container orchestration

Want more questions like this?

Get a free certification question every week.

Last updated August 28, 2026

Are you ready for the Professional Cloud Security Engineer?

50 questions in the full practice test

More Configuring object lifecycle policies for Cloud Storage. practice questions

Get a free certification question with a full explanation every week.

Professional Cloud Security Engineer

Provider: Google Cloud
Passing score: 70%
Questions: 50
Duration: 90 minutes

Other sections in this exam

Configuring access
Securing communications and establishing boundary protection
Ensuring data protection
Managing operations
Supporting compliance requirements

Ask Scout

Still curious? Scout, our AI tutor, can explain this concept further and answer your follow-up questions.

An enterprise stores millions of compliance audit logs and supporting evidence artifacts in a Cloud Storage bucket initialized with the Standard storage class. The data architecture team establishes the following data retention and cost optimization requirements:

All active objects older than 365 days must transition from Standard storage to Coldline storage to lower at-rest storage expenses for regulatory archival.
Transitioning millions of small index and thumbnail files under 5 MiB must be avoided, as the Class A operation fees for SetStorageClass would exceed any monthly storage cost savings.
The storage transition mechanism must not incur retrieval charges or inter-region replication fees during the storage class migration.

Which Object Lifecycle Management configuration should the security engineer deploy on the bucket?

Configure a lifecycle rule with a SetStorageClass action targeting COLDLINE, specifying conditions for daysSinceNoncurrentTime of 365 days and matchesStorageClass set to STANDARD.

Configure a lifecycle rule with a SetStorageClass action targeting COLDLINE, specifying conditions for age of 365 days, matchesStorageClass set to STANDARD, and sizeBelowBytes set to 5242880.

Configure a lifecycle rule with a Delete action conditioned on an age of 365 days and matchesStorageClass set to STANDARD, paired with an automated Cloud Function to rewrite surviving objects into Coldline.

Configure a lifecycle rule with a SetStorageClass action targeting COLDLINE, specifying conditions for age of 365 days, matchesStorageClass set to STANDARD, and sizeAboveBytes set to 5242880.

Configure a lifecycle rule with a SetStorageClass action targeting COLDLINE, specifying conditions for daysSinceNoncurrentTime of 365 days and matchesStorageClass set to STANDARD.

Configure a lifecycle rule with a SetStorageClass action targeting COLDLINE, specifying conditions for age of 365 days, matchesStorageClass set to STANDARD, and sizeBelowBytes set to 5242880.

Configure a lifecycle rule with a Delete action conditioned on an age of 365 days and matchesStorageClass set to STANDARD, paired with an automated Cloud Function to rewrite surviving objects into Coldline.

Configure a lifecycle rule with a SetStorageClass action targeting COLDLINE, specifying conditions for age of 365 days, matchesStorageClass set to STANDARD, and sizeAboveBytes set to 5242880.

What Object Lifecycle Management with Size Filtering Is

Object Lifecycle Management (OLM) in Google Cloud Storage automates object transition and deletion policies. The SetStorageClass lifecycle action alters the storage tier of an object asynchronously without rewriting data bytes or triggering data movement pipelines.

How It Meets the Requirements

Regulatory Archival at 365 Days: Setting the age condition to 365 and matchesStorageClass to STANDARD ensures that only active objects that have resided in Standard storage for a full year transition to the COLDLINE tier.
Preventing Inefficient Class A Operation Fees: Applying sizeAboveBytes: 5242880 (5 MiB) filters out small index files and thumbnails. Because executing SetStorageClass is billed as a Class A operation against the destination class, small objects can incur transition API charges that dwarf ongoing capacity savings.
Avoiding Retrieval and Inter-Region Fees: Unlike manual copy or rewrite routines, Cloud Storage lifecycle transitions using SetStorageClass do not rewrite the underlying object data. Consequently, they incur zero retrieval fees and zero inter-region network charges.

Key Advantages

Automated Policy Enforcement: Evaluates object metadata asynchronously without client-side compute overhead.
Granular Filter Combinations: Combines age, matchesStorageClass, and sizeAboveBytes within a single rule condition block.
Cumulative Duration Credit: Time spent in the original storage class counts toward the minimum retention duration of subsequent storage tiers.

Why This Is Optimal

This declarative lifecycle approach eliminates manual batch scripts, avoids unneeded operation expenses on small files, and safeguards against unexpected egress and retrieval billing.