You are working at a financial institution that stores mortgage loan approval documents on Cloud Storage. Any change to these approval documents must be uploaded as a separate approval file. You…

Question

Options

• ACreate a retention policy on the bucket for the duration of 5 years. Create a lock on the retention
• BCreate a retention policy organizational constraint constraints/storage.retentionPolicySeconds at
• CUse a customer-managed key for the encryption of the bucket. Rotate the key after 5 years.
• DCreate a retention policy organizational constraint constraints/storage.retentionPolicySeconds at

• A
  79% (22)
• B
  7% (2)
• C
  4% (1)
• D
  11% (3)

Explanation

Option A is correct because Cloud Storage retention policies prevent objects from being deleted or overwritten until the retention period expires, and locking that policy makes it permanent and irrevocable - meaning even an administrator cannot shorten or remove the policy, which satisfies regulatory compliance requirements for financial documents.

Options B and D describe an organizational policy constraint (constraints/storage.retentionPolicySeconds) that can enforce minimum retention durations across buckets, but this constraint alone does not lock the retention policy; a sufficiently privileged user could still modify or delete the bucket's retention policy, leaving documents vulnerable.

Option C is a red herring - customer-managed encryption keys (CMEK) control who can decrypt data, not whether objects can be deleted or overwritten, so rotating a key after 5 years does nothing to enforce immutability.

Memory tip: Think of it as a two-step vault: first you set the timer (retention policy = 5 years), then you weld the door shut (lock = irreversible). Without the lock, someone with enough permissions could still open the vault early. The lock is what makes it legally defensible.

No community discussion yet for this question.