mediumMultiple ChoiceObjective-mapped
Cloud Digital Leader Practice Question: Ensure that no employee can accidentally delete…
A company wants to ensure that no employee can accidentally delete critical data stored in Cloud Storage. They need a solution that protects against accidental deletion even by users with full permissions. Which approach should they use?
⚠ Common exam trap
Google Cloud often tests the misconception that IAM roles alone can prevent deletion, but the trap here is that users with full permissions (e.g., `roles/storage.admin`) can delete objects unless a retention policy is applied, which overrides IAM at the bucket level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Object Versioning and set a retention policy
Object Versioning in Cloud Storage preserves non-current object versions, allowing recovery from accidental overwrites or deletions. A retention policy prevents object deletion (including version deletion) until the retention period expires, even for users with full permissions like `storage.objects.delete`. Together, they provide a defense-in-depth against accidental data loss.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable Object Versioning and set a retention policy
Why this is correct
Enabling Object Versioning preserves noncurrent versions of objects each time an object is overwritten or deleted, meaning a mistaken deletion leaves the prior version intact and recoverable. A bucket retention policy in Google Cloud Storage enforces a mandatory minimum retention duration, blocking any deletion attempt—even by an administrator—until that period has elapsed. Together, they ensure that accidental deletion can be undone via version history and that the data cannot be permanently purged before a safe recovery window.
- ✗
Use customer-managed encryption keys
Why it's wrong here
Customer-managed encryption keys (CMEK) let you control the cryptographic keys that protect objects at rest, providing independent key management and revocation capabilities. Encryption, however, only safeguards confidentiality—it does not manage the object's lifecycle, and deleting an object removes the encrypted ciphertext entirely. No key can restore or resurrect deleted data, so CMEK provides zero protection against accidental deletion.
- ✗
Set up Cloud Audit Logs for data access
Why it's wrong here
Cloud Audit Logs record every administrative and data operation, including object deletions, enabling you to trace precisely when and by whom a delete request was issued. Logging is a passive, observable layer that cannot intercept or block operations—the delete request completes regardless of what the log captures. While audit logs help attribute an accident after the fact, they offer no mechanism to halt the deletion or recover the lost object.
- ✗
Restrict IAM roles to Viewer only
Why it's wrong here
Restricting employees to the read-only Viewer role does prevent that limited population from deleting objects, but it also blocks any write-oriented task such as uploading new versions or updating metadata, making it unusable for roles that need to work with data. The restriction only applies to principals granted that role; an administrator with Storage Admin or an over-privileged service account can still delete objects, leaving a significant gap. Because admins can always grant themselves higher roles, a blanket Viewer policy is an impractical and easily circumvented approach that does not create a true deletion defense.
Go deeper
Related to this question
Learn chapter
Cloud Digital Transformation
Key term
Data
Data is raw, unprocessed information, like numbers, words, or measurements, that can be stored, processed, and analyzed by computers.
Key term
Cloud storage
Cloud storage is a service that lets you save data on remote servers accessed over the internet instead of on your computer's hard drive.
About these practice questions
One of 829 original GCDL practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This GCDL practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCDL exam.