PDE Storing the Data Practice Question
A financial services firm stores trade documents in a Cloud Storage bucket. Auditors require that each object be retained for exactly seven years and that no user, including project owners, be able to delete or overwrite the objects during that period. The firm also needs to prove compliance to auditors. Which combination of controls should the data engineer implement?
⚠ Common exam trap
The trap here is treating Cloud Storage versioning or a lifecycle rule as equivalent to WORM retention, when only a locked retention policy prevents deletion by privileged users.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a bucket lock on a retention policy of seven years and grant auditors the Storage Object Viewer role.
A locked bucket retention policy enforces object immutability for the specified duration and cannot be removed or shortened, satisfying the requirement that even project owners cannot delete data. Because the lock is a permanent bucket property, auditors can verify it directly. Lifecycle rules, versioning, and IAM conditions are all modifiable controls and therefore cannot guarantee the required immutability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a bucket lock on a retention policy of seven years and grant auditors the Storage Object Viewer role.
Why this is correct
A bucket retention policy prevents deletion or replacement of objects until the retention period elapses, and locking the policy makes it permanent and irreversible even for project owners. Granting auditors Storage Object Viewer lets them inspect objects and the bucket metadata to verify the lock. This combination enforces seven-year immutability and provides the evidence auditors need.
- ✗
Apply IAM conditions that deny storage.objects.delete unless the request comes from an auditor's service account.
Why it's wrong here
Deny policies and IAM conditions can restrict who may delete, but a sufficiently privileged principal could still alter the policy, and there is no cryptographic or platform-level guarantee of seven-year retention. Auditors would be verifying configuration rather than an immutable lock. The scenario demands that even project owners cannot delete, which IAM alone cannot guarantee against policy changes.
- ✗
Set an Object Lifecycle Management rule to delete objects after 2555 days and enable uniform bucket-level access.
Why it's wrong here
A lifecycle rule that deletes objects after a fixed period is a cleanup mechanism, not a retention guarantee; any principal with storage.objects.delete permission can remove an object earlier. Uniform bucket-level access only changes how permissions are granted, not whether deletion is possible. Neither control provides the immutability or audit evidence the scenario requires.
- ✗
Enable Cloud Storage versioning and set a lifecycle rule to keep noncurrent versions for seven years.
Why it's wrong here
Versioning preserves prior versions when an object is overwritten or deleted, but it does not prevent a user with delete permissions from issuing a delete on the live object or from removing all versions. Lifecycle rules that manage noncurrent versions are cleanup policies, not enforcement. This approach leaves the retention guarantee dependent on user restraint rather than platform control.
Go deeper
Related to this question
About these practice questions
This PDE question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Google Cloud exam blueprint
This PDE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PDE exam.