GCP Professional Cloud Security Engineer Practice Question

A security architect must implement least-privilege retention for an audit-log bucket that has object versioning enabled. The mandate is:

Keep the most recent (live) version of each object indefinitely.
Remove only noncurrent versions that are at least 90 days old.

Which single Cloud Storage lifecycle rule meets this requirement while complying with Google-recommended condition and action names?

Action: Delete - Condition: Age: 90, IsLive: true
Action: Delete - Condition: NumberOfNewerVersions: 2
Action: SetStorageClass to Coldline - Condition: Age: 90, IsLive: false
Action: Delete - Condition: Age: 90, IsLive: false

Report Issue

Answer Description

The requirement targets object versions that are no longer current. In lifecycle configuration, this is expressed with the condition IsLive:false to select noncurrent versions. Combining that with Age:90 limits the rule to versions that were created at least 90 days ago. The action must be Delete, because the goal is to permanently remove the selected objects. Using Age with IsLive:false avoids deleting the live copy, and a single rule is sufficient.

Delete with Age:90 and IsLive:false ⇒ correct: deletes only noncurrent versions 90+ days old.
Delete with NumberOfNewerVersions or IsLive:true would either miss some eligible versions or risk deleting the live copy.
SetStorageClass actions do not remove objects, so they do not satisfy the mandate.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.