A payments company must keep transaction receipts in a Cloud Storage bucket for 10 years. Regulators require that no one, including project owners, can delete or overwrite a receipt before its retention period ends. Which configuration meets this requirement?
Show answer and explanation
Answer: A
A retention policy with Bucket Lock blocks deletion and overwriting of objects until their retention period expires. Once the policy is locked it cannot be reduced or removed, even by project owners, which gives the tamper-proof guarantee compliance requires. Versioning keeps history but still lets a privileged user delete versions, lifecycle rules change storage class rather than block deletion, and encryption or access settings do not stop an authorized delete.
Why the other options are wrong
- B. Versioning retains prior generations, but anyone with delete rights can still remove the live and noncurrent versions. Restricting permissions is not an enforced immutability guarantee.
- C. Lifecycle rules move or delete objects based on age, which helps with cost, but they do not prevent deletion before a retention window ends and can even remove data early.
- D. Uniform access and customer-managed keys control who can read data and how it is encrypted. They do not stop a permitted user from deleting or overwriting objects, so they fail the immutability requirement.
Exam tip. For write-once compliance requirements in Cloud Storage, think retention policy with Bucket Lock, not versioning.