Task 3.2: Managing storage and data solutions.

• AEnable Object Versioning so older log files move to a cheaper storage class automatically

  Incorrect

  Object Versioning has no setting that moves objects to another storage class.

• BCreate the bucket in Coldline from the start and add a Delete rule at age 365 days

  Incorrect

  Coldline's retrieval charges would apply to the frequent reads of the first 90 days.

• CSet a retention policy of 365 days on the bucket so objects expire after one year

  Incorrect

  A retention policy neither deletes objects nor changes their class, so it meets neither cost goal.

• DAdd lifecycle rules: SetStorageClass to Coldline at age 90 days, and Delete at age 365 days

  Correct

  Lifecycle rules apply actions by condition, such as age, so objects move to a cheaper class and are deleted on schedule.

Object Lifecycle Management turns an access pattern into rules: change the class when data cools and delete it when it expires.

• AAutomated daily backups of the instance

  Correct

  Point-in-time recovery starts from a backup, so automated backups must be on.

• BHigh availability with a standby in another zone

  Incorrect

  The standby receives the same changes, including the delete, so it protects against zone failure rather than bad writes.

• CA weekly export of the database to Cloud Storage

  Incorrect

  An export captures one moment a week, not any minute within the last seven days.

• DA cross-region read replica of the instance

  Incorrect

  A replica applies the same delete shortly after the primary does, so the rows are gone there too.

• EPoint-in-time recovery, which uses binary logging

  Correct

  Binary logs record every change after a backup, which lets you recover to a specific moment.

Recovering to an exact moment needs a base backup plus a log of changes after it. Replicas and standbys copy mistakes as faithfully as good writes.

• AAn access control list on each object that names the customer's email address

  Incorrect

  ACLs grant access to Google identities, which these customers do not have.

• BA signed URL for the object with a 24-hour expiration

  Correct

  A signed URL grants time-limited access to one object to anyone who has the URL, without a Google account.

• CA grant of Storage Object Viewer to allUsers on the bucket, removed after 24 hours

  Incorrect

  This makes every invoice in the bucket public to anyone during the window.

• DAn HMAC key for each customer with access to the bucket

  Incorrect

  HMAC keys are long-lived credentials for applications using the XML API, not short-lived links for people.

Signed URLs embed the authorization in the link: one object, a chosen method and an expiry. They suit sharing with people outside your identity system.

• ATurn on Object Versioning so that objects are rewritten with the new key after each upload

  Incorrect

  Versioning keeps older versions of objects; it has nothing to do with which key encrypts them.

• BGrant the uploading users the Cloud KMS CryptoKey Encrypter/Decrypter role on the us-central1 key

  Incorrect

  Cloud Storage uses the key through its service agent, not with the users' permissions, and the key's location still does not match.

• CSupply a customer-supplied encryption key with each upload instead of a Cloud KMS key

  Incorrect

  Customer-supplied keys work, but then the company must manage and send key material on every request, which is not what was asked.

• DUse a key in europe-west3 and grant the Cloud Storage service agent Encrypter/Decrypter on it

  Correct

  The key must be in a location compatible with the bucket, and the Cloud Storage service agent needs permission to use the key.

With CMEK, a Google-managed service agent encrypts and decrypts on your behalf. It needs the Encrypter/Decrypter role on the key, and the key ring must be in a location that matches the bucket.

• ASigned URLs for every employee

  Incorrect

  These do not stop anyone from granting public access to the bucket.

• BA firewall rule that blocks internet traffic to the bucket

  Incorrect

  VPC firewall rules do not apply to Cloud Storage access.

• CObject Versioning on the bucket

  Incorrect

  Versioning keeps older versions; it does not stop public grants.

• DPublic access prevention on the bucket

  Correct

  With public access prevention enforced, the bucket and its objects cannot be made public, while other access works as before.

Public access prevention is a guardrail on top of IAM: it blocks allUsers and allAuthenticatedUsers grants on the bucket.

• Abq query "SELECT * FROM events WHERE key = 'ROW_KEY'"

  Incorrect

  bq queries BigQuery tables, not this Bigtable table.

• Bgcloud bigtable instances describe prod

  Incorrect

  This shows the instance's configuration, not table data.

• Ccbt -instance=prod lookup events ROW_KEY

  Correct

  cbt lookup reads a single row by its key.

• Dgcloud storage cat gs://events/ROW_KEY

  Incorrect

  This reads objects from Cloud Storage, not Bigtable rows.

The cbt CLI covers everyday Bigtable reads: lookup for one row, read for ranges.

• AThe Google Cloud Pricing Calculator

  Correct

  The calculator builds cost estimates for planned products and lets you share them.

• BA Cloud Monitoring dashboard of storage usage

  Incorrect

  Dashboards show usage of existing resources, not future cost.

• CThe Cloud Asset Inventory console

  Incorrect

  Asset Inventory lists existing resources, not prices of planned ones.

• DThe Budgets page of the billing account

  Incorrect

  Budgets track actual spend after resources exist.

Estimate before you build with the Pricing Calculator; track after you build with billing tools.

• AThey are re-encrypted with a Google-managed key automatically

  Incorrect

  Cloud Storage does not switch to another key by itself.

• BThey cannot be accessed until the key version is enabled again

  Correct

  While a key version is disabled, data encrypted with it cannot be accessed; re-enabling restores access.

• CThey stay readable because Google keeps a plaintext copy

  Incorrect

  Google does not keep a plaintext copy to bypass your key.

• DThey are deleted immediately and permanently

  Incorrect

  Disabling a key version does not delete data; it blocks access.

With CMEK, your key controls access to the data. Disable a key version only when you mean to cut off access.

• ARun the query with LIMIT 10 to see the cost

  Incorrect

  On non-clustered tables a LIMIT clause does not reduce the bytes processed or the cost.

• BPreview the table in the console

  Incorrect

  Previewing shows rows of the table, not what a query would process.

• CRun the query once and check the cost afterward

  Incorrect

  This pays for the query before knowing what it costs.

• DPerform a dry run of the query

  Correct

  A dry run estimates the bytes the query would process without running it.

Estimate first with a dry run, and cap risk with a maximum bytes billed setting when needed.