GCP ACE Practice / Study guide / Topics / Cloud Storage: Classes, Access & Security
Cloud Storage: Classes, Access & Security
What actually gets tested on the Google Cloud Associate Cloud Engineer exam,
the traps to know, and 6 free sample questions with full explanations.
First, tell the storage products apart: Cloud Storage is object storage (buckets, HTTP access) for unstructured data; Persistent Disk (or Hyperdisk) is a block device attached to a single VM, read-write, at a time; and Filestore is managed NFS that many clients can mount simultaneously with POSIX semantics. A scenario needing shared, simultaneous read-write access from multiple instances is describing Filestore, not a Persistent Disk — PD's read-write mode is single attachment only.
Storage classes (Standard, Nearline, Coldline, Archive) come up constantly, and the differentiator the exam actually tests is access frequency and minimum storage duration, not just raw price — Archive is cheapest per GB but has the longest minimum storage duration and the highest retrieval cost, so it's wrong for anything accessed even occasionally. Multi-region and dual-region buckets replicate across geographically separated locations for higher availability against a regional failure; versioning preserves prior object generations on overwrite or delete (an "undo" mechanism, usually paired with a lifecycle rule to expire old versions and control the extra storage cost it creates).
On access control, prefer uniform bucket-level access and IAM over legacy per-object ACLs whenever a question is framed around simplifying or auditing permissions — ACLs are the older, more granular but harder-to-audit mechanism. For encryption, Google encrypts data at rest by default at no extra cost; Cloud KMS with customer-managed encryption keys (CMEK) is the answer when a scenario specifically needs you to control key rotation and revocation yourself (see the Data Protection topic for the full CMEK-vs-CSEK breakdown).
Exam tips for this topic
- Shared, simultaneous read-write access from multiple instances is Filestore, not Persistent Disk — PD read-write mode attaches to exactly one instance.
- Storage class differences are about access frequency and minimum storage duration, not just "how cheap" — Archive has the longest minimum duration and highest retrieval cost.
- Prefer uniform bucket-level access (IAM) over legacy per-object ACLs whenever a question is about simplifying or auditing bucket permissions.
Sample questions — Cloud Storage: Classes, Access & Security
These 6 questions are drawn from our full bank of 658 to show the style and
depth you'll get in the app. Each comes with the full explanation you'd see after answering
in a real practice session.
Cloud Storage
Your new app needs an assets bucket in region europe-west1 with uniform access control. Which command creates it?
- gcloud storage buckets create gs://acme-app-assets --location=europe-west1 --uniform-bucket-level-accessCorrect
- gcloud buckets new acme-app-assets
- gsutil create-bucket acme-app-assets
- gcloud storage create gs://... --acl=fine-grained
Why: gcloud storage buckets create (successor to gsutil mb) with uniform bucket-level access is the recommended setup — IAM-only permissions, no per-object ACLs. Bucket names are globally unique.
Storage
Which statement correctly matches the storage product to its model?
- Cloud Storage = objects, Persistent Disk = block, Filestore = shared file (NFS)Correct
- Cloud Storage = block, Persistent Disk = shared file (NFS), Filestore = objects
- All three are object stores that differ only in price and latency
- Filestore = block storage that can be attached to a single VM
Why: Objects (buckets, HTTP access) are Cloud Storage; block devices attached to VMs are Persistent Disk/Hyperdisk; NFS shares mounted by many clients are Filestore. Picking the wrong model is a common architecture error.
Storage ops
You need to move all objects from bucket A to bucket B in the same project without pulling data through your own network. What is the efficient way?
- gcloud storage mv (or Storage Transfer Service for very large buckets) server-sideCorrect
- Download everything to a laptop and re-upload
- Rename the bucket
- Email support to swap them
Why: Server-side copies never touch your bandwidth; STS handles massive buckets with parallelism and checksums. Buckets can't be renamed (names are global/permanent) — 'rename' is really copy+delete.
Storage security
After reading about yet another public-bucket data breach, you enable public access prevention across your org. What does it do?
- Blocks granting allUsers/allAuthenticatedUsers, ensuring the bucket can never be made public — enforceable by org policyCorrect
- Requires every request to carry a signed URL
- Encrypts objects with a second, access-specific key
- Blocks all downloads from outside your VPC
Why: PAP is the guardrail against accidental public buckets (a legendary breach class). Legitimate access via IAM continues; it targets only public principals.
Cloud Storage
You must copy a local folder of 10,000 small files into your bucket without it taking all afternoon. What is the efficient way?
- gcloud storage cp -r ./assets gs://bucket/ (parallelized by default; gsutil needed -m)Correct
- One gsutil cp per file in a loop
- FTP to the bucket
- Email attachments
Why: gcloud storage parallelizes transfers automatically (legacy gsutil required -m for parallelism). Buckets have no FTP endpoint; per-file serial copies are painfully slow.
Storage
Several GKE pods and Compute Engine VMs must all read and write the same POSIX file share concurrently. Which service?
- Filestore (managed NFS)Correct
- A single persistent disk attached read-write to every pod and VM at once
- Cloud Storage, mounted with gsutil rsync running on each client
- Local SSDs on each machine, replicated manually between them
Why: Filestore provides managed NFS that many clients mount simultaneously with POSIX semantics. A PD can be attached read-write to only one instance at a time (multi-writer is niche), and object storage isn't a POSIX filesystem.
Practice this for real
The app has dozens more questions on this and every other topic, with instant scoring,
spaced repetition of what you get wrong, and progress tracking across sessions.
Start practicing →
This topic shows up in
Other topics