How many GCP interview questions should I actually prepare?

For a fresher or internship screen, the fundamentals, Compute Engine, Cloud Storage, IAM and VPC topics are enough — roughly 200 questions. For a mid-level cloud or DevOps role add GKE, Cloud Run, Cloud SQL, BigQuery, monitoring and Terraform. Senior and architect loops lean heavily on the architecture, cost, security and troubleshooting sets, where the interviewer cares far more about how you reason through trade-offs than about recalling service limits.

Do I need a Google Cloud certification to clear a GCP interview?

No, but it helps you get shortlisted, especially for service-company and partner roles where certifications count towards the vendor partnership tier. Associate Cloud Engineer maps closely to the junior and mid questions here; Professional Cloud Architect and Professional Data Engineer map to the senior and architecture sets. A certification with no hands-on stories behind it is transparent in an interview, so build something small and be ready to talk about it.

What is the most common reason candidates fail a GCP interview?

Answering from memorised definitions instead of from consequences. Anyone can say what a VPC is; far fewer can say what breaks when two VPCs have overlapping CIDR ranges, or why an IAM change did not take effect for several minutes. Every answer in this guide includes the consequence, because that is what separates a pass from a fail.

How is a GCP interview different from an AWS interview?

The service names differ but the reasoning is almost identical — networking, identity, storage classes, scaling and cost trade-offs all transfer. GCP interviews tend to push harder on the global VPC model, the resource hierarchy and IAM inheritance, BigQuery, and Kubernetes, because GKE is where Kubernetes originated. If you already know AWS, the mapping is worth learning explicitly, and interviewers often ask for it directly.

Are these questions suitable for freshers with no cloud experience?

Yes. Every topic starts at junior level and the fundamentals set assumes no prior cloud exposure. What you cannot skip is hands-on time — sign up for the free tier, deploy one VM, one bucket, one Cloud Run service and one BigQuery query, and you will be able to answer the practical follow-ups that pure theory leaves you stranded on.

GCP Interview Questions and Answers (1001+, Junior to Senior, 2026)

A sample from every topic. Open any topic above for the full set of answers on that service.

Junior level

What is Google Cloud Platform (GCP)?

Answer: Google Cloud Platform is Google's public cloud offering — a suite of on-demand compute, storage, networking, database, big-data, machine-learning and management services delivered over the internet and billed on consumption. It runs on the same global fibre network and data-centre infrastructure that powers Search, Gmail and YouTube.

Why interviewers ask this: Interviewers listen for two things: that you mention pay-as-you-go/consumption billing, and that you know GCP is one of the "big three" alongside AWS and Microsoft Azure. Adding that Google Cloud also includes Google Workspace and the Google Maps Platform under the wider "Google Cloud" brand shows you know the product boundaries.

Junior level

What is the difference between a region and a zone in GCP?

Answer: A region is an independent geographic area (for example asia-south1 in Mumbai) that contains three or more zones. A zone is a deployment area within a region — effectively an isolated failure domain, usually one or a small group of data centres. Resources are either zonal, regional or multi-regional depending on how widely they are replicated.

Why interviewers ask this: The follow-up is always "so how do you build for high availability?" — the answer is to spread instances across multiple zones in a region for zone-fault tolerance, and across multiple regions for region-fault tolerance and lower latency to users. Note that a zone name like asia-south1-a is not guaranteed to map to the same physical hardware across two different projects: Google shuffles the letter-to-cluster mapping per project to spread load.

gcloud

# List every region and zone available to your project
gcloud compute regions list
gcloud compute zones list --filter="region:asia-south1"

Junior level

What is Compute Engine?

Answer: Compute Engine is GCP's Infrastructure-as-a-Service product: configurable virtual machines running on Google's infrastructure, with a choice of machine type, OS image, persistent or local disks, and networking. You control the guest OS upwards; Google runs the hypervisor, hardware and physical facility.

Why interviewers ask this: The differentiators worth naming in the same breath are per-second billing after a one-minute minimum, automatic sustained-use discounts, custom machine types, and live migration during host maintenance. Those four together are what makes the answer sound like experience rather than a definition.

Junior level

What are the Compute Engine machine families and when do you use each?

Answer: General purpose (E2, N2, N2D, N4, C4) for most workloads and the best price-performance balance; compute optimised (C2, C2D, C3) for high per-core performance such as gaming servers or HPC; memory optimised (M1, M2, M3) for large in-memory databases like SAP HANA; accelerator optimised (A2, A3, G2) for GPU and ML workloads; and storage optimised (Z3) for very high local-SSD throughput.

Why interviewers ask this: The pattern interviewers reward is "start on E2 or N2, measure, then move to a specialised family only when a metric forces it". E2 is the cheapest and uses dynamic resource management, which means it does not support sole-tenancy, GPUs, or committed-use discounts in the same way — that exception is a common follow-up.

gcloud

gcloud compute machine-types list --filter="zone:asia-south1-a AND name~'^e2-'"

Junior level

What is Google Cloud Storage?

Answer: Cloud Storage is GCP's managed object storage service. You store immutable objects (files of any type, up to 5 TB each) inside globally-named buckets, addressed by a flat key rather than a directory tree, and access them over HTTP with strong consistency. It is used for static assets, backups, data-lake landing zones, media and log archives.

Why interviewers ask this: The framing interviewers want is "object storage, not a filesystem". There are no real directories — the slashes in an object name are part of the key, and the console only simulates folders. Candidates who talk about Cloud Storage as if it were a mounted disk usually get caught on the next question.

Junior level

What are the Cloud Storage classes and when do you use each?

Answer: Standard for frequently accessed or short-lived data with no minimum storage duration. Nearline for data accessed about once a month, with a 30-day minimum. Coldline for roughly quarterly access, with a 90-day minimum. Archive for data accessed less than once a year, with a 365-day minimum. Storage cost falls at each step while retrieval and operation costs rise.

Why interviewers ask this: The trap is the minimum storage duration: delete or overwrite an Archive object after a week and you are still billed for 365 days. That is why lifecycle rules should move data down the tiers rather than a script deleting and rewriting it. Also worth saying: retrieval latency is milliseconds for all four classes on GCP, unlike some competitors where the coldest tier requires a restore job.

Junior level

What is GKE and what does it manage for you?

Answer: GKE is Google's managed Kubernetes service. Google runs and secures the control plane — the API server, scheduler, controller manager and etcd — handles its availability and upgrades, and provides deep integration with GCP networking, IAM, logging, monitoring and load balancing. You supply workloads and, in Standard mode, manage the worker nodes.

Why interviewers ask this: The credibility marker is knowing that Kubernetes originated at Google from the Borg system, and that GKE is generally the reference implementation — new Kubernetes versions land on GKE early. Mentioning that the control plane is not billed per-node but as a flat cluster management fee is a useful detail.

Mid level

What is the difference between GKE Autopilot and GKE Standard?

Answer: In Standard mode you choose, size, scale and patch node pools, and you pay for the nodes whether or not pods use them. In Autopilot, Google provisions and manages nodes entirely; you specify pod-level CPU, memory and storage requests and are billed for those requested resources. Autopilot enforces security and configuration best practices, which also means it restricts privileged operations.

Why interviewers ask this: The decision rule to state: Autopilot for most application teams, because it removes node management and bin-packing entirely; Standard when you need something Autopilot forbids — privileged containers, custom node OS or kernel settings, certain DaemonSets, specific GPU or sole-tenant configurations. Naming a concrete Autopilot restriction is what proves you have used it.

Junior level

What is Cloud Run?

Answer: Cloud Run is a fully managed serverless platform that runs stateless containers. You supply a container image that listens on the port given by the PORT environment variable; Cloud Run handles provisioning, TLS, scaling from zero to thousands of instances, and billing per 100 milliseconds of usage. It supports HTTP, gRPC, WebSockets and event-driven invocation.

Why interviewers ask this: The framing that scores is "any language, any library, as long as it is in a container and listens on a port" — that container freedom is what distinguishes it from Cloud Functions and from App Engine standard. Mentioning that it is built on Knative-compatible APIs shows depth.

Mid level

What is a Cloud Run revision?

Answer: A revision is an immutable snapshot of a service's container image plus its configuration — environment variables, CPU and memory, concurrency, scaling bounds, service account. Every deployment creates a new revision, and traffic is then assigned to revisions by percentage, which is what makes canary releases and instant rollback trivial.

Why interviewers ask this: Immutability is the whole design. Because you cannot mutate a revision, "rollback" is just moving 100% of traffic back to the previous revision — it takes seconds and requires no rebuild. That is the answer interviewers want when they ask how you would recover from a bad deploy.

gcloud

gcloud run deploy api --image=asia-south1-docker.pkg.dev/p/repo/api:v2 --no-traffic --tag=v2
gcloud run services update-traffic api --to-revisions=api-v2=10,api-v1=90

Junior level

What is a VPC in GCP and how is it different from an AWS VPC?

Answer: A GCP VPC is a global, software-defined private network. It spans every region automatically, and subnets are regional resources inside it, so instances in Mumbai and Frankfurt can sit in the same VPC and reach each other over private IPs with no peering or gateway. An AWS VPC is regional, so a multi-region deployment needs several VPCs plus peering or a transit gateway.

Why interviewers ask this: This is the single most distinctive fact about GCP networking and interviewers ask it constantly. The follow-up consequence: routes and firewall rules are VPC-wide, so a firewall rule you write once applies across every region, which is powerful and also means a mistake has global blast radius.

Junior level

What is a subnet in GCP and what does it determine?

Answer: A subnet is a regional IP range within a VPC. It determines which region resources live in and which internal IPs they receive. Subnets can be expanded in place without downtime, and a VPC-native GKE cluster additionally uses secondary ranges on the subnet for pod and service IPs.

Why interviewers ask this: Two facts to include: subnets cannot span regions, and you can grow a subnet's primary range but never shrink it, and never in a way that overlaps another subnet in the same VPC or in a peered VPC. That "can grow, cannot shrink, must not overlap" trio is what drives IP address planning.

gcloud

gcloud compute networks subnets expand-ip-range prod-asia \
  --region=asia-south1 --prefix-length=20

Junior level

What is Cloud IAM and what are its three core elements?

Answer: Cloud IAM controls who can do what on which resource. The three elements are the principal (a user, group, service account, or domain), the role (a collection of permissions), and the resource the binding applies to. A policy is the set of bindings attached to a resource, and it is evaluated together with everything inherited from above in the hierarchy.

Why interviewers ask this: The phrase interviewers want is "you never grant permissions directly — you grant roles, which are bundles of permissions". Permissions follow the service.resource.verb format such as compute.instances.delete, and knowing that format lets you reason about custom roles.

Junior level

What are the three types of IAM roles?

Answer: Basic roles — Owner, Editor, Viewer — are the legacy, extremely broad roles that predate fine-grained IAM. Predefined roles are service-specific bundles curated and maintained by Google, such as roles/storage.objectViewer. Custom roles are ones you define yourself from an explicit list of permissions when no predefined role fits.

Why interviewers ask this: The recommendation to state clearly is: never use basic roles in production. Editor alone grants tens of thousands of permissions across every service, including the ability to modify most resources, and it is the single most common finding in a GCP security review.

Junior level

What is BigQuery?

Answer: BigQuery is a serverless, highly scalable, columnar data warehouse. You load or stream data in and query it with standard SQL; there are no clusters, nodes or indexes to manage, and storage and compute are separated so each scales and is billed independently. It handles petabyte-scale analytical queries in seconds.

Why interviewers ask this: The separation of storage and compute is the architectural fact to lead with, because it explains almost everything else — why you can query a table nobody has "attached" to a cluster, why storage is cheap, and why cost control is about how much data a query *scans* rather than how big the warehouse is.

Senior level

How does BigQuery's architecture work under the hood?

Answer: Storage is Colossus, Google's distributed file system, holding data in the columnar Capacitor format. Compute is Dremel, which decomposes a query into a tree of execution stages across thousands of slots. The two are connected by Jupiter, Google's petabit-scale network, which is what makes separating them practical. Shuffle happens in memory between stages.

Why interviewers ask this: Naming Dremel, Colossus, Capacitor and Jupiter demonstrates you have read beyond the marketing page. The point to draw out is that because the network is fast enough, compute does not need data locality, which is precisely why BigQuery can be serverless while traditional warehouses cannot.

Junior level

What is Cloud SQL?

Answer: Cloud SQL is GCP's fully managed relational database service for MySQL, PostgreSQL and SQL Server. Google handles provisioning, patching, backups, replication, encryption and failover, while you keep full SQL compatibility and normal client drivers. It is the default choice for OLTP workloads that need a traditional relational database.

Why interviewers ask this: The boundary to state is what it does *not* do: it is a single-region primary with vertical scaling limits, so it does not horizontally scale writes. When a candidate proposes Cloud SQL for a global write-heavy workload, that limit is exactly what the interviewer is probing.

Mid level

How does high availability work in Cloud SQL?

Answer: An HA configuration provisions a standby instance in a different zone within the same region, with synchronous replication of the underlying regional persistent disk. If the primary's zone fails or the primary becomes unresponsive, Cloud SQL automatically fails over to the standby, which takes over the same connection name and IP, typically within a minute or two.

Why interviewers ask this: Two facts to include: the standby serves no read traffic — it is purely for failover, unlike a read replica — and HA protects against a zone failure, not a region failure. Regional protection requires a cross-region read replica that you promote manually, which is a different RPO and RTO story.

Mid level

What is Cloud Spanner?

Answer: Spanner is a globally distributed relational database that combines horizontal write scalability with strong external consistency and full SQL support, including schemas, secondary indexes and ACID transactions across rows, tables and regions. It is the only widely-available database that offers relational semantics and horizontal scaling simultaneously.

Why interviewers ask this: The claim to explain rather than repeat is external consistency: transactions appear to occur in a global order consistent with real time, not merely serialisable. That is a stronger guarantee than most distributed databases offer and it is what TrueTime enables.

Senior level

What is TrueTime and why does Spanner need it?

Answer: TrueTime is Google's globally synchronised clock API backed by GPS receivers and atomic clocks in every data centre. It returns a time interval with a bounded uncertainty rather than a single instant. Spanner assigns commit timestamps and waits out that uncertainty before acknowledging a write, which is how it guarantees that any transaction starting later sees the earlier one — external consistency across regions.

Why interviewers ask this: This is the deepest piece of Spanner theory an interviewer will ask, and the key insight is the commit-wait: Spanner deliberately waits a few milliseconds to make the ordering guarantee safe. It trades a small latency cost for a much stronger consistency model, and articulating that trade-off is the whole answer.

Junior level

What is Cloud Pub/Sub?

Answer: Pub/Sub is a fully managed, globally distributed messaging service implementing the publish-subscribe pattern. Publishers send messages to a topic, subscribers receive them through subscriptions, and Pub/Sub decouples the two — publishers do not know who consumes, and consumers can be added without changing the publisher. It scales to millions of messages per second with no capacity planning.

Why interviewers ask this: The property to emphasise is decoupling in both time and space: a subscriber that is down does not block the publisher, and messages are retained until acknowledged or until the retention window expires. That is what makes it the backbone of event-driven architectures.

Junior level

What is the difference between a topic and a subscription?

Answer: A topic is the named channel publishers write to. A subscription is a named stream of messages from that topic for one consumer group — each subscription receives its own copy of every message. So two subscriptions on one topic means two independent consumers each get everything; two consumer instances on one subscription share the load.

Why interviewers ask this: This is the fan-out versus load-balancing distinction and candidates get it wrong constantly. If you want three services to react to an order event, you create three subscriptions. If you want ten workers sharing the load, they all pull from one subscription.

Junior level

What is Cloud Dataflow?

Answer: Dataflow is a fully managed service for running Apache Beam pipelines, handling both batch and streaming with the same code. It provisions and autoscales workers, rebalances work dynamically, and manages checkpointing and exactly-once state so you write transformation logic rather than cluster management.

Why interviewers ask this: The unified batch-and-streaming model is the headline: the same pipeline can read a bounded file collection or an unbounded Pub/Sub stream. That is the Beam idea Dataflow implements, and naming Beam as the programming model versus Dataflow as the runner is the distinction interviewers check.

Mid level

What is Apache Beam and what are its core abstractions?

Answer: Beam is a unified programming model for data processing. Its core abstractions are the Pipeline (the whole job), the PCollection (a distributed, possibly unbounded dataset), the PTransform (an operation applied to a PCollection), and I/O connectors as sources and sinks. Windowing, triggers and watermarks handle time in streaming.

Why interviewers ask this: The property to state about PCollections is that they are immutable — a transform produces a new PCollection rather than mutating the input, which is what allows the runner to parallelise and retry freely. That immutability is the basis of the whole execution model.

Junior level

What is Vertex AI?

Answer: Vertex AI is GCP's unified machine-learning platform, covering the whole lifecycle: data labelling, feature management, AutoML and custom training, hyperparameter tuning, a model registry, batch and online prediction endpoints, pipelines for orchestration, and model monitoring. It also hosts Google's foundation models such as Gemini and provides the tooling around them.

Why interviewers ask this: The word "unified" is the point — it replaced separate AI Platform and AutoML products that had different APIs and artefacts. Framing it as one platform with consistent metadata and lineage across training and serving is what the product is actually for.

Mid level

What is the difference between AutoML and custom training on Vertex AI?

Answer: AutoML trains a model from your labelled data with no model code — you choose the objective, supply data, and Google searches architectures and hyperparameters. Custom training runs your own code in a container with your chosen framework, giving full control over architecture, loss and training loop, at the cost of doing the work yourself.

Why interviewers ask this: The decision rule is a baseline argument: start with AutoML to establish what accuracy is achievable and how quickly, then move to custom training only if you can beat it meaningfully. Teams that begin with custom training often spend weeks matching what AutoML produced in an afternoon.

Junior level

What are Cloud Functions?

Answer: Cloud Functions is GCP's functions-as-a-service offering: you deploy a single function in a supported runtime — Node.js, Python, Go, Java, .NET, Ruby, PHP — and Google runs it in response to an HTTP request or an event, scaling automatically and billing only for execution time. There is no server or container to define.

Why interviewers ask this: The framing to lead with is "smallest unit of deployable compute": one function, one responsibility, triggered by one kind of event. It suits glue code and event handlers, and becomes awkward as soon as you want several related endpoints, which is where Cloud Run fits better.

Mid level

What is the difference between Cloud Functions 1st gen and 2nd gen?

Answer: 2nd gen is built on Cloud Run and Eventarc, so it inherits much longer timeouts (up to 60 minutes for HTTP), larger instances up to 16 GiB and 4 vCPU, concurrency of up to 1000 requests per instance, traffic splitting between revisions, and access to more than 90 event sources through Eventarc. 1st gen has shorter timeouts, one request per instance and a limited trigger set.

Why interviewers ask this: The concurrency difference is the most consequential: 1st gen handled exactly one request per instance, so ten simultaneous requests meant ten instances and ten cold starts. 2nd gen behaves like Cloud Run, which changes both latency and cost substantially.

Mid level

What load balancer types does GCP offer?

Answer: They divide along three axes: external versus internal, application (layer 7, proxy) versus network (layer 4), and global versus regional. So the main options are the global external Application Load Balancer, regional external Application Load Balancer, internal Application Load Balancer, external passthrough Network Load Balancer, internal passthrough Network Load Balancer, and external proxy Network Load Balancer for TCP and SSL.

Why interviewers ask this: The framing that makes this memorable is to answer the three questions in order — is the traffic from the internet or internal, do you need HTTP-aware routing, and does it need to be global — because those three answers uniquely select a product.

Senior level

What is the difference between a proxy and a passthrough load balancer?

Answer: A proxy load balancer terminates the client connection and opens a new one to the backend, so it can inspect and modify HTTP, apply TLS termination, route by path or header, and add CDN and WAF. A passthrough load balancer forwards packets to the backend without terminating, so the backend sees the original client IP and any protocol works, but no layer 7 features are available.

Why interviewers ask this: The consequence to name is source IP: with a proxy, the backend sees the load balancer's IP and must read X-Forwarded-For; with passthrough it sees the real client. That difference bites when someone implements IP-based rate limiting behind a proxy and blocks everyone.

Mid level

How does GCP encrypt data at rest by default?

Answer: All customer data at rest is encrypted by default with no configuration and no extra cost. Data is chunked, each chunk encrypted with its own data encryption key, and those keys are wrapped by key encryption keys held in Google's internal key management system, with regular automatic rotation. The customer does not manage anything unless they choose to.

Why interviewers ask this: The envelope-encryption structure is the part to explain, because it is the same model CMEK extends: with CMEK you supply the key encryption key from Cloud KMS while Google still manages the per-chunk data encryption keys. Understanding envelope encryption makes every subsequent key question straightforward.

Mid level

What is Cloud KMS?

Answer: Cloud KMS is GCP's managed key management service. You create key rings scoped to a location, and keys within them, with a purpose — symmetric encryption, asymmetric signing or encryption, or MAC. It supports automatic rotation, versioning, IAM per key, and audit logging of every use.

Why interviewers ask this: The location constraint matters: a key ring is created in a region or multi-region and cannot be moved, and a resource generally must use a key in a compatible location. Getting that wrong means recreating resources, so it is a planning decision rather than a detail.

Junior level

What is the Google Cloud Operations suite?

Answer: It is the observability stack formerly called Stackdriver: Cloud Monitoring for metrics, dashboards, uptime checks and alerting; Cloud Logging for log ingestion, search, sinks and log-based metrics; Cloud Trace for distributed tracing; Cloud Profiler for continuous CPU and memory profiling; and Error Reporting for grouped exception tracking.

Why interviewers ask this: Naming all five and what each is *for* is the answer. The connection worth drawing is that they share resource labels, so a metric, a log entry and a trace for the same Cloud Run revision can be correlated automatically — that correlation is the value of an integrated suite.

Mid level

What is the difference between metrics, logs and traces?

Answer: Metrics are numeric time series — cheap to store, good for trends, dashboards and alerting, but they cannot tell you about a specific request. Logs are discrete records with detail, good for investigating a specific event, but expensive at volume. Traces follow a single request across services, showing where time was spent.

Why interviewers ask this: The way to use them together is the substance: alert on metrics because they are cheap and aggregate, use traces to find which service is slow, then use logs to find out why. Candidates who reach for logs first for every problem are describing an expensive and slow workflow.

Junior level

How is billing structured in GCP?

Answer: A Cloud Billing account is a payment profile that sits outside the resource hierarchy and is linked to one or more projects. Costs accrue per project against the linked billing account. Billing accounts have their own IAM roles, support budgets and alerts, and can export detailed usage and cost data to BigQuery for analysis.

Why interviewers ask this: The fact to volunteer is that a project with no active billing account has most services disabled, and that moving a project between billing accounts is possible but changes where its costs land. Both matter when reorganising an estate.

Mid level

What is a budget and does it stop spending?

Answer: A budget sets an amount and triggers alerts at configured percentage thresholds, based on actual or forecast spend. It does not cap spending — exceeding a budget changes nothing by itself. To actually stop spend, route the budget notification to Pub/Sub and have a Cloud Function disable billing on the project.

Why interviewers ask this: This is one of the most commonly misunderstood facts in GCP and interviewers ask it deliberately. The follow-up caution is that disabling billing terminates resources and can destroy data, so it is appropriate for a sandbox and dangerous for production.

Junior level

What is Cloud Build?

Answer: Cloud Build is GCP's serverless CI/CD execution service. A build is a sequence of steps, each running a container image with your source mounted, defined in a cloudbuild.yaml or a Dockerfile. It triggers on repository events, has no build servers to maintain, and integrates with IAM, Secret Manager, Artifact Registry and Cloud Deploy.

Why interviewers ask this: The "every step is a container" model is the point to draw out: it means any tool can be a build step without installing anything on a shared agent, and steps are reproducible. That is a meaningful difference from a traditional agent-based CI system with drifting tool versions.

Mid level

How do build steps share data in Cloud Build?

Answer: All steps share the /workspace volume, which holds the checked-out source and persists across steps within a build. Anything written elsewhere in a step's container is lost when that step ends. Artifacts that must outlive the build go to Artifact Registry or Cloud Storage.

Why interviewers ask this: The follow-up is step ordering and parallelism: steps run sequentially by default, and waitFor lets you express a dependency graph so independent steps run in parallel. Knowing waitFor is a good signal of having optimised a real pipeline.

YAML

steps:
  - id: test
    name: node:22
    entrypoint: npm
    args: ['test']
  - id: build
    name: gcr.io/cloud-builders/docker
    args: ['build','-t','asia-south1-docker.pkg.dev/$PROJECT_ID/app/api:$SHORT_SHA','.']
    waitFor: ['test']

Junior level

What is Infrastructure as Code and why does it matter?

Answer: Infrastructure as Code means defining infrastructure in version-controlled, declarative files that a tool applies, rather than clicking in a console. It matters because it makes environments reproducible, changes reviewable, drift detectable and rollback possible, and it turns infrastructure knowledge from something in people's heads into something in a repository.

Why interviewers ask this: The specific failure it prevents is the unreproducible environment: production configured by hand over three years that nobody can recreate. Naming reviewability — an infrastructure change getting the same scrutiny as a code change — is the point interviewers value most.

Mid level

What is Terraform state and why does it exist?

Answer: State is Terraform's record of which real resources correspond to which configuration blocks, along with their last-known attributes. It exists because Terraform must map declarative configuration to actual resource identifiers, detect what changed, and know what to destroy when a block is removed.

Why interviewers ask this: The consequence to name is that state is authoritative and dangerous: losing it means Terraform no longer knows it owns those resources and will try to recreate them. That is why remote state with versioning is not optional on a real project.

Mid level

What does DevOps actually mean to you?

Answer: Shared ownership of software from commit to production — developers accountable for how their code runs and operations engineers building the platform and automation that makes that safe. In practice it shows up as automated delivery, infrastructure as code, observability owned by the team that writes the code, and a blameless culture around failure.

Why interviewers ask this: The answer to avoid is "DevOps is a role that does CI/CD". Interviewers listen for whether you describe it as a way of working with cultural and organisational components, and naming the four DORA metrics as how you would measure it is a strong close.

Mid level

What is a container image layer and why does layer order matter?

Answer: A Docker image is built from stacked read-only layers, one per instruction, cached and reused across builds. Order matters because a change in one layer invalidates every layer after it — so you copy dependency manifests and install dependencies before copying application source, and the frequently-changing source last.

Why interviewers ask this: This is the single most common Dockerfile optimisation and it turns a two-minute rebuild into ten seconds. The other point is that deleting a file in a later layer does not remove it from the image, which is why secrets baked into an early layer remain recoverable.

Dockerfile

COPY package*.json ./
RUN npm ci --omit=dev
COPY . .

Mid level

What are the common cloud migration strategies?

Answer: The "6 Rs": rehost (lift and shift with no change), replatform (lift and optimise — for example moving a database to Cloud SQL), refactor or re-architect (redesign for cloud-native), repurchase (move to a SaaS product), retire (decommission what nobody uses), and retain (leave it where it is for now).

Why interviewers ask this: The valuable part is knowing that retire and retain are real answers, not failures. In most portfolio assessments a meaningful share of applications turn out to be unused or not worth moving, and identifying those early is the cheapest win in the whole programme.

Senior level

How do you decide which strategy applies to a given application?

Answer: Assess business value, technical fit and change appetite. Rehost when the deadline is a data-centre exit and the application works as is. Replatform when a managed service removes real operational burden with limited change. Refactor when the application is strategically important and its current architecture blocks the business. Repurchase for commodity functions. Retire for anything unused.

Why interviewers ask this: The driver to name explicitly is the deadline: a hard data-centre exit date forces rehost first and modernisation later, whereas an open timeline allows selective refactoring. Attempting to refactor everything during a time-boxed exit is the classic way these programmes fail.

Senior level

How do you approach an open-ended cloud design question in an interview?

Answer: Clarify requirements before designing: expected scale, latency targets, availability and recovery objectives, data residency and compliance, budget, team skills, and what already exists. Then state assumptions, sketch a high-level design, and go deeper where the interviewer probes, naming trade-offs at each decision rather than presenting one answer as obviously correct.

Why interviewers ask this: The most common failure is jumping to services in the first thirty seconds. Interviewers are assessing whether you gather requirements, so asking two or three sharp questions — "what is the read to write ratio?", "is this a hard 99.99% or an aspiration?" — is worth more than any specific architecture.

Senior level

What are the pillars of the Google Cloud Architecture Framework?

Answer: Operational excellence, security and compliance, reliability, cost optimisation, performance optimisation, and sustainability. They are the axes along which you evaluate a design, and improving one usually costs something on another — which is why explicit trade-offs matter more than a single "best" architecture.

Why interviewers ask this: The value in using the framework is that it gives you a checklist so you do not present a design that is technically elegant and operationally unmaintainable. Naming which pillar you are trading away in a given decision is what a senior interviewer wants to hear.

Mid level

How do you approach a production incident you have never seen before?

Answer: Stabilise first, diagnose second. Check the scope — which users, which region, which service. Look for a recent change, because most incidents follow a deployment or configuration change, and roll back if one correlates. Then work down the stack from user symptom to component, using dashboards and traces rather than guessing, and communicate status while you work.

Why interviewers ask this: The single most valuable habit is "what changed?" — it resolves the majority of incidents faster than root-cause analysis does. Interviewers are listening for whether you restore service before understanding it, which is the correct priority order.

Senior level

Your load balancer returns 502 but the backend responds fine when you curl it directly. What is wrong?

Answer: Almost always health checks. Verify the firewall allows 130.211.0.0/22 and 35.191.0.0/16 to the health-check port, that the check path returns 200, and that the backend service port and protocol match. Also check the backend service timeout against actual response time, and whether the backend closes idle connections faster than the load balancer expects, which causes intermittent 502s.

Why interviewers ask this: Reciting the health-check source ranges immediately is the strongest possible signal here. The keepalive mismatch is the subtle second cause and is worth naming because it produces intermittent rather than total failure, which is much harder to diagnose.

Junior level

What is cloud computing?

Answer: Cloud computing is the delivery of computing resources — servers, storage, databases, networking, software — over the internet, on demand, paid for by usage rather than bought up front. Instead of buying and running hardware, you rent capacity from a provider and scale it up or down as needed.

Why interviewers ask this: A good fresher answer names the shift from capital expenditure to operating expenditure, and from weeks to provision a server to seconds. Adding one concrete example — "we can create a virtual machine in a minute instead of ordering hardware" — makes it real rather than recited.

Junior level

What are the main benefits of using the cloud?

Answer: Elasticity — scale up for a traffic spike and back down after; pay for what you use rather than for peak capacity; global reach without building data centres; managed services that remove operational work; faster time to market; and built-in reliability through multiple zones and regions.

Why interviewers ask this: Interviewers also want honesty about the trade-offs: less control, potential vendor lock-in, and the fact that cloud can be more expensive than on-premises for a steady, fully-utilised workload. A candidate who names one downside sounds far more credible than one who lists only benefits.

GCP Interview Questions and Answers

All 25 topics

Which interviews is this for?

50 of the most-asked GCP interview questions

What is Google Cloud Platform (GCP)?

What is the difference between a region and a zone in GCP?

What is Compute Engine?

What are the Compute Engine machine families and when do you use each?

What is Google Cloud Storage?

What are the Cloud Storage classes and when do you use each?

What is GKE and what does it manage for you?

What is the difference between GKE Autopilot and GKE Standard?

What is Cloud Run?

What is a Cloud Run revision?

What is a VPC in GCP and how is it different from an AWS VPC?

What is a subnet in GCP and what does it determine?

What is Cloud IAM and what are its three core elements?

What are the three types of IAM roles?

What is BigQuery?

How does BigQuery's architecture work under the hood?

What is Cloud SQL?

How does high availability work in Cloud SQL?

What is Cloud Spanner?

What is TrueTime and why does Spanner need it?

What is Cloud Pub/Sub?

What is the difference between a topic and a subscription?

What is Cloud Dataflow?

What is Apache Beam and what are its core abstractions?

What is Vertex AI?

What is the difference between AutoML and custom training on Vertex AI?

What are Cloud Functions?

What is the difference between Cloud Functions 1st gen and 2nd gen?

What load balancer types does GCP offer?

What is the difference between a proxy and a passthrough load balancer?

How does GCP encrypt data at rest by default?

What is Cloud KMS?

What is the Google Cloud Operations suite?

What is the difference between metrics, logs and traces?

How is billing structured in GCP?

What is a budget and does it stop spending?

What is Cloud Build?

How do build steps share data in Cloud Build?

What is Infrastructure as Code and why does it matter?

What is Terraform state and why does it exist?

What does DevOps actually mean to you?

What is a container image layer and why does layer order matter?

What are the common cloud migration strategies?

How do you decide which strategy applies to a given application?

How do you approach an open-ended cloud design question in an interview?

What are the pillars of the Google Cloud Architecture Framework?

How do you approach a production incident you have never seen before?

Your load balancer returns 502 but the backend responds fine when you curl it directly. What is wrong?

What is cloud computing?

What are the main benefits of using the cloud?

GCP interview FAQs

How many GCP interview questions should I actually prepare?

Do I need a Google Cloud certification to clear a GCP interview?

What is the most common reason candidates fail a GCP interview?

How is a GCP interview different from an AWS interview?

Are these questions suitable for freshers with no cloud experience?

Prepared? Now find the role.