Question 1

What is Google Cloud Storage?

Accepted Answer

Cloud Storage is GCP's managed object storage service. You store immutable objects (files of any type, up to 5 TB each) inside globally-named buckets, addressed by a flat key rather than a directory tree, and access them over HTTP with strong consistency. It is used for static assets, backups, data-lake landing zones, media and log archives. The framing interviewers want is "object storage, not a filesystem". There are no real directories — the slashes in an object name are part of the key, and the console only simulates folders. Candidates who talk about Cloud Storage as if it were a mounted disk usually get caught on the next question.

Question 2

What are the Cloud Storage classes and when do you use each?

Accepted Answer

Standard for frequently accessed or short-lived data with no minimum storage duration. Nearline for data accessed about once a month, with a 30-day minimum. Coldline for roughly quarterly access, with a 90-day minimum. Archive for data accessed less than once a year, with a 365-day minimum. Storage cost falls at each step while retrieval and operation costs rise. The trap is the minimum storage duration: delete or overwrite an Archive object after a week and you are still billed for 365 days. That is why lifecycle rules should move data down the tiers rather than a script deleting and rewriting it. Also worth saying: retrieval latency is milliseconds for all four classes on GCP, unlike some competitors where the coldest tier requires a restore job.

Question 3

What is the difference between a regional, dual-region and multi-region bucket?

Accepted Answer

A regional bucket stores data in one region — lowest cost and lowest latency for compute in that region. A dual-region bucket keeps data in two specific regions with a defined replication behaviour and gives you higher availability with a known geography. A multi-region bucket spreads data across a large geographic area such as US, EU or ASIA for the highest availability and best global read latency. The rule to state is "co-locate the bucket with the compute that reads it most". A regional bucket read from a different region incurs cross-region network egress and added latency, which is a very common and quietly expensive mistake in data pipelines.

Question 4

What consistency guarantees does Cloud Storage provide?

Accepted Answer

Cloud Storage provides strong global consistency for object reads, writes, deletes and for the metadata of an object: once a write returns success, any subsequent read anywhere returns the new object. Bucket and object *listing* is also strongly consistent. Bucket-level metadata and IAM changes are eventually consistent and can take time to propagate. This is worth being precise about, because the old S3 behaviour of eventually-consistent overwrites has shaped a lot of folklore. Saying "read-after-write is strongly consistent for objects, but an IAM grant may take a minute to take effect" shows you know exactly where the boundary sits.

Question 5

What is uniform bucket-level access and why is it recommended?

Accepted Answer

Uniform bucket-level access disables the legacy per-object ACL system so that permissions are governed exclusively by IAM at the bucket level. It is recommended because managing thousands of individual object ACLs is unauditable — you cannot answer "who can read this bucket?" reliably when any object may carry its own grants. The migration caveat: once you enable uniform access you have 90 days to switch it back, after which it is permanent. Organisation policy constraints commonly enforce it estate-wide, and the fine-grained alternative should only survive where a genuine legacy per-object requirement exists.

Question 6

What is a signed URL and when would you use one?

Accepted Answer

A signed URL is a time-limited URL that grants anyone holding it permission to perform a specific operation — usually GET or PUT — on a specific object, without needing a Google identity. You generate it by signing a request with a service account's private key. It is the standard way to let an end user download a private file or upload directly to a bucket. The architectural value is that the upload or download bypasses your application servers entirely — the client talks straight to Cloud Storage — so you do not pay for proxying bandwidth and you do not need to size servers for large file transfers. Expiry should be short, minutes not days, because anyone who obtains the URL can use it.

Question 7

What is the difference between a signed URL and a signed policy document?

Accepted Answer

A signed URL authorises one specific operation on one specific object. A signed policy document authorises a browser-based form POST upload while constraining what may be uploaded — key prefix, content type, and a size range — which lets you accept uploads from an HTML form without pre-naming the object. The practical selection rule: signed URL when your client controls the exact object name and method, signed policy when you are accepting an arbitrary user upload through a form and need server-side constraints on size and type. Size limiting is the reason most people reach for the policy document.

Question 8

How does object versioning work in Cloud Storage?

Accepted Answer

When versioning is enabled on a bucket, overwriting or deleting an object does not destroy it — the previous version is retained as a noncurrent version identified by a generation number. You can list, restore or permanently delete noncurrent versions, which protects against accidental deletion and application bugs. The cost warning is essential: noncurrent versions are billed as ordinary storage, so a bucket with versioning and frequent overwrites can grow without bound. Versioning must always be paired with a lifecycle rule that deletes noncurrent versions after N days or keeps only the newest few.

Question 9

What are Object Lifecycle Management rules?

Accepted Answer

Lifecycle rules are bucket-level policies that automatically act on objects meeting conditions — age, creation date, storage class, number of newer versions, or whether the object is live or noncurrent. The actions are Delete or SetStorageClass, so you can automatically tier data down to Nearline, Coldline and Archive and eventually delete it. Two facts that make an answer credible: rules are evaluated asynchronously roughly once a day, so an object may live slightly past its condition, and a SetStorageClass transition is one-way down the tier ladder — you cannot use a rule to move data back up to Standard.

Question 10

What is Object Lifecycle Management not able to do, and what do you use instead?

Accepted Answer

Lifecycle rules cannot enforce that data *must not* be deleted — they only delete or transition. To guarantee retention you use a bucket retention policy, which blocks deletion or modification of any object until it reaches a minimum age, and can be locked so that even a project owner cannot shorten it. The compliance detail interviewers look for: once a retention policy is *locked*, it is irreversible for the life of the bucket, and the only way to remove the data is to delete the bucket after every object has aged out. That irreversibility is exactly what makes it acceptable to auditors under WORM requirements.

Question 11

What is an object hold?

Accepted Answer

A hold is a flag on an individual object that prevents it from being deleted or replaced while the hold is in place, independent of any bucket retention policy. There are two kinds: an event-based hold, which also resets the object's retention clock when released, and a temporary hold, which does not. The scenario that makes it concrete is legal hold on litigation-relevant records: you cannot know in advance how long you need to keep them, so you set a hold rather than extending a retention period. The reset-the-clock behaviour of event-based holds is what makes them right for "retain for 7 years *after* account closure" style rules.

Question 12

How do you make a Cloud Storage bucket serve a public website?

Accepted Answer

Grant allUsers the roles/storage.objectViewer role on the bucket, set the main page and 404 suffixes with the website configuration, and put a global external HTTP(S) load balancer with a backend bucket in front so you can attach a custom domain, an SSL certificate and Cloud CDN. Direct storage.googleapis.com access works but gives you no custom domain over HTTPS. The load balancer requirement is what candidates miss. Bucket website hosting alone serves over HTTP on a Google domain; anything with your own domain and TLS needs the backend-bucket plus load-balancer pattern. Mentioning Cloud CDN in the same answer shows you have actually shipped this.

Question 13

A bucket was accidentally made public. How do you detect and prevent that?

Accepted Answer

Detect it with Security Command Center's Public Bucket ACL finding, or with a Cloud Asset Inventory feed that alerts on IAM policy changes containing allUsers or allAuthenticatedUsers. Prevent it with the organisation policy constraint storage.publicAccessPrevention, which blocks public grants across every bucket regardless of who tries. The distinction that matters is detection versus prevention. IAM alone cannot stop a project owner from making a bucket public; only the org policy constraint can. Answering with just "review IAM regularly" is a weak answer in a security-oriented loop.

Question 14

What is a composite object and when is it useful?

Accepted Answer

A composite object is created by composing up to 32 existing objects in the same bucket into one, server-side, without downloading them. It is the mechanism behind parallel composite uploads, where a large file is split, the parts are uploaded concurrently, and then composed into the final object — dramatically improving throughput on large transfers. The caveat to raise: composite objects carry a CRC32C checksum but not an MD5, which breaks tooling that expects an MD5, and some services will not accept a composed object. That is why parallel composite uploads are sometimes deliberately disabled for data destined for BigQuery loads or third-party consumers.

Question 15

How is Cloud Storage priced?

Accepted Answer

Four components: storage per GB per month at a rate set by storage class and location; network egress, which is free within the same region to GCP services but charged for cross-region and internet egress; Class A operations (writes, lists) and Class B operations (reads), priced per 10,000; and retrieval fees for Nearline, Coldline and Archive on top of the read operation. The bill surprise that interviewers like to probe is retrieval and early-deletion fees on cold classes — moving a rarely-read but frequently-listed dataset to Archive can cost more than leaving it in Standard. Always model operations, not just capacity.

Question 16

What is Autoclass?

Accepted Answer

Autoclass is a bucket setting that automatically moves each object between storage classes based on its own access pattern, promoting objects back to Standard when they are read and demoting them when they go cold. It removes the guesswork of lifecycle tuning and, importantly, waives early-deletion and retrieval fees for objects it manages. It is the right default when access patterns are unpredictable — a data lake, a user-content bucket. It charges a small per-object management fee, so it is less suitable for buckets with an enormous number of tiny objects where that fee dominates.

Question 17

What is the difference between Cloud Storage, Persistent Disk and Filestore?

Accepted Answer

Cloud Storage is object storage accessed over an API, effectively unlimited, ideal for unstructured data and shared access from anywhere. Persistent Disk is block storage attached to a VM, presented as a raw device you format — fast, but normally attached to one writer. Filestore is managed NFS file storage, giving a POSIX filesystem that many VMs or GKE pods can mount read-write simultaneously. The selection question behind this is usually "my application needs a shared filesystem" — the answer is Filestore, not Cloud Storage, because legacy applications expect POSIX semantics like partial writes and file locking that object storage does not provide. Cloud Storage FUSE exists but has performance and semantic caveats worth naming.

Question 18

What is Cloud Storage FUSE and what are its limitations?

Accepted Answer

Cloud Storage FUSE mounts a bucket as a filesystem so legacy applications can read and write objects with normal file calls. Its limitations are significant: no support for partial writes without rewriting the whole object, poor performance on small random I/O, weaker metadata consistency than a real filesystem, and no POSIX file locking. The correct framing is "a compatibility bridge, not a filesystem". It is fine for read-heavy workloads like serving model weights or training data into GKE, and wrong for anything that expects a database or a lock file to behave normally.

Question 19

How do you transfer 100 TB from on-premises into Cloud Storage?

Accepted Answer

Estimate transfer time over the available link first. If bandwidth allows, use Storage Transfer Service for on-premises data, which handles parallelism, retries, checksums and scheduling far better than a script. If the network would take months, use Transfer Appliance — a physical device Google ships to you, which you fill and return for ingest. The calculation is what makes this answer credible: 100 TB over a saturated 1 Gbps link is roughly 10 days at perfect efficiency, and real-world efficiency is much lower. Interviewers want to see you do the arithmetic before choosing a tool, and to hear that you would not run gsutil in a loop from a laptop.

Question 20

What is Storage Transfer Service?

Accepted Answer

A managed service that moves data into Cloud Storage from other clouds (S3, Azure Blob), from a URL list, from on-premises filesystems via an agent, or between GCS buckets. It handles scheduling, incremental sync, bandwidth throttling, integrity checks and retries, and can optionally delete source objects after transfer. It matters because hand-rolled transfer scripts fail silently on partial copies. The features to name are checksum verification and the ability to run recurring incremental jobs, which is what makes it suitable for an ongoing cross-cloud replication rather than a one-off copy.

Question 21

How does Cloud Storage encrypt data and what are the key options?

Accepted Answer

Every object is encrypted at rest by default with Google-managed keys, transparently and at no cost. You can instead use CMEK, where a Cloud KMS key you own and rotate is used to wrap the data encryption key, or CSEK, where you supply the raw AES-256 key with every request and Google stores only a hash of it. Data in transit is protected by TLS. The property that makes CMEK valuable is revocability: disable the KMS key and every object encrypted with it becomes unreadable immediately, which is a genuine kill switch. The same property is the operational risk, so key deletion should be protected by IAM and a long destroy-scheduled duration.

Question 22

What are Cloud Storage notifications and how do you trigger code on upload?

Accepted Answer

A bucket can publish notifications to a Pub/Sub topic on object finalise, delete, archive or metadata update. Subscribers — Cloud Run, Cloud Functions, Dataflow — then react to the message. Eventarc wraps this pattern and is now the recommended way to wire storage events to a Cloud Run service. The reliability point worth making: notifications are at-least-once, so your handler must be idempotent. Processing the same uploaded file twice because Pub/Sub redelivered is the classic bug in this pattern, and interviewers ask about it specifically.

Question 23

What is requester pays and why would you enable it?

Accepted Answer

With requester pays enabled, the party downloading the data is billed for the network egress and operation costs rather than the bucket owner, and they must supply their own billing project on every request. It is used for publicly shared datasets where the owner wants to publish data without funding everyone's downloads. The practical consequence to name: every client, including gcloud and client libraries, must pass a user project header, so enabling it on an existing bucket breaks consumers who have not been told. It is a publishing decision, not a cost-optimisation you apply quietly.

Question 24

How do you host large media files with low global latency from Cloud Storage?

Accepted Answer

Put a global external HTTP(S) load balancer with a backend bucket in front and enable Cloud CDN, so content is cached at Google's edge locations near the user. Set sensible Cache-Control headers on the objects, use a multi-region bucket for the origin, and use signed URLs or signed cookies if the content is not public. The detail that separates a real answer is Cache-Control: without it Cloud CDN will use conservative defaults and your hit rate will be poor. Signed cookies rather than signed URLs is the right call for streaming, because a video player fetches many segments and you do not want to sign each one.

Question 25

What is the difference between soft delete and versioning?

Accepted Answer

Object versioning retains an explicit noncurrent version whenever an object is overwritten or deleted, and you manage those versions with lifecycle rules. Soft delete is a newer bucket-level retention window that keeps deleted objects recoverable for a configured duration by default, protecting against accidental or malicious deletion without requiring you to design a versioning strategy. The reason both exist: versioning protects your data model, soft delete protects against operational accidents including a compromised credential running a mass delete. In a ransomware-resilience discussion, soft delete plus a locked retention policy is the pairing to name.

Question 26

What limits should you know about Cloud Storage?

Accepted Answer

Maximum object size is 5 TB. Bucket names are globally unique across all of Google Cloud, 3–63 characters, DNS-compliant and cannot be changed after creation. There is a rate limit on bucket metadata updates of roughly one per second, and while object read and write throughput auto-scales, ramping traffic very steeply on a new bucket benefits from a gradual increase. The global uniqueness of bucket names is the one that catches freshers — it means you cannot name a bucket "backups", and it also means bucket names leak information, so avoid embedding customer names. The metadata rate limit explains why a script that updates bucket configuration in a loop starts failing with 429s.

Question 27

Why should you avoid sequential object names at very high write rates?

Accepted Answer

Cloud Storage distributes load by key range. Strictly sequential prefixes — timestamps or auto-incrementing IDs at the start of the key — concentrate writes on a single range and limit how effectively the service can auto-scale. Adding a hash or a randomised prefix at the front of the key spreads writes evenly. This matters far less than it used to because auto-scaling has improved, so the honest answer notes that it is only a concern at very high sustained write rates — thousands of writes per second. Claiming it always matters is as wrong as never having heard of it.

Question 28

What IAM roles control Cloud Storage access?

Accepted Answer

The common predefined roles are Storage Object Viewer (read objects), Storage Object Creator (write new objects but not read or overwrite), Storage Object User (read and write objects), Storage Object Admin (full object control including delete), and Storage Admin (everything including bucket creation, deletion and IAM). Legacy roles map to the old ACL model and should be avoided. The nuance interviewers check is that Object Admin does not let you create or delete buckets, and Storage Admin does. The Object Creator role is under-used and valuable: it lets an upload-only client write without being able to read back other users' data.

Question 29

How would you give a Cloud Run service read access to one bucket only?

Accepted Answer

Give the Cloud Run service a dedicated service account with no project-level roles, then grant that service account roles/storage.objectViewer on the single bucket resource rather than on the project. The service then uses Application Default Credentials with no key file. The mistake this question is designed to catch is granting the role at project level, which silently gives access to every bucket in the project. Granting at the resource level is the practical expression of least privilege, and dedicating a service account per workload is what makes it auditable.

Question 30

What is dual-region with turbo replication?

Accepted Answer

Turbo replication is an option on dual-region buckets that guarantees 100% of newly written objects are replicated to the second region within 15 minutes, backed by an SLA. Standard dual-region replication is asynchronous with no such time guarantee, typically completing in minutes but without a commitment. It exists to give a hard recovery point objective for regulated workloads. The trade-off is a higher price, so the design question is whether the business truly needs a contractual 15-minute RPO or is satisfied with best-effort replication.

Question 31

How do you copy data between two buckets efficiently?

Accepted Answer

Use gcloud storage cp with the recursive flag, which parallelises automatically, or Storage Transfer Service for large or recurring jobs. Server-side copy is used when source and destination are in compatible locations, so bytes never leave Google's network and you avoid egress charges and local bandwidth entirely. The performance answer people miss is that gcloud storage is significantly faster than the older gsutil -m for large transfers because of a rewritten parallelism model. For anything above a few TB, or where you need retries and reporting, Storage Transfer Service is the professional answer.

Question 32

What is object metadata and which fields matter in practice?

Accepted Answer

Each object carries fixed metadata such as size, generation, storage class, content type and checksums, plus arbitrary custom metadata key-value pairs. In practice the ones that matter are Content-Type, which determines how a browser renders it; Content-Encoding, for gzip-compressed objects; Cache-Control, which drives CDN and browser caching; and Content-Disposition, which forces a download rather than inline display. The very common bug this maps to is a file uploaded without a content type, defaulting to application/octet-stream, so images download instead of rendering. Being able to name that failure immediately is a strong practical signal.

Question 33

How does Cloud Storage handle very large uploads reliably?

Accepted Answer

Through resumable uploads: the client initiates a session, receives a session URI, and uploads in chunks. If the connection drops, the client queries the session for the last committed byte and continues from there rather than restarting. Client libraries and gcloud switch to resumable uploads automatically above a size threshold. The operational details worth knowing: a resumable session URI is valid for about a week, and the session itself is what you must persist if the uploading process might restart. Contrast with a simple single-request upload, which is fine for small objects and wasteful for large ones.

Question 34

What is a bucket lock and how does it relate to compliance?

Accepted Answer

Bucket lock permanently locks a retention policy on a bucket so that the retention period can be increased but never decreased or removed, and no object can be deleted before it ages out. This provides WORM (write once, read many) semantics required by regulations such as SEC 17a-4, FINRA and CFTC record-keeping rules. The irreversibility is the whole point and also the whole risk: a mistakenly locked 10-year retention on a large bucket means 10 years of storage cost with no way out except deleting the bucket, which you cannot do until the objects age out. Interviewers want to hear that you would test in a non-production project first.

Question 35

Your data-lake bill has doubled but stored volume is flat. What do you investigate?

Accepted Answer

Look at operations and egress, not storage. Common causes: a job listing millions of objects repeatedly (Class A operations), a consumer in another region reading a regional bucket (cross-region egress), a lifecycle rule that moved data to Archive where a downstream job now pays retrieval fees on every read, or versioning enabled without a cleanup rule so noncurrent versions accumulate invisibly in the storage line. The method matters more than the guess: export billing to BigQuery and break the cost down by SKU, then by bucket label. Naming the specific SKU families — storage, Class A ops, Class B ops, egress, retrieval — is what makes this a senior answer.

Question 36

What is the difference between allUsers and allAuthenticatedUsers?

Accepted Answer

allUsers means anyone on the internet, with or without a Google account — a truly public grant. allAuthenticatedUsers means anyone signed in to any Google account, including accounts with no relationship to your organisation. Both are effectively public and neither should be used for private data. The point candidates miss is that allAuthenticatedUsers is not "our employees" — it is roughly two billion Gmail users. Treating it as an internal-only grant is a real and recurring cause of data exposure.

Question 37

How do you serve private user content from Cloud Storage in a web application?

Accepted Answer

Keep the bucket private and have your backend issue short-lived signed URLs after checking the user's authorisation, or use signed cookies with a CDN for content sets like video segments. For internal corporate applications, Identity-Aware Proxy in front of a load balancer with a backend bucket lets you authorise by Google identity with no signing at all. The anti-pattern to name explicitly is streaming bytes through your application server. It works, but it makes your compute tier the bandwidth bottleneck and multiplies cost. The whole point of signed URLs is to keep the data path direct while keeping the authorisation decision in your code.

Question 38

What is the Cloud Storage JSON API versus the XML API?

Accepted Answer

The JSON API is the primary, fully-featured interface used by gcloud and the modern client libraries, supporting all current features. The XML API is an S3-compatible interface retained mainly for interoperability, so tools written against Amazon S3 can point at Cloud Storage with minimal change. The migration angle is where this comes up: the XML API plus HMAC keys is how you get an S3-targeted application talking to GCS without rewriting it. It is a bridge, and new development should use the JSON API and native libraries.

Question 39

What are HMAC keys in Cloud Storage?

Accepted Answer

HMAC keys are an access-key/secret pair associated with a service account or user, used to authenticate to the S3-compatible XML API. They let S3-native tooling authenticate against Cloud Storage using the signature scheme it already implements. The security caution to volunteer: HMAC keys are long-lived static credentials, the same class of risk as exported service-account JSON keys. They should be scoped to a dedicated service account with minimal permissions, rotated, and used only where a tool genuinely cannot speak native GCP auth.

Question 40

Design the storage layer for an application that ingests 5 TB of IoT data per day, queried for 30 days then kept for 7 years.

Accepted Answer

Land raw files in a regional Standard bucket co-located with the processing compute, partitioned by date in the object key. Process into BigQuery for the 30-day query window. Apply a lifecycle rule moving raw objects to Nearline at 30 days, Coldline at 90 and Archive at 365, deleting at 7 years. Enable versioning only if overwrites are possible, with a matching cleanup rule, and apply a locked retention policy if the 7-year period is a regulatory obligation. This is the standard closing scenario and it tests whether you separate the *query* tier from the *retention* tier. Keeping 7 years of data in BigQuery active storage instead of tiering it to Archive is the expensive mistake the question is designed to expose — and BigQuery long-term storage pricing is worth naming as the alternative.

GCP Cloud Storage Interview Questions and Answers

How to use this set