Question 1

What is Google Cloud Platform (GCP)?

Accepted Answer

Google Cloud Platform is Google's public cloud offering — a suite of on-demand compute, storage, networking, database, big-data, machine-learning and management services delivered over the internet and billed on consumption. It runs on the same global fibre network and data-centre infrastructure that powers Search, Gmail and YouTube. Interviewers listen for two things: that you mention pay-as-you-go/consumption billing, and that you know GCP is one of the "big three" alongside AWS and Microsoft Azure. Adding that Google Cloud also includes Google Workspace and the Google Maps Platform under the wider "Google Cloud" brand shows you know the product boundaries.

Question 2

What is the difference between a region and a zone in GCP?

Accepted Answer

A region is an independent geographic area (for example asia-south1 in Mumbai) that contains three or more zones. A zone is a deployment area within a region — effectively an isolated failure domain, usually one or a small group of data centres. Resources are either zonal, regional or multi-regional depending on how widely they are replicated. The follow-up is always "so how do you build for high availability?" — the answer is to spread instances across multiple zones in a region for zone-fault tolerance, and across multiple regions for region-fault tolerance and lower latency to users. Note that a zone name like asia-south1-a is not guaranteed to map to the same physical hardware across two different projects: Google shuffles the letter-to-cluster mapping per project to spread load.

Question 3

Explain the GCP resource hierarchy.

Accepted Answer

From the top down it is Organisation → Folders → Projects → Resources. The organisation node is the root and maps to your Cloud Identity or Workspace domain; folders group projects by department, team or environment; the project is the fundamental unit that owns resources, billing and APIs; and the resources themselves (VMs, buckets, datasets) sit inside a project. The reason the hierarchy matters is IAM inheritance: a policy applied at the organisation or folder level is inherited by everything beneath it, and inherited permissions are additive — a child can never take away a permission granted higher up. That single fact is the most commonly asked follow-up in the whole IAM area.

Question 4

What is a GCP project and why is everything tied to one?

Accepted Answer

A project is the container for all your resources and the boundary for billing, quotas, APIs and IAM. Every resource you create belongs to exactly one project, and every API call is billed and rate-limited against a project. Each project has three identifiers: a globally unique project ID, a mutable display name and a Google-assigned project number. The gotcha worth mentioning: the project ID is permanent and cannot be changed or reused once the project is deleted, while the name can be edited freely. Interviewers also like to hear that using separate projects per environment (dev/staging/prod) is the standard isolation pattern, because a project is the cleanest blast radius boundary GCP offers.

Question 5

How does GCP differ from AWS and Azure?

Accepted Answer

Functionally the three overlap heavily, but GCP differentiates on its private global fibre network, live-migration of VMs during host maintenance, per-second billing with automatic sustained-use discounts, a genuinely global VPC, and strength in data and ML products such as BigQuery and Vertex AI. AWS has the widest service catalogue and largest market share; Azure wins where an organisation is already invested in Microsoft licensing and Active Directory. Do not turn this into a sales pitch. A strong answer names one or two concrete technical differences — the global VPC versus AWS's regional VPC, or live migration versus AWS's instance-retirement notices — rather than vague claims about "better performance".

Question 6

What are IaaS, PaaS and SaaS, and give a GCP example of each?

Accepted Answer

IaaS gives you raw infrastructure and you manage the OS upwards — Compute Engine. PaaS gives you a managed runtime and you only supply code and configuration — App Engine or Cloud Run. SaaS is finished software consumed over the internet with nothing to manage — Google Workspace. The higher up the stack you go, the less you operate and the less control you retain. A neat way to close is the "shared responsibility" framing: in IaaS you patch the guest OS, in PaaS Google patches it, in SaaS there is no OS to think about. Mentioning that GKE sits between IaaS and PaaS (often called CaaS, containers-as-a-service) shows nuance.

Question 7

What is the difference between zonal, regional and multi-regional resources?

Accepted Answer

A zonal resource lives in a single zone and is lost if that zone fails — a Compute Engine VM or a standard persistent disk. A regional resource is replicated across zones inside one region — a regional managed instance group or a regional persistent disk. A multi-regional resource is replicated across regions — a multi-region Cloud Storage bucket or a multi-region BigQuery dataset. The practical follow-up: cost and latency rise as you widen replication, so you pick the narrowest scope that meets your recovery objective. Interviewers often probe whether you know that a global resource type also exists — VPC networks, global HTTP(S) load balancers and images are global.

Question 8

What is Cloud Shell and when would you use it?

Accepted Answer

Cloud Shell is a free, browser-based Debian VM pre-loaded with the gcloud CLI, kubectl, Terraform, Docker, Python, Go and an editor, with 5 GB of persistent storage mounted at your home directory. It is authenticated as your logged-in identity automatically, so it is the fastest way to run administrative commands without installing anything locally. Two caveats worth naming: only the home directory persists — anything installed outside it is wiped when the session VM is recycled after about 20 minutes of inactivity — and there is a weekly usage quota. It is for administration and prototyping, never for running production workloads.

Question 9

What is the gcloud CLI and how does it relate to gsutil and bq?

Accepted Answer

gcloud is the primary command-line tool for managing GCP resources and identities. gsutil was the dedicated tool for Cloud Storage and bq is the dedicated tool for BigQuery. Cloud Storage operations have since been folded into gcloud as gcloud storage, which is faster than gsutil for large transfers and is now the recommended path. Naming gcloud storage rather than only gsutil is a small but real signal that you have used GCP recently. Also worth mentioning: gcloud config configurations let you keep several named profiles (project + account + region) and switch between them, which matters when you work across client environments.

Question 10

What is a service account and how does it differ from a user account?

Accepted Answer

A service account is a special identity used by an application, VM or workload rather than a person. It is identified by an email address, it is both an identity (it can be granted IAM roles) and a resource (IAM roles can be granted on it), and it authenticates with keys or, preferably, with automatically-rotated tokens from the metadata server. A user account belongs to a human and authenticates interactively. The strongest possible follow-up answer: avoid downloading service-account JSON keys at all. Attach the service account to the resource (VM, GKE workload via Workload Identity, Cloud Run service) so credentials are short-lived and never stored on disk. Long-lived exported keys are the single most common cause of GCP credential leaks.

Question 11

What are Google Cloud APIs and why must you enable them per project?

Accepted Answer

Every GCP service is fronted by an API that must be explicitly enabled on a project before it can be used. Enabling is per project because quotas, billing and audit logging are all tracked at the project level, and it keeps the attack surface minimal — an API that is not enabled cannot be called at all. A very common real-world error is "API [compute.googleapis.com] not enabled on project", which candidates should recognise instantly. In Terraform this is why you normally declare google_project_service resources and make everything else depend on them.

Question 12

What is the Google Cloud metadata server?

Accepted Answer

It is an internal HTTP endpoint reachable from every Compute Engine VM at 169.254.169.254 (or metadata.google.internal) that exposes instance metadata — project ID, instance name, zone, custom attributes, startup scripts — and, crucially, short-lived OAuth access tokens for the attached service account. Requests must include the header Metadata-Flavor: Google. It is how client libraries get credentials without any key file, and it is also why SSRF vulnerabilities are so dangerous on cloud VMs: an attacker who can make your app fetch an arbitrary URL can read the token. GKE mitigates this with Workload Identity, which blocks direct node-metadata access from pods.

Question 13

What is Application Default Credentials (ADC)?

Accepted Answer

ADC is the credential-discovery strategy every Google client library follows. It checks, in order: the GOOGLE_APPLICATION_CREDENTIALS environment variable, then the credentials written by gcloud auth application-default login, then the attached service account via the metadata server. This lets the same code run unchanged on a laptop and in production. The classic interview trap is the difference between gcloud auth login and gcloud auth application-default login. The first authenticates the CLI; the second writes credentials that your application code will pick up. Candidates who have only ever used one of them usually cannot explain why their local script fails while gcloud works.

Question 14

How is billing structured in GCP?

Accepted Answer

A Cloud Billing account is a payment profile that sits outside the resource hierarchy and is linked to one or more projects. Costs accrue per project but are paid by the linked billing account. Billing accounts have their own IAM roles, support budgets and alerts, and can export detailed usage to BigQuery for analysis. Two facts that separate a prepared candidate: a project without an active billing account will have most services disabled, and budget alerts do not cap spend — they only notify. To actually stop spend you need a Cloud Function triggered by the budget Pub/Sub message that disables billing on the project.

Question 15

What are labels and how do they differ from network tags?

Accepted Answer

Labels are key-value pairs attached to almost any GCP resource, used for cost attribution, filtering and inventory — they appear in billing exports. Network tags are simple strings applied only to Compute Engine instances and are used as the target of VPC firewall rules. Labels describe; network tags control traffic. Mixing these two up is one of the most common mistakes in a GCP interview. A firewall rule can target a network tag but not a label, and billing reports can group by label but not by network tag.

Question 16

What is Cloud Identity and how does it relate to Google Workspace?

Accepted Answer

Cloud Identity is Google's identity-as-a-service product that manages users, groups and devices for a domain without the Workspace productivity apps. Google Workspace includes the same identity layer plus Gmail, Drive and Docs. Either one provides the organisation node that sits at the top of the GCP resource hierarchy. This matters because without Cloud Identity or Workspace you have no organisation node, which means no folders, no org-level IAM policies and no org policy constraints — you are limited to standalone projects owned by individual Gmail accounts, which is not viable for an enterprise.

Question 17

What is the Organisation Policy Service and how does it differ from IAM?

Accepted Answer

IAM answers "who can do what" — it grants permissions to identities. The Organisation Policy Service answers "what is allowed to exist at all" — it applies constraints to resources regardless of who is asking. For example, a constraint can forbid external IP addresses on VMs, restrict which regions are usable, or block service-account key creation even for project owners. The framing to use is "IAM is about identities, org policy is about configuration guardrails, and org policy wins". A project owner has full IAM permission to create an external IP but still cannot do it if an org policy forbids it — that asymmetry is exactly what interviewers are testing.

Question 18

What is the shared responsibility model in Google Cloud?

Accepted Answer

Google is responsible for the security *of* the cloud — hardware, physical data centres, the hypervisor, the network fabric and the managed service internals. The customer is responsible for security *in* the cloud — IAM policies, firewall rules, data classification, application code, and guest OS patching where an OS is exposed. The dividing line moves up the stack as the service becomes more managed. Google also uses the term "shared fate", which goes further than the AWS-style shared responsibility model: Google provides opinionated secure defaults, blueprints and Assured Workloads rather than simply drawing a line and leaving the rest to you. Mentioning that phrase reads as genuine GCP experience.

Question 19

What are quotas in GCP and how do they differ from limits?

Accepted Answer

A quota is a ceiling on consumption that is tracked per project (and often per region) and can be raised on request — for example the number of CPUs in a region, or API requests per minute. A hard limit is a fixed system boundary that cannot be raised, such as the maximum number of VPC networks per project in some cases. Quotas exist to prevent runaway cost and to protect shared capacity. The operational point interviewers want: quota errors surface as 403 RESOURCE_EXHAUSTED or "Quota exceeded" during deployment, not at design time. Any serious production plan checks regional CPU, IP address and API-rate quotas before a launch, and quota increases can take days to approve.

Question 20

What is the difference between Cloud Console, gcloud, the client libraries and the REST API?

Accepted Answer

They are four interfaces to the same control plane. The Cloud Console is the web UI, gcloud is the CLI, the client libraries are idiomatic SDKs for Java, Python, Go, Node and others, and the REST/gRPC API is the underlying contract all three call. Anything you can do in the console you can do through the API. A good addition: the console is fine for exploration but production changes should go through Infrastructure as Code (Terraform or Config Connector) so state is reviewable and reproducible. Interviewers frequently follow up with "why is ClickOps a problem?" — drift, no audit trail of intent, and no rollback.

Question 21

What is Cloud Asset Inventory?

Accepted Answer

It is a service that keeps a searchable, time-travelling inventory of every asset and IAM policy across your organisation. You can query the current state, export a full snapshot to BigQuery or Cloud Storage, look at any point in the past 35 days, and subscribe to a Pub/Sub feed that fires when assets change. It is the answer to governance questions such as "how would you find every VM in the organisation with an external IP?" or "how do you detect that someone granted a public role on a bucket?" — export to BigQuery and query it, or use a real-time feed for detection.

Question 22

What is a VPC Service Control perimeter, in one sentence?

Accepted Answer

It is a virtual boundary around a set of projects and Google-managed services that prevents data from being read out of, or written into, the perimeter even by identities that hold valid IAM permissions — mitigating data exfiltration through stolen credentials or misconfigured IAM. The key insight is that it is a *data* boundary layered on top of IAM, not a replacement for it. A user with Storage Admin who is outside the perimeter still cannot copy a bucket's contents out. Expect follow-ups on access levels and ingress/egress rules if you are interviewing for a security or architect role.

Question 23

How would you choose between Compute Engine, GKE, Cloud Run and Cloud Functions?

Accepted Answer

Compute Engine when you need full OS control, legacy software or specialised hardware. GKE when you have many services, need fine-grained orchestration, or already run Kubernetes. Cloud Run when you have a stateless containerised HTTP or event-driven service and want scale-to-zero with no cluster to operate. Cloud Functions when the unit of work is a single small event handler. The framing that scores well is "least operational surface that satisfies the constraints" — start at the most managed option and step down only when a real requirement forces it. Naming the constraint that forces the step is what makes it a senior answer: GPU pinning, a sidecar-heavy service mesh, long-running background threads, or a protocol Cloud Run does not support.

Question 24

What is the difference between a managed and an unmanaged service?

Accepted Answer

With a managed (or serverless) service Google runs the infrastructure, patching, scaling and availability — BigQuery, Cloud Run, Cloud SQL to a large extent. With an unmanaged service you provision and operate the machines yourself — a database installed on Compute Engine. Managed services cost more per unit but remove operational headcount and reduce the chance of an outage caused by human error. The mature answer acknowledges the trade-off honestly: managed services impose version and feature constraints and can be harder to debug because you cannot see inside them. The right choice depends on whether your team's scarcest resource is money or engineering time.

Question 25

What does "eventual consistency" mean and where do you meet it in GCP?

Accepted Answer

Eventual consistency means a write is not immediately visible to every reader, but all replicas converge given enough time without new writes. In GCP you meet it in IAM policy propagation (changes can take up to seven minutes to be fully effective), in Cloud Storage bucket and object listing operations, and in some Datastore-mode Firestore queries. The practical consequence interviewers probe: a deployment script that grants a role and immediately uses it can fail intermittently. The fix is to retry with backoff rather than to add a fixed sleep. Note that Cloud Storage object reads themselves are strongly consistent — it is listings and metadata that lag.

Question 26

What is Google's global network and why does it matter to an application?

Accepted Answer

Google operates one of the largest private backbones in the world, with subsea cables and over 180 network edge locations. Traffic entering at a Google edge point of presence — via a global load balancer or Cloud CDN — travels the private backbone to the region hosting your workload rather than the public internet, which materially reduces latency, jitter and packet loss. This is the technical basis for the Premium versus Standard network service tier question. Premium tier uses the Google backbone end to end; Standard tier hands traffic to the public internet at the region, which is cheaper but slower and less predictable, and does not support global load balancing.

Question 27

What are Network Service Tiers?

Accepted Answer

Premium Tier routes traffic over Google's private global backbone, entering and leaving at the edge location closest to the user, and is required for global load balancing and global anycast IPs. Standard Tier routes over the public internet and keeps traffic regional, costing noticeably less but offering lower and less consistent performance with only regional load balancing. A good closing line: use Standard Tier for internal tooling, batch egress and cost-sensitive regional workloads, and Premium Tier for anything user-facing and global. The tier is chosen per resource, so you can mix them in one project.

Question 28

What is Cloud IAM Recommender?

Accepted Answer

It is part of the Active Assist family and it analyses 90 days of actual permission usage to suggest tightening over-privileged role bindings — for example replacing a broad Editor grant with a narrow custom or predefined role that covers only what the principal actually used. It is the practical route to least privilege in an existing environment. The nuance that makes this a strong answer: recommendations are based on observed usage, so a job that runs quarterly may not appear in the window and blindly applying every recommendation can break things. You apply them with a review step, not automatically.

Question 29

What is the difference between "delete" and "shut down" for a GCP project?

Accepted Answer

Shutting down a project schedules it for deletion. It immediately stops all resources and API access but enters a 30-day recovery window during which an owner can restore it. After 30 days the project and everything in it are permanently and irrecoverably deleted, and the project ID can never be reused. The 30-day window and the permanent loss of the project ID are the two facts interviewers check. It is also worth noting that liens can be placed on a project to prevent accidental deletion — a common guardrail on production projects.

Question 30

What is Google Cloud Marketplace?

Accepted Answer

It is a catalogue of pre-configured third-party and open-source solutions — VM images, Kubernetes applications, SaaS products and datasets — that deploy into your project in a few clicks, with licensing charges consolidated onto your Cloud Billing account. It also lets you draw down a negotiated committed-spend contract on qualifying third-party software. The operational caveat worth raising: Marketplace deployments create real resources you own and are billed for, and they are not automatically patched. Treat a Marketplace VM as your responsibility from the moment it launches.

Question 31

What is the difference between horizontal and vertical scaling, and which does GCP favour?

Accepted Answer

Vertical scaling means making a single machine bigger (more vCPU or memory); horizontal scaling means adding more machines behind a load balancer. GCP's managed instance groups, GKE and all its serverless products are built around horizontal scaling, because it gives elasticity and fault tolerance that a single larger machine cannot. Add the constraint: vertical scaling on Compute Engine requires a restart and is bounded by the largest machine type in the family, while horizontal scaling requires the workload to be stateless or to externalise its state. Naming that requirement is what distinguishes a real answer from a textbook one.

Question 32

What is an "organisation node" and what happens if you do not have one?

Accepted Answer

The organisation node is the root of the resource hierarchy, created automatically when you sign up for Cloud Identity or Google Workspace. Without it, projects are standalone and owned by individual accounts, so you lose folders, organisation-level IAM policies, org policy constraints, centralised audit logging and the ability to reclaim projects when an employee leaves. That last point is the one that lands: if a departing engineer created projects under a personal account with no organisation, those projects leave with them. This is the standard justification for setting up Cloud Identity before any serious GCP adoption.

Question 33

What is Cloud Deployment Manager and is it still recommended?

Accepted Answer

Deployment Manager is Google's native Infrastructure as Code service using YAML, Jinja2 and Python templates. It still exists but Google now steers new work towards Terraform (with the Google provider and Infrastructure Manager) or Config Connector for Kubernetes-native management, because those have far wider ecosystem support and multi-cloud reach. Saying "Deployment Manager works but Terraform is the practical default on GCP today" is both accurate and the answer most interviewers are looking for. Be ready for a follow-up on how you manage Terraform state — a GCS backend with object versioning and state locking.

Question 34

How does GCP handle host maintenance without downtime?

Accepted Answer

Compute Engine uses live migration: when a host needs patching or hardware repair, the running VM is transparently moved to another host in the same zone with only a brief performance blip and no reboot or IP change. The alternative on-host-maintenance policy is TERMINATE, which is required for VMs with attached GPUs or for preemptible/Spot instances. This is a genuine GCP differentiator worth naming explicitly, because AWS handles the equivalent case by scheduling an instance retirement that you must act on. The exception for GPU-attached VMs is the detail interviewers use to check whether you have actually run GPU workloads.

Question 35

What is a Google Cloud "folder" used for in practice?

Accepted Answer

Folders group projects so that IAM policies and organisation policy constraints can be applied to a whole slice of the estate at once. Typical patterns are one folder per department, per environment, or per subsidiary — often nested, for example Organisation → Engineering → Production → individual service projects. The design rule to state: model folders on your *governance* boundaries, not your org chart, because reorganisations happen more often than security-model changes. Folders can nest up to a documented depth, and a project can only ever have one parent.

Question 36

What is the Google Cloud Free Tier and what does it include?

Accepted Answer

It has two parts. The 90-day trial grants a credit (US$300 or the local equivalent) for new customers. The Always Free tier gives perpetual monthly allowances on around 20 products — for example one e2-micro VM in select US regions, 5 GB of regional Cloud Storage, 2 million Cloud Functions invocations and 1 TB of BigQuery query processing per month. The detail worth flagging: Always Free allowances are region-restricted for several products, so an e2-micro in asia-south1 is *not* free. Candidates who have actually used the free tier usually know this because they were surprised by a bill.

Question 37

How would you explain "serverless" to a non-technical stakeholder?

Accepted Answer

Servers still exist, but you never see, size, patch or pay for idle ones. You hand over code or a container, the platform runs it only when there is work to do, scales it automatically from zero to thousands of copies, and bills you for the time it actually ran. The trade-off is less control over the environment and cold-start latency on the first request. Interviewers value candidates who can pitch a concept without jargon *and* still name the trade-off. Skipping the cold-start caveat is the usual reason this answer reads as marketing rather than engineering.

Question 38

What are Google Cloud audit logs and which types exist?

Accepted Answer

Cloud Audit Logs record who did what, where and when. There are four types: Admin Activity (configuration changes, always on and free), Data Access (reads and writes of user data, off by default except BigQuery, and high-volume), System Event (Google-initiated actions such as live migration) and Policy Denied (requests blocked by security policy). The two facts interviewers test: Admin Activity logs cannot be disabled and are retained 400 days by default, while Data Access logs must be explicitly enabled and can generate enormous volume and cost. For compliance you normally sink audit logs to a separate, locked-down project.

Question 39

What is the difference between Cloud Monitoring and Cloud Logging?

Accepted Answer

Cloud Monitoring collects numeric time-series metrics — CPU, latency, request count, custom metrics — and drives dashboards, SLOs and alerting policies. Cloud Logging collects textual and structured log entries, supports queries, log-based metrics and sinks to BigQuery, Cloud Storage or Pub/Sub. They are separate products under the Cloud Operations suite and are commonly used together. The bridge between them is the log-based metric: you extract a counter or distribution from log text and then alert on it in Monitoring. Being able to describe that pattern is often the difference between a junior and a mid-level answer here.

Question 40

You are asked to design a GCP landing zone for a new enterprise. What are the first decisions you make?

Accepted Answer

Establish Cloud Identity and the organisation node; design the folder structure around governance boundaries; decide the project-per-environment and per-workload strategy; set up centralised billing with budgets and BigQuery export; choose a networking model (Shared VPC hub with service projects is the common default); define the IAM model on groups rather than individuals; and enable organisation policy constraints, centralised audit-log sinks and Terraform-based provisioning from day one. This is the classic senior opener and it is testing sequence, not encyclopaedic recall. The signal is that identity, hierarchy and networking come *before* any workload, because retrofitting a Shared VPC or an org policy onto a live estate is painful. Naming Google's Cloud Foundation Toolkit or the Fabric FAST blueprints as a starting point is a strong close.

GCP Fundamentals & Core Concepts Interview Questions and Answers

How to use this set