Question 1

What are the common cloud migration strategies?

Accepted Answer

The "6 Rs": rehost (lift and shift with no change), replatform (lift and optimise — for example moving a database to Cloud SQL), refactor or re-architect (redesign for cloud-native), repurchase (move to a SaaS product), retire (decommission what nobody uses), and retain (leave it where it is for now). The valuable part is knowing that retire and retain are real answers, not failures. In most portfolio assessments a meaningful share of applications turn out to be unused or not worth moving, and identifying those early is the cheapest win in the whole programme.

Question 2

How do you decide which strategy applies to a given application?

Accepted Answer

Assess business value, technical fit and change appetite. Rehost when the deadline is a data-centre exit and the application works as is. Replatform when a managed service removes real operational burden with limited change. Refactor when the application is strategically important and its current architecture blocks the business. Repurchase for commodity functions. Retire for anything unused. The driver to name explicitly is the deadline: a hard data-centre exit date forces rehost first and modernisation later, whereas an open timeline allows selective refactoring. Attempting to refactor everything during a time-boxed exit is the classic way these programmes fail.

Question 3

What are the phases of a cloud migration programme?

Accepted Answer

Assess — inventory applications, dependencies, utilisation and cost, and build a business case. Plan — landing zone design, identity, networking, security, wave planning. Migrate — move in waves, starting with low-risk applications to build capability. Optimise — right-size, apply commitments, modernise, and shut down the source. The step teams skip is decommissioning the source, which means paying for both environments indefinitely and losing most of the business case. Making decommissioning an explicit, tracked deliverable per wave is what a seasoned migration lead insists on.

Question 4

How do you build a dependency map before migrating?

Accepted Answer

Combine agent-based or agentless discovery tooling with network flow data, configuration management databases and interviews with application owners. The output is a set of move groups — applications that must move together because they communicate chattily or share data — which then become migration waves. The reason move groups matter is latency: splitting two chatty components across the data centre and the cloud usually breaks performance badly. Discovering that dependency after cutover, rather than before, is the most common cause of a migration rollback.

Question 5

What is Migration Center?

Accepted Answer

Migration Center is Google's assessment and planning hub: it discovers on-premises and other-cloud assets, collects utilisation data, groups applications, produces total-cost-of-ownership comparisons and right-sized GCP equivalents, and tracks migration progress. The value in an interview context is that it produces a defensible business case from measured utilisation rather than from nameplate specifications. On-premises servers are typically provisioned for peak and run at low utilisation, so right-sizing from real data is where much of the saving comes from.

Question 6

How do you migrate virtual machines to Compute Engine?

Accepted Answer

Migrate to Virtual Machines replicates the source VM's disks continuously while it keeps running on-premises or in another cloud, then performs a short cutover to a Compute Engine instance. For simpler cases you can import a virtual disk image directly, or rebuild the VM from a Packer-built image if you prefer immutable infrastructure. The continuous-replication model is what keeps the cutover window to minutes rather than the hours a full copy would take. The practice to name is a test clone into an isolated VPC first, so you validate the migrated VM before touching production.

Question 7

How do you migrate a database to GCP with minimal downtime?

Accepted Answer

Use Database Migration Service in continuous mode: an initial load followed by ongoing change replication from the source, so cutover is just stopping writes, letting replication drain, and repointing the application. Validate schema, extensions and users beforehand and rehearse the cutover to measure the real drain time. The blockers to check early are unsupported extensions, superuser dependencies and stored procedures, because discovering them at cutover is fatal to the schedule. Rehearsing rather than assuming the drain time is the discipline that makes the window credible.

Question 8

How do you move very large volumes of data into GCP?

Accepted Answer

Calculate transfer time over the available bandwidth first. Within a feasible window, use Storage Transfer Service, which handles parallelism, checksums, retries and scheduling. Beyond that, use Transfer Appliance — a physical device shipped to you, filled and returned. For ongoing sync, Storage Transfer Service runs incremental jobs. Doing the arithmetic is what makes this answer credible: 500 TB over a saturated 1 Gbps link is roughly 50 days at perfect efficiency. Interviewers want to see you compute before choosing, and to reject "we will just copy it" as a plan.

Question 9

What is a landing zone and why build it before migrating?

Accepted Answer

A landing zone is the pre-built foundation — organisation hierarchy, folders, identity federation, IAM model, shared VPC and IP plan, organisation policies, logging and monitoring, billing structure and Terraform pipelines — that workloads land into. Building it first means every migrated workload inherits governance rather than being retrofitted. The decisions that are painful to change later are the ones to emphasise: the IP plan, the folder structure and the identity model. Migrating workloads into an ungoverned estate and fixing it afterwards is far more expensive than the delay of building the foundation first.

Question 10

What is Anthos and what problem does it solve?

Accepted Answer

Anthos — now largely delivered as GKE Enterprise — is Google's platform for running and managing Kubernetes consistently across GCP, on-premises and other clouds, with a common control plane: Config Management for GitOps policy and configuration, Service Mesh for traffic and security, and fleet management for multi-cluster operations. The problem it addresses is operational consistency, not portability in the abstract: an organisation with clusters in three environments otherwise ends up with three sets of policies, three deployment mechanisms and three security models. Whether that consistency is worth the licence cost is the honest question to raise.

Question 11

When is hybrid cloud a genuine requirement rather than a transitional state?

Accepted Answer

When regulation or data sovereignty requires certain data to stay on premises; when latency to factory floor, trading or medical equipment demands local compute; when there is significant unamortised hardware investment; or when a legacy system genuinely cannot move. Otherwise hybrid is usually a phase of a migration rather than a destination. The honest framing matters because hybrid is operationally expensive — two networks, two identity integrations, two operational models. Being able to distinguish a real constraint from an unfinished migration is what a senior architect is expected to do.

Question 12

How do you connect an on-premises data centre to GCP?

Accepted Answer

HA VPN over the internet with two interfaces and two tunnels for the 99.99% SLA — quick and cheap but bounded by internet quality. Dedicated Interconnect for a direct physical link at 10 or 100 Gbps into a Google colocation facility. Partner Interconnect through a service provider for smaller bandwidth increments. Cloud Router exchanges routes over BGP in all cases. The SLA detail is the one interviewers check: a single-interface HA VPN configuration only carries 99.9%, and the 99.99% figure requires two interfaces with tunnels to two peer devices. Getting that wrong in a design review is a visible error.

Question 13

How do you extend on-premises identity into GCP?

Accepted Answer

Federate Cloud Identity with the existing identity provider — Active Directory via Google Cloud Directory Sync and SAML, or Okta, Azure AD or another IdP — so users authenticate against the corporate directory and groups synchronise. IAM roles are then granted to those synchronised groups. Granting roles to synchronised groups rather than individuals is what makes joiner-mover-leaver processes work: access follows directory membership automatically. Without it, offboarding requires hunting for individual bindings across every project.

Question 14

What is a migration wave and how do you sequence them?

Accepted Answer

A wave is a batch of applications migrated together, defined by move groups so interdependent systems move at once. Sequence by risk and learning: start with low-risk, low-dependency applications to build team capability and prove the landing zone, then move progressively more critical systems, keeping the most complex for when the team is experienced. The counter-intuitive point worth making is not to start with the easiest *and* least valuable application, because a pilot with no business visibility fails to build momentum or funding. A low-risk but visible application is the better first wave.

Question 15

How do you plan a cutover and a rollback?

Accepted Answer

Define the exact sequence and timings, the freeze window, validation checks with pass criteria, the communication plan, and a rollback trigger and procedure with its own time limit. Rehearse the whole thing in a non-production run, and agree in advance who makes the go or no-go decision. The rollback time limit is the element most plans omit: without a defined point of no return, teams keep trying to fix forward past the window and end up with an extended outage. Naming that decision point explicitly is what an experienced migration lead does.

Question 16

How would you migrate from AWS to GCP?

Accepted Answer

Map services rather than translating literally — EC2 to Compute Engine, S3 to Cloud Storage, RDS to Cloud SQL, EKS to GKE, Lambda to Cloud Functions or Cloud Run, DynamoDB to Firestore or Bigtable, Redshift to BigQuery. Move data with Storage Transfer Service, which reads S3 directly. Rebuild IAM in GCP's model rather than porting policies, and plan for the networking differences, particularly GCP's global VPC. The IAM point is the one candidates underestimate: AWS policies are resource-attached JSON documents while GCP uses hierarchical role bindings, so a mechanical translation produces either over-permissive or broken access. Redesigning identity is a workstream, not a conversion script.

Question 17

What is Cross-Cloud Interconnect?

Accepted Answer

A dedicated physical connection between GCP and another cloud provider, giving high-bandwidth, low-latency private connectivity without traversing the public internet. It is used for genuine multi-cloud architectures and for large-scale data movement during a migration. The driver is usually egress cost and latency: moving petabytes over the public internet is slow and the source provider's egress charges are substantial. Naming egress economics as the reason shows commercial as well as technical awareness.

Question 18

What is BigQuery Omni and how does it help multi-cloud analytics?

Accepted Answer

BigQuery Omni runs BigQuery compute in AWS or Azure so you can query data where it sits, returning only results. It avoids egressing large datasets while giving one query interface and one governance model across clouds. The constraint to acknowledge is that cross-cloud joins do move data, and not every BigQuery feature is available in Omni regions. It is a data-gravity solution rather than a general multi-cloud strategy, and being precise about that is the mark of a careful answer.

Question 19

How do you handle licensing when migrating commercial software?

Accepted Answer

Check whether licences are portable to the cloud, whether they are counted per physical core — which may require sole-tenant nodes — and whether the vendor offers a bring-your-own-licence or a cloud-metered option. Windows Server and SQL Server can be licence-included on Compute Engine or brought with you under specific conditions. Sole-tenant nodes for per-physical-core licensing is the specific GCP answer, and it is a real cost and design factor rather than a footnote. Discovering a licensing constraint after designing the compute layer forces a redesign, so it belongs in assessment.

Question 20

What is Migrate to Containers?

Accepted Answer

Migrate to Containers automates converting VM-based applications into containers that run on GKE or Cloud Run, extracting the application and its dependencies from the VM and generating artefacts and manifests, without a full manual rewrite. The honest caveat is that it produces a working container, not a well-designed one — the result often carries the VM's assumptions about local state and processes. It is a useful accelerator for suitable stateless workloads and a poor fit for anything with significant local state.

Question 21

How do you validate that a migration succeeded?

Accepted Answer

Functional testing against agreed acceptance criteria; performance comparison against a pre-migration baseline captured before cutover; data reconciliation with row counts and checksums; integration verification with upstream and downstream systems; and a monitoring period before declaring success and decommissioning the source. Capturing the performance baseline *before* migrating is the step that must be planned in advance, because "it feels slower" is unresolvable without it. Data reconciliation with checksums rather than a spot check is the other rigorous element.

Question 22

What are the most common reasons migrations fail?

Accepted Answer

Unknown dependencies discovered at cutover; underestimating data transfer time; no landing zone so governance is retrofitted; attempting to modernise and migrate simultaneously; insufficient skills in the team; no decommissioning so costs double; and treating it as a purely technical project without business ownership of each application. The dual-running cost is the one that destroys business cases quietly: if the source is never switched off, the programme delivers negative savings regardless of technical success. Naming it as a tracked deliverable rather than an assumption is the practical insight.

Question 23

How do you upskill a team during a migration?

Accepted Answer

Pair experienced cloud engineers with the existing team on real workloads rather than relying on training courses alone; start with lower-risk waves to build confidence; establish a cloud centre of excellence that produces reusable patterns and modules; and use certifications to structure learning while insisting on hands-on work. The point interviewers value is that a partner doing the migration for you leaves an operational gap when they leave. Building capability during the programme, rather than after it, is the difference between a migration and a permanent outsourcing dependency.

Question 24

What is a cloud centre of excellence and what should it own?

Accepted Answer

A small central team owning the landing zone, shared Terraform modules, reference architectures, guardrails such as organisation policies, cost governance and the enablement programme — while application teams own their own workloads. It is an enabling function, not an approval gate. The failure mode to name is a CCoE that becomes a ticket queue every change must pass through, which recreates the bottleneck cloud was meant to remove. Framing it as producing paved paths rather than approvals is what distinguishes a good model.

Question 25

How do you estimate the cost of running a workload on GCP before migrating it?

Accepted Answer

Collect actual utilisation from the source — CPU, memory, storage, IOPS, network — over a representative period, right-size to GCP machine types from that rather than from nameplate specifications, add storage, network egress and managed-service costs, apply expected commitments and discounts, and present a range with the assumptions stated. Right-sizing from measured utilisation is where most of the saving comes from, because on-premises servers are typically provisioned for peak and multi-year growth. A like-for-like specification comparison usually shows cloud as more expensive and is the wrong analysis.

Question 26

What is the difference between multi-cloud and hybrid cloud?

Accepted Answer

Hybrid combines a private data centre with a public cloud. Multi-cloud uses more than one public cloud provider. They solve different problems: hybrid is usually about constraints that keep workloads on premises, while multi-cloud is about avoiding lock-in, using best-of-breed services, or meeting a customer or regulatory requirement. The honest position on multi-cloud is that running the same workload across providers is expensive and rarely delivers the resilience people expect, whereas placing different workloads on different providers for genuine reasons is common and sensible. Interviewers respect that distinction.

Question 27

What is GKE Enterprise fleet management?

Accepted Answer

A fleet is a logical grouping of clusters — across GCP regions, on-premises and other clouds — managed together with consistent configuration through Config Sync, consistent policy through Policy Controller, cross-cluster service discovery through Service Mesh, and multi-cluster ingress or Gateway for routing across them. The capability worth highlighting is multi-cluster Gateway: one global load balancer routing to services across clusters in several regions, with failover. That is genuinely hard to build yourself and is a concrete reason to adopt the platform.

Question 28

How do you handle applications that cannot be migrated?

Accepted Answer

Retain them, and connect them properly — Interconnect or HA VPN for network reachability, identity federation so access control is consistent, and log and metric forwarding so they appear in the same observability platform. Plan their eventual replacement or retirement on a separate track rather than treating the exception as permanent. The organisational risk is that the exception list grows until the hybrid state is permanent and unmanaged. Attaching a review date and an owner to each retained application is the governance step that keeps it from becoming the default.

Question 29

What is a proof of concept versus a pilot in a migration?

Accepted Answer

A proof of concept validates a technical question in isolation — can this workload run on GKE at all — and is usually thrown away. A pilot migrates a real, production-bound application end to end through the real process, and its output is both a running workload and a validated migration method. The distinction matters because a successful proof of concept proves very little about a migration programme, which is mostly about process, dependencies and organisational readiness. Insisting on a real pilot before committing to waves is the right sequencing.

Question 30

How do you manage risk during a large migration?

Accepted Answer

Wave-based delivery so failures are contained; rehearsed cutovers with defined rollback; a maintained dependency map; parallel running where feasible with reconciliation; a communication plan; and a risk register reviewed regularly with owners. Every wave should produce lessons that change the next one. The feedback loop is what separates a programme that improves from one that repeats the same failure twenty times. Naming a post-wave review with concrete changes to the runbook is the practice that delivers it.

Question 31

What networking differences should you plan for when moving from AWS to GCP?

Accepted Answer

GCP's VPC is global with regional subnets, so multi-region deployments do not need peering; firewall rules are VPC-wide with priorities and can target service accounts as well as tags; there are no security groups or NACLs as separate concepts; routing is centrally managed with Cloud Router BGP for hybrid; and the global anycast load balancer replaces the regional-plus-DNS pattern. The global VPC is the biggest conceptual shift and it usually simplifies the design, so a literal translation of an AWS topology into GCP produces unnecessary complexity. Naming service-account-targeted firewall rules as a GCP advantage is a good specific detail.

Question 32

How do you migrate a data warehouse to BigQuery?

Accepted Answer

Assess schemas, queries and dependencies; use the BigQuery Data Transfer Service migration connectors for Redshift or Teradata, which include schema translation; use the batch SQL translator for query conversion; run both warehouses in parallel and reconcile results; migrate downstream consumers progressively; then decommission. Redesign for BigQuery rather than porting a star schema unchanged. The redesign point is the substance: BigQuery favours denormalisation with nested and repeated fields over join-heavy star schemas, and a literal port performs and costs worse than it should. Naming parallel running with result reconciliation is what gives stakeholders confidence to switch.

Question 33

What is the role of a partner in a GCP migration and how do you work with one?

Accepted Answer

Partners bring migration experience, accelerators and certified capacity, and can access Google funding programmes. The engagement should be structured so knowledge transfers — joint teams rather than a delivery silo, shared repositories, and documented runbooks — with clearly defined ownership at handover. This question comes up often at service companies and Google Cloud partners, and the answer that reads as experienced is one that plans for handover from day one. A migration that leaves the customer unable to operate the result has not succeeded.

Question 34

What is the difference between lift-and-shift and lift-and-optimise?

Accepted Answer

Lift and shift moves the workload unchanged, which is fastest and lowest risk but carries over inefficiencies and delivers little of the cloud benefit. Lift and optimise makes targeted changes during the move — right-sizing, replacing a self-managed database with Cloud SQL, moving files to Cloud Storage — which costs more effort but produces a materially better outcome. The pragmatic position is that some optimisation during the move is almost always worth it, because right-sizing and managed-service substitution are cheap changes with large recurring benefit, while full re-architecture is not. Naming that middle path is the balanced answer.

Question 35

How do you decommission source infrastructure safely?

Accepted Answer

Confirm no traffic reaches it with flow logs and monitoring over an agreed observation period; verify backups of its data are retained per policy; power it down rather than deleting it for a defined cooling-off period; then decommission fully, cancel licences and contracts, and confirm the cost reduction appears in the next billing cycle. The observation period with traffic monitoring is the safety mechanism that catches forgotten integrations — a nightly job or a partner system nobody documented. Verifying the cost actually fell is the step that closes the business case rather than assuming it.

Question 36

How would you approach a data-centre exit with a fixed deadline eighteen months away?

Accepted Answer

Assess and build the landing zone in the first months in parallel; classify the portfolio with the 6 Rs biased towards rehost and retire given the deadline; sequence waves by dependency and risk with a visible early pilot; run migration factories with repeatable runbooks; defer modernisation to a post-exit track; and track decommissioning per wave so savings are realised. Hold a buffer at the end for the hardest applications. The judgement being tested is resisting the temptation to modernise during a deadline-driven exit. Rehost now, modernise later is the correct call, and being willing to defend that against a preference for cloud-native purity is what an experienced migration lead does.

Question 37

What is Bare Metal Solution?

Accepted Answer

Bare Metal Solution provides dedicated physical hardware in a Google-managed facility adjacent to a GCP region, with low-latency connectivity to GCP services. It exists for workloads that cannot be virtualised or that have specialised licensing or certification requirements, most commonly Oracle databases. It is the answer to "we cannot move Oracle" — it gets the workload out of your own data centre and next to your cloud services without re-platforming. It is a transitional or constraint-driven option rather than a strategic destination.

Question 38

How do you keep security consistent across on-premises and GCP during a hybrid period?

Accepted Answer

Federate identity so there is one source of truth for users and groups; apply equivalent network controls with firewall rules and hierarchical policies mirroring on-premises segmentation; forward logs from both environments into one platform; use one secrets management approach; and run a single vulnerability and compliance reporting process across both. Unified logging is the highest-value item, because during a hybrid period an incident spans both environments and correlating across two disconnected log platforms is where investigations stall. Naming that as the first integration to build is a strong operational answer.

Question 39

What metrics would you report to executives during a migration?

Accepted Answer

Applications migrated against plan, waves completed, source infrastructure decommissioned, run-rate cost in both environments, incidents caused by migration, and business-facing outcomes such as deployment frequency or time to provision. Not raw technical counts like VMs moved, which do not convey progress towards the business goal. Reporting decommissioning alongside migration is the honest metric pairing, because migrated-but-not-decommissioned is negative progress financially. Choosing outcome metrics over activity metrics is what distinguishes a programme lead from a project tracker.

Question 40

Design a migration plan for a 400-application enterprise estate moving to GCP.

Accepted Answer

Assess with Migration Center plus discovery tooling to build the inventory, dependency map and utilisation baseline, classifying with the 6 Rs and expecting a meaningful retire population. Build a Terraform-managed landing zone with organisation hierarchy, federated identity, Shared VPC and IP plan, organisation policies, centralised logging and billing export before any workload moves. Establish a CCoE producing shared modules and paved paths. Run a visible pilot, then migration factories delivering waves grouped by move group, using Migrate to Virtual Machines and Database Migration Service, with rehearsed cutovers and defined rollback. Track decommissioning as a wave deliverable. Defer modernisation to a post-migration track prioritised by business value, and upskill through paired delivery rather than training alone. The closing scenario. The senior markers are landing zone before workloads, decommissioning as a tracked deliverable, deferring modernisation, and building internal capability during the programme — because those four are where large migrations actually succeed or fail.

GCP Migration, Anthos & Hybrid Cloud Interview Questions and Answers

How to use this set