Question 1

How does GCP encrypt data at rest by default?

Accepted Answer

All customer data at rest is encrypted by default with no configuration and no extra cost. Data is chunked, each chunk encrypted with its own data encryption key, and those keys are wrapped by key encryption keys held in Google's internal key management system, with regular automatic rotation. The customer does not manage anything unless they choose to. The envelope-encryption structure is the part to explain, because it is the same model CMEK extends: with CMEK you supply the key encryption key from Cloud KMS while Google still manages the per-chunk data encryption keys. Understanding envelope encryption makes every subsequent key question straightforward.

Question 2

What is Cloud KMS?

Accepted Answer

Cloud KMS is GCP's managed key management service. You create key rings scoped to a location, and keys within them, with a purpose — symmetric encryption, asymmetric signing or encryption, or MAC. It supports automatic rotation, versioning, IAM per key, and audit logging of every use. The location constraint matters: a key ring is created in a region or multi-region and cannot be moved, and a resource generally must use a key in a compatible location. Getting that wrong means recreating resources, so it is a planning decision rather than a detail.

Question 3

What is the difference between Google-managed keys, CMEK and CSEK?

Accepted Answer

Google-managed keys are the default — encryption happens with no involvement from you. CMEK means you own a Cloud KMS key that wraps the data keys, so you control rotation, can audit every use, and can revoke access by disabling the key. CSEK means you supply the raw key on every API call and Google never stores it, so losing it means losing the data permanently. The property that makes CMEK valuable is revocation: disabling the key makes the data immediately unreadable, which is a genuine kill switch for a compromised environment. That same property is the operational risk, so key destruction should be protected and the destroy-scheduled duration set generously.

Question 4

What is Cloud HSM and Cloud External Key Manager?

Accepted Answer

Cloud HSM stores and uses keys inside FIPS 140-2 Level 3 validated hardware security modules managed by Google, for workloads that require hardware-backed key protection. Cloud EKM lets keys remain in a third-party key manager outside Google entirely, with GCP calling out to it for every cryptographic operation. EKM is the answer to a compliance requirement that Google must never possess the key material. The trade-off to name is availability coupling — if the external key manager is unreachable, the data is unreachable, which introduces a dependency outside Google's SLA.

Question 5

How does key rotation work in Cloud KMS?

Accepted Answer

A key can be configured with an automatic rotation period, which creates a new key version that becomes primary for new encryptions. Existing data stays encrypted with its original version, which remains enabled for decryption. Re-encrypting old data with the new version is a separate deliberate action. The point candidates miss is that rotation does not re-encrypt anything — it only changes which version encrypts new data. So rotation limits the blast radius going forward but does not protect data already written, and full protection requires a re-encryption process.

Question 6

What is Secret Manager and how does it differ from KMS?

Accepted Answer

Secret Manager stores secret values — API keys, passwords, certificates — with versioning, IAM per secret, audit logging, optional rotation notifications and replication policy. KMS manages cryptographic keys and performs cryptographic operations; it does not store your secrets. Secret Manager encrypts its contents using KMS underneath. The distinction to state simply: KMS holds keys that encrypt things, Secret Manager holds things that are encrypted. Using KMS to encrypt a secret and storing the ciphertext yourself is the pattern Secret Manager replaces, and knowing that is why the two are not alternatives.

Question 7

How should applications consume secrets from Secret Manager?

Accepted Answer

Fetch them at runtime using the workload's attached service account, with no key file, and cache the value in memory rather than fetching on every request. On Cloud Run and Cloud Functions you can reference the secret directly in the service configuration as an environment variable or mounted file; on GKE, use Workload Identity with the Secret Manager CSI driver. The rotation consideration is whether you pin a version or use "latest": pinning is deterministic and requires a deploy to rotate, while "latest" picks up a rotated value on the next instance start. Naming that trade-off shows you have thought past the initial integration.

Question 8

What is Cloud Armor?

Accepted Answer

Cloud Armor is GCP's WAF and DDoS protection applied at the global load balancer. It supports IP and geography based allow and deny rules, preconfigured OWASP Top 10 rule sets for SQL injection, cross-site scripting and similar, per-client rate limiting, bot management with reCAPTCHA integration, and adaptive protection that uses machine learning to detect anomalous traffic patterns. The deployment discipline to mention is preview mode: run new WAF rules in preview first so you see what *would* have been blocked before enforcing, because OWASP rule sets have real false-positive rates on legitimate application traffic.

Question 9

How would you protect an API from abuse on GCP?

Accepted Answer

Cloud Armor rate limiting per client IP or per identifying header at the load balancer, authentication with API Gateway or Apigee for quota enforcement per API key, IAM or IAP for internal consumers, and application-level idempotency and input validation. Alert on 429 rates and on sudden traffic pattern changes. The layered ordering is the answer: drop obvious abuse at the edge where it is cheapest, enforce per-consumer quotas at the API layer, and validate at the application. Doing rate limiting only in application code means the attack still consumes your compute, which is the point of the question.

Question 10

What is Security Command Center?

Accepted Answer

Security Command Center is GCP's centralised security and risk platform. It provides asset inventory, Security Health Analytics for misconfiguration findings, Web Security Scanner, Event Threat Detection over audit and network logs, Container Threat Detection, and compliance reporting against benchmarks such as CIS and PCI DSS. The tiering matters practically: Standard gives a subset of findings while Premium and Enterprise add threat detection, attack path simulation and full compliance reporting. Promising Event Threat Detection to a Standard-tier customer is the sort of error the tier question is designed to catch.

Question 11

What are the most common GCP misconfigurations you would look for first?

Accepted Answer

Public Cloud Storage buckets or BigQuery datasets granted to allUsers or allAuthenticatedUsers; basic Owner and Editor roles granted broadly; long-lived service-account keys; VMs with public IPs and open firewall rules, especially SSH and RDP to 0.0.0.0/0; default service accounts with Editor; disabled or unmonitored audit logging; and unencrypted or unrestricted access to sensitive datasets. The strong follow-up is to say how you would *prevent* rather than only detect each: organisation policy constraints for public access and external IPs and key creation, hierarchical firewall policies for the network rules. Detection without prevention means finding the same issue every quarter.

Question 12

What is VPC Service Controls and what threat does it address?

Accepted Answer

It creates a perimeter around projects and Google-managed services so data cannot be read out of or written into the perimeter, even by an identity holding valid IAM permissions from outside it. It addresses credential-based data exfiltration — a stolen service-account key or a compromised user account used from anywhere on the internet — which firewalls cannot stop because these APIs are internet-facing. The operational advice is to deploy in dry-run mode first, because perimeters break legitimate access paths in ways that are hard to predict — CI pipelines, partner integrations, support tooling. Naming dry-run mode is what separates someone who has implemented it from someone who has read about it.

Question 13

What is Binary Authorization and where does it fit in supply-chain security?

Accepted Answer

Binary Authorization is a deploy-time gate that only allows container images carrying required attestations to run on GKE, Cloud Run or Anthos. Attestations are signed statements that an image was built by a trusted pipeline, passed vulnerability scanning, or was reviewed. It stops unverified images reaching production. The complete supply-chain story pairs it with Artifact Registry vulnerability scanning, Cloud Build provenance and SLSA-style build attestations. Naming the break-glass process is also important — you will eventually need an emergency deployment, and an undesigned bypass becomes a permanent hole.

Question 14

How do you scan container images for vulnerabilities on GCP?

Accepted Answer

Artifact Registry provides vulnerability scanning that analyses images on push and continuously re-scans as new CVEs are published, reporting severity and fixable status. Findings surface in Security Command Center, and Binary Authorization can block deployment of images above a severity threshold. The continuous re-scan is the important property: an image clean at build time becomes vulnerable when a new CVE is published, so a one-off scan in CI is insufficient. Pairing scanning with a base-image update cadence is the process half of the answer.

Question 15

What is Identity-Aware Proxy and how does it implement zero trust?

Accepted Answer

IAP authenticates and authorises every request to an application at the edge, based on Google identity plus context such as device state and network, before the request reaches the backend. There is no VPN and no network-based trust — access is granted per request by IAM and access levels, which is the BeyondCorp model. The implementation detail to include is that the backend must verify the signed IAP JWT rather than trusting a header, because if the backend is ever reachable directly, header spoofing bypasses IAP entirely. That is a real vulnerability pattern.

Question 16

How would you respond to a suspected compromised service account?

Accepted Answer

Contain first: disable the service account or remove its role bindings, and disable any keys. Then assess with audit logs — what did it do, from where, over what period — using Cloud Logging and Cloud Asset Inventory time travel to see what changed. Rotate any secrets it could reach, revoke and reissue credentials, and remediate the root cause, usually a leaked key. Preserve logs for forensics before anything is deleted. The sequencing — contain, investigate, remediate, recover — is what interviewers listen for, along with preserving evidence. Deleting the service account immediately feels decisive but destroys the binding history you need to understand the blast radius.

Question 17

What is the principle of defence in depth applied to a GCP workload?

Accepted Answer

Multiple independent controls so one failure does not expose the system: organisation policy constraints preventing dangerous configurations; IAM least privilege on dedicated service accounts; network isolation with private IPs, firewall rules and Cloud NAT; VPC Service Controls around data services; encryption with CMEK; Cloud Armor at the edge; audit logging to a separate project; and detection with Security Command Center. The framing that scores is that each layer assumes the previous one has failed. Being able to say "if IAM is bypassed by a stolen credential, the VPC Service Controls perimeter still contains the data" demonstrates the reasoning rather than just the list.

Question 18

What are Cloud Audit Logs and which should you enable?

Accepted Answer

Admin Activity logs are always on, free and record every configuration and IAM change. Data Access logs record reads and writes of user data and are off by default outside BigQuery because of their volume and cost. System Event logs record Google-initiated actions. Policy Denied logs record requests blocked by security policy. The recommendation to give is to enable Data Access logging selectively on sensitive services — Cloud Storage buckets and BigQuery datasets holding regulated data — rather than globally, because full enablement across a large estate generates enormous volume. That balance is the practical judgement being tested.

Question 19

How do you protect audit logs from tampering?

Accepted Answer

Export them with an aggregated organisation-level sink to a dedicated logging project with restricted IAM, into a Cloud Storage bucket with a locked retention policy or a BigQuery dataset. Deny policies prevent even project owners from deleting the sink or the bucket, and an alert fires on any change to the log configuration itself. The reason this matters is that disabling logging is a standard early step in an intrusion, and logs stored in the same project as the compromised workload can be deleted by the attacker. Separation plus a locked retention policy is what makes them evidence.

Question 20

What is the difference between an organisation policy constraint and an IAM deny policy?

Accepted Answer

An organisation policy constraint restricts what configuration is permitted — no external IPs, no public buckets, only these regions — regardless of who requests it. An IAM deny policy blocks specific principals from specific permissions, evaluated before allow policies. Constraints govern resource shape, deny policies govern identity. Both override IAM allows, which is what makes them guardrails, but they answer different questions. Being able to pick the right one for a given requirement — "no VM may have a public IP" is a constraint, "contractors may never delete buckets" is a deny policy — is the applied skill.

Question 21

How do you handle PII in a GCP data platform?

Accepted Answer

Discover and classify it with Sensitive Data Protection (Cloud DLP), de-identify at ingestion where possible through tokenisation or masking, apply BigQuery column-level policy tags so only authorised roles can read sensitive columns, use row-level security for tenant or region scoping, enforce a VPC Service Controls perimeter, enable Data Access audit logs, and set retention so data is deleted when no longer needed. Retention is the part most candidates omit and regulators care about most: holding personal data indefinitely is itself a violation under several regimes. Naming lifecycle deletion alongside access control makes the answer complete.

Question 22

What is Assured Workloads?

Accepted Answer

Assured Workloads applies a compliance-specific control package to a folder — enforcing data residency, personnel access restrictions, supported product limits and encryption requirements for regimes such as regional sovereignty programmes, FedRAMP or CJIS — so the environment is technically constrained rather than only documented as compliant. The value is that controls are enforced by the platform rather than relying on engineers to follow a policy document. The trade-off is a reduced product set and some feature restrictions, which is worth naming because teams are surprised when a service is unavailable inside the boundary.

Question 23

What is a service perimeter bridge?

Accepted Answer

A bridge allows controlled communication between two VPC Service Controls perimeters for specific projects, so services that must exchange data across perimeters can do so without merging the perimeters or opening them broadly. It exists because perimeters are intentionally restrictive, and real organisations have legitimate cross-boundary flows. Preferring ingress and egress rules over bridges is the current guidance, since they are more granular, and knowing that shows currency.

Question 24

How do you secure a GKE cluster?

Accepted Answer

Private cluster with no public node IPs and a restricted control-plane endpoint; Workload Identity instead of node service accounts or key files; a default-deny NetworkPolicy baseline with Dataplane V2; Binary Authorization on signed, scanned images; least-privilege RBAC per namespace; Secret Manager rather than plain Kubernetes Secrets; Shielded and Confidential nodes where required; and node auto-upgrade on a release channel. The single highest-value item is Workload Identity, because it removes both the exported-key risk and the node-metadata escalation path. Leading with it, rather than listing controls alphabetically, shows you have prioritised by actual risk.

Question 25

What is the difference between authentication, authorisation and auditing?

Accepted Answer

Authentication proves identity; authorisation decides what that identity may do; auditing records what it actually did. All three are needed — strong authentication without least-privilege authorisation still allows over-broad action, and both without auditing leave you unable to investigate or prove compliance. On GCP the mapping is Cloud Identity and federation for authentication, IAM for authorisation, and Cloud Audit Logs for auditing. Giving the mapping rather than the definitions is what makes it a GCP answer rather than a textbook one.

Question 26

What is Web Security Scanner?

Accepted Answer

Web Security Scanner crawls a deployed App Engine, Compute Engine or GKE web application, following links and exercising forms, and reports vulnerabilities such as cross-site scripting, mixed content, outdated libraries and clear-text password fields. Findings appear in Security Command Center. The caution to state is that it performs real interactions, so running it against production can create data or trigger side effects. Running it against a staging environment with representative data is the safe practice.

Question 27

How would you implement least privilege for a CI/CD pipeline?

Accepted Answer

A dedicated service account per environment with only the deployment permissions it needs on the specific target resources; Workload Identity Federation so the pipeline uses short-lived credentials rather than a stored key; attribute conditions restricting which repository and branch may assume the identity; and separate, more privileged identities for production requiring an approval gate. The attribute condition is the security-critical detail: without restricting on repository and ref, a different repository in the same organisation can obtain production deployment credentials. That misconfiguration has caused real incidents, which is why it is asked specifically.

Question 28

What is Confidential Computing on GCP?

Accepted Answer

Confidential VMs and Confidential GKE nodes encrypt data in use, in memory, using hardware memory encryption from AMD SEV or equivalent. Combined with default encryption at rest and in transit, this closes the last gap where data was previously exposed in plaintext to the hypervisor. The use cases that justify the performance overhead are regulated data, multi-party computation where several organisations pool data without any seeing the others' inputs, and requirements that the cloud operator cannot access the data. Naming multi-party computation shows you understand why it exists beyond compliance box-ticking.

Question 29

How do you manage TLS certificates on GCP?

Accepted Answer

Google-managed SSL certificates on a load balancer are provisioned and renewed automatically once domain ownership is validated, which is the default choice. Certificate Manager handles larger fleets, wildcard and multi-domain certificates and custom validation. Self-managed certificates are uploaded when you must use a specific CA. The failure people hit is a Google-managed certificate stuck in PROVISIONING because DNS does not yet point at the load balancer's IP — validation requires the domain to resolve to it. Knowing that ordering requirement saves hours during a launch.

Question 30

What is the shared fate model and how does it differ from shared responsibility?

Accepted Answer

Shared responsibility draws a line and says what is the provider's job and what is yours. Shared fate goes further: Google provides opinionated secure defaults, blueprints, guardrails and risk-protection programmes so customers are actively helped to be secure rather than merely told where the boundary is. The concrete expressions are secure-by-default settings, the Cloud Foundation blueprints, organisation policy constraints and Assured Workloads. Naming those makes it a substantive answer rather than repeating marketing language.

Question 31

How do you detect and prevent cryptomining on compromised GCP resources?

Accepted Answer

Prevent with organisation policy constraints on external IPs and service-account key creation, least privilege, and quota limits capping how much compute can be created. Detect with Event Threat Detection in Security Command Center, which flags cryptomining patterns, plus budget alerts and anomalous-spend detection, and alert on unusual VM creation in unused regions. Quotas as a security control is the insight worth volunteering: an attacker with compute permissions is limited by regional CPU quota, so keeping unused regions at zero quota bounds the damage. Most candidates think of quotas only as a cost mechanism.

Question 32

What is Access Transparency and Access Approval?

Accepted Answer

Access Transparency provides logs of when Google personnel access your content and why, giving visibility that is normally absent from a cloud provider. Access Approval goes further and requires your explicit approval before such access occurs, so support actions cannot proceed without a customer decision. These matter for regulated customers who must attest that no third party can access data unilaterally. The operational cost to name is that Access Approval can slow support engagements, because a genuine incident may wait on an approval decision.

Question 33

What security considerations apply to Cloud Storage specifically?

Accepted Answer

Enforce uniform bucket-level access so IAM is the single source of truth; enable public access prevention through organisation policy; use signed URLs with short expiry for user access rather than making objects public; enable versioning and soft delete against ransomware and accidental deletion; use CMEK for regulated data; enable Data Access audit logs; and apply retention policies where records must be immutable. The ransomware angle is the one worth leading with in a modern interview: versioning plus soft delete plus a locked retention policy means an attacker with storage permissions still cannot destroy the data. That is a concrete, current threat model.

Question 34

What is the difference between a firewall rule and a security policy in Cloud Armor?

Accepted Answer

A VPC firewall rule operates at layers 3 and 4 on packets between IP addresses inside your network. A Cloud Armor security policy operates at layer 7 on HTTP requests arriving at the global load balancer, inspecting paths, headers and bodies, and applying WAF rules and rate limits before traffic reaches any backend. The complementary framing is that Cloud Armor stops application-layer attacks at the edge and firewall rules control network reachability inside. Neither substitutes for the other, and a design that relies only on firewall rules has no protection against SQL injection.

Question 35

How do you prevent data exfiltration by an insider with legitimate access?

Accepted Answer

VPC Service Controls perimeters so data cannot leave the boundary even with valid credentials; egress firewall rules with default deny and a proxy for permitted destinations; restricted external IPs; Data Access audit logs with alerting on unusual read volume; column-level and row-level access controls so the accessible surface is minimal; and separation of duties so nobody can both extract data and delete the logs. The honest acknowledgement is that you cannot prevent someone from reading data they legitimately need — you can only minimise what that is, make bulk extraction difficult, and make it detectable. Framing it as minimise-and-detect rather than prevent is the mature position.

Question 36

What is Cloud Identity-Aware Proxy TCP forwarding used for?

Accepted Answer

It tunnels SSH and RDP through Google's infrastructure to instances with no external IP, authorised by IAM rather than by network position. It removes the need for a bastion host or a VPN for administrative access, and every session is authorised per identity and audited. The concrete comparison is with a bastion host, which you must patch, monitor and secure, and which becomes a high-value target. IAP moves that responsibility to Google and replaces network trust with identity, which is both simpler and stronger.

Question 37

How do you approach compliance certification on GCP — for example ISO 27001 or PCI DSS?

Accepted Answer

Start from Google's own certifications, which cover the infrastructure layer and are available through the Compliance Reports Manager, then map the controls that remain yours. Use Assured Workloads or the security blueprints for enforced configuration, Security Command Center compliance reporting to track posture, organisation policy for preventive controls, and audit-log export for evidence. The essential clarification is that Google's certification does not make your workload compliant — it covers their layer only. Candidates who say "GCP is PCI compliant so we are covered" have the model wrong, and that is exactly what this question checks.

Question 38

What is a break-glass procedure and how would you implement it on GCP?

Accepted Answer

A pre-defined, audited path to elevated access for genuine emergencies. Implement it with a dedicated group granted powerful roles through an IAM condition that is normally unsatisfied, or a process that grants time-bound access on approval, with an immediate alert to security on every use, mandatory post-use review, and automatic expiry. The design requirement is that using it must be possible under pressure but impossible to use quietly. If break-glass access is convenient and unmonitored, it becomes the normal path, which defeats every other control you have built.

Question 39

What logs and signals would you feed into a SIEM from GCP?

Accepted Answer

Cloud Audit Logs (Admin Activity, Data Access, Policy Denied), VPC Flow Logs, firewall logs, Cloud Armor request logs, GKE audit and container logs, Security Command Center findings, and DNS logs. Export through an aggregated organisation-level log sink to Pub/Sub or BigQuery, or to Google Security Operations directly. The volume-versus-value point is worth raising: Data Access and Flow Logs can dominate ingest cost in a SIEM, so sampling and selective enablement are real decisions. Naming an aggregated sink at organisation level, rather than per-project exports, is the scalable pattern.

Question 40

Design the security architecture for a healthcare application on GCP handling patient data.

Accepted Answer

Cloud Identity federated with the corporate IdP and enforced multi-factor authentication; a folder under Assured Workloads for residency and personnel controls; separate projects per environment under a Shared VPC with no external IPs, Cloud NAT egress and default-deny egress rules; VPC Service Controls perimeter around all data services; CMEK on Cloud Storage, BigQuery and Cloud SQL with rotation; Sensitive Data Protection to classify and de-identify at ingestion; column-level policy tags and row-level policies in BigQuery; IAP for internal application access with device context; Cloud Armor and managed certificates at the only public entry point; audit logs including Data Access exported to a locked, separate logging project; Security Command Center Premium with alerting; Binary Authorization on the container supply chain; and a documented, tested incident-response and break-glass procedure. The closing scenario. The differentiators are de-identifying at ingestion rather than protecting after the fact, isolating and locking the audit logs, and explicitly including tested incident response — a security architecture with no rehearsed response plan is incomplete regardless of how many controls it lists.

GCP Security, KMS & Secret Manager Interview Questions and Answers

How to use this set