Google Cloud Interview Questions and Answers

An organization is the root node of the Google Cloud resource hierarchy. A project is the fundamental resource container where you enable APIs, create resources, and attach billing.

Hierarchy: organization, then folders, then projects, then resources. IAM policies and organization policies inherit downward.

• Organization: created with Google Workspace or Cloud Identity, it lets you centrally apply policy and manage billing accounts.
• Project: required for almost every resource. It has a project ID, number, and name. Billing attaches here, and resources cannot span projects.
• Folders: group projects by department or environment and apply policy at that level.

gcloud projects create my-app-prod --organization=123456789
gcloud projects list --format='table(projectId,name)'

Best practice is one project per environment or service boundary, Shared VPC or VPC peering for connectivity, and least-privilege IAM at folders.

A service account key is a downloadable JSON file containing a private key that lets any holder authenticate as that service account. It is long-lived and does not expire unless you delete it.

Why to avoid keys:

• They are bearer credentials; if leaked, an attacker gets the account's permissions until the key is revoked.
• They are hard to rotate and audit, and often end up in source control or CI logs.
• Google recommends workload identity instead.

Better options:

• Attach a service account to Compute Engine, GKE, or Cloud Run so the workload gets short-lived tokens automatically.
• Use Workload Identity Federation to let external workloads, such as GitHub Actions, exchange their identity for GCP tokens.
• If a key is unavoidable, store it in Secret Manager, restrict access, and rotate regularly.

gcloud iam service-accounts keys list --iam-account=sa@proj.iam.gserviceaccount.com

Treat keys as a last resort.