Google Cloud Interview Questions and Answers

GCP IAM binds principals to roles on resources. A service account is a special identity for workloads rather than humans.

• Principals: users, groups, service accounts, domains.
• Roles: basic (owner, editor, viewer), predefined, or custom. Roles are collections of permissions.
• Policy: a binding of principal, role, and resource, inherited down the hierarchy.

Service accounts:

• Identified by an email such as sa@project.iam.gserviceaccount.com.
• Prefer attaching them to resources such as Compute Engine, GKE Workload Identity, or Cloud Run so workloads get short-lived tokens.
• Avoid downloading long-lived JSON keys; if you must, rotate them and store them in Secret Manager.

gcloud iam service-accounts create reader --display-name="Reader"
gcloud projects add-iam-policy-binding my-proj \
  --member="serviceAccount:reader@my-proj.iam.gserviceaccount.com" \
  --role="roles/storage.objectViewer"

Follow least privilege and prefer Workload Identity Federation over keys.

All run workloads, but at different levels of abstraction.

• Compute Engine: raw VMs with full control of the OS, networking, and disks. Best for legacy apps, custom kernels, or lift-and-shift. You manage patching and scaling, although managed instance groups help.
• Google Kubernetes Engine: managed Kubernetes. Runs containerised workloads with orchestration, autoscaling, and a rich ecosystem. Autopilot mode manages nodes for you. Choose it when you need portability, complex scheduling, or many services.
• Cloud Run: serverless containers. Scales to zero, handles HTTP and events, and bills per request. Best for stateless APIs and jobs with unpredictable traffic.

A rule of thumb: start with Cloud Run for simple stateless services, GKE for a Kubernetes-native platform, and Compute Engine only when you need machine-level control.

BigQuery is a serverless, columnar data warehouse built on a separation of storage and compute.

• Storage: data lives in Capacitor, a columnar format backed by Colossus distributed storage. You pay for bytes stored, with long-term automatic discounts after 90 days.
• Compute: queries run on a shared pool of Dremel slots. You can use on-demand pricing, billed per byte scanned, or flat-rate and slot reservations for predictable workloads.
• This separation means storage scales independently of query capacity, and you can query data without provisioning clusters.

SELECT user_id, COUNT(*) AS events
FROM `proj.analytics.events`
WHERE event_date = CURRENT_DATE()
GROUP BY user_id
ORDER BY events DESC
LIMIT 100;

Optimise cost by partitioning on date, clustering on common filters, and selecting only needed columns. Avoid SELECT *, and check the query plan before running at scale.

A GCP VPC is a global, software-defined network. Subnets are regional, and instances in different regions can communicate over the internal network.

• VPC networks come in auto mode, with one subnet per region, or custom mode. Custom is recommended for control.
• Subnets have a primary CIDR and optional secondary ranges for GKE pods and services.
• Firewall rules are stateful, applied at the VPC level, and use priorities. They target instances by network tags or service accounts.
• Rules define direction, protocol, ports, source and destination ranges, and action. Default rules allow internal traffic and deny ingress from the internet.

gcloud compute firewall-rules create allow-https \
  --network=my-vpc --allow=tcp:443 \
  --source-ranges=0.0.0.0/0 --target-tags=web

Use hierarchical firewall policies for organisation-wide rules and Shared VPC to centralise networking across projects.

Cloud Storage classes trade storage cost for retrieval cost and minimum storage duration.

• Standard: frequent access, no minimum duration. Best for hot data and serving websites.
• Nearline: accessed less than once a month, 30-day minimum.
• Coldline: accessed less than once a quarter, 90-day minimum.
• Archive: accessed less than once a year, 365-day minimum, and the lowest storage price.

All classes offer millisecond access and the same durability; only cost and minimum duration differ. Set the class at upload or let Autoclass move objects automatically based on access.

gcloud storage cp logs/*.gz gs://my-bucket/logs/ \
  --storage-class=NEARLINE
gcloud storage buckets update gs://my-bucket --lifecycle-file=lifecycle.json

Lifecycle rules can transition or delete objects. Beware early-deletion charges if you move data before the minimum duration elapses.