Google Cloud interview questions covering compute, storage, networking, IAM, GKE, Cloud Run, BigQuery, observability, and security.
Google Cloud Platform, or GCP, is a set of cloud services for running applications, storing data, analyzing events, training AI models, securing workloads, and operating infrastructure. In an interview, explain it as more than virtual machines: a production GCP system usually combines identity, networking, compute, storage, observability, automation, and cost controls.
The resource hierarchy is Organization, Folders, Projects, and Resources. The organization represents the company boundary.
Projects are important because they isolate resources, billing, API enablement, IAM bindings, quotas, and operational ownership. Teams often create separate projects for development, staging, and production so risky experiments do not affect production.
gcloud projects list
gcloud config set project my-prod-project
gcloud services enable run.googleapis.com storage.googleapis.com pubsub.googleapis.comFolders help group projects by environment, department, region, compliance boundary, or product line. For example, a company may create folders named Production, NonProduction, Data, and Sandbox. Organization policies and IAM roles can be assigned at folder level so each group follows common rules.
Identity and Access Management controls who can do what on which resource. A binding connects a principal, such as a user, group, service account, or workload identity, to a role on a resource.
Primitive roles are broad legacy roles such as Owner, Editor, and Viewer. Predefined roles are service-specific roles managed by Google, such as Cloud Run Admin or BigQuery Data Viewer.
A service account is an identity used by an application, VM, function, build job, or other non-human workload. Instead of sharing user credentials, assign a service account to the workload and grant only the required roles.
gcloud iam service-accounts create api-runner \
--display-name="Cloud Run API identity"
gcloud projects add-iam-policy-binding my-prod-project \
--member="serviceAccount:api-runner@my-prod-project.iam.gserviceaccount.com" \
--role="roles/logging.logWriter"Service account keys are long-lived credentials that can be copied outside Google Cloud. If a key is leaked through a repository, laptop, CI log, or ticket, an attacker can use it until it is revoked. Better options are attached service accounts for GCP workloads, Workload Identity for GKE, Workload Identity Federation for external systems, and short-lived tokens.
Workload Identity Federation lets external workloads access Google Cloud without storing service account keys. Instead of downloading a JSON key, an external identity provider such as GitHub Actions, Azure AD, or an on-prem identity system exchanges a trusted token for a short-lived Google credential.
A Virtual Private Cloud network is a global private network that contains regional subnets. It controls private IP addressing, routes, firewall rules, peering, VPNs, NAT, and private connectivity.
Subnets are regional IP ranges inside a VPC. Resources such as Compute Engine VMs and GKE nodes are placed into subnets.
Firewall rules allow or deny traffic based on direction, protocol, port, source or destination, priority, and targets. Rules can target all instances, network tags, or service accounts. Lower priority numbers win.
Cloud NAT lets private instances reach the internet for outbound connections without having public IP addresses. It is useful when VMs or GKE nodes need to download packages, call third-party APIs, or reach external services while staying private.
Cloud Load Balancing distributes traffic across backends such as instance groups, Cloud Run services, GKE services, or backend buckets. Google Cloud has global external HTTP(S) load balancing for web traffic, regional load balancers for internal or regional traffic, and TCP/UDP options.
Cloud CDN caches static and cacheable content close to users at Google edge locations. It reduces latency, origin load, and sometimes egress cost.
Choose Compute Engine when you need VM-level control: custom agents, specialized operating systems, lift-and-shift applications, GPUs, stateful software, or workloads that do not fit serverless constraints. The tradeoff is operational responsibility. You must patch images, configure startup scripts, manage disks, monitor health, and plan autoscaling.
Managed instance groups run identical VM instances from an instance template and provide autoscaling, autohealing, rolling updates, and load balancer integration. They are useful for stateless VM-based services.
App Engine is a managed application platform with opinionated runtimes. Cloud Run runs containers, while Cloud Functions is aimed at small event-driven handlers.
Build or provide a container image, choose a region, configure environment variables, attach a service account, set ingress and authentication, and deploy. Cloud Run creates a revision for each deployment, so rollbacks are straightforward.
gcloud run deploy orders-api \
--image=us-docker.pkg.dev/my-prod-project/apps/orders-api:1.4.2 \
--region=us-central1 \
--service-account=orders-api@my-prod-project.iam.gserviceaccount.com \
--no-allow-unauthenticatedA Cloud Run revision is an immutable snapshot of service configuration and container image. Every deployment creates a new revision. Traffic can be split between revisions for canary releases, gradual rollouts, or quick rollback.
Google Kubernetes Engine is Google Cloud's managed Kubernetes service. Choose it when you need Kubernetes APIs, multi-container orchestration, custom networking, service mesh, workload portability, complex scheduling, or a platform shared by many teams.
GKE Standard gives more control over node pools, machine types, daemonsets, and cluster configuration. GKE Autopilot manages more infrastructure for you and bills closer to requested pod resources.
Use least-privilege Kubernetes RBAC, Workload Identity instead of service account keys, private clusters where appropriate, network policies for pod-to-pod restrictions, Binary Authorization or admission controls for image policy, regular upgrades, and separate namespaces for ownership boundaries. Also configure logging and metrics, avoid privileged containers, scan images, and restrict who can create cluster-admin bindings.
Cloud Storage stores objects such as images, backups, logs, exports, static assets, machine learning datasets, and data lake files. It is not a POSIX file system; objects are stored in buckets and addressed by name. Design decisions include location type, storage class, lifecycle rules, retention policy, uniform bucket-level access, public access prevention, encryption, and versioning.
gcloud storage buckets create gs://tl-prod-assets \
--location=US \
--uniform-bucket-level-access
gcloud storage cp ./logo.png gs://tl-prod-assets/images/logo.pngStandard is best for frequently accessed data. Nearline, Coldline, and Archive are cheaper for storage but designed for less frequent access and may have retrieval or minimum storage duration considerations.
Cloud SQL is a managed relational database service for MySQL, PostgreSQL, and SQL Server. Google handles much of provisioning, backups, patching, replication, and monitoring, but you still design schemas, indexes, connection pooling, availability, backups, and security.
Cloud Spanner is a globally distributed relational database with horizontal scaling and strong consistency. It is useful when a business needs relational semantics, high availability, large scale, and regional or multi-regional distribution.
Firestore is a managed NoSQL document database commonly used for web, mobile, and serverless applications. It stores documents in collections and supports real-time sync patterns. Interviewers expect you to understand document modeling, query indexes, transaction limits, security rules for client access, and cost behavior based on reads, writes, deletes, and storage.
BigQuery is a serverless data warehouse for analytics over large datasets. It is designed for SQL-based analysis, reporting, data marts, dashboards, and batch or streaming analytics.
SELECT
DATE(order_created_at) AS order_date,
COUNT(*) AS orders,
SUM(total_amount) AS revenue
FROM `analytics.orders`
WHERE order_created_at >= TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 30 DAY)
GROUP BY order_date
ORDER BY order_date;Control cost by partitioning tables, clustering frequently filtered columns, selecting only required columns, previewing bytes processed, using table expiration for temporary data, materializing repeated heavy transformations, and setting budgets or custom quotas. Avoid SELECT * on large tables.
Pub/Sub is a managed messaging service for asynchronous event delivery. Publishers send messages to topics, and subscribers receive them through push or pull subscriptions.
gcloud pubsub topics create order-events
gcloud pubsub subscriptions create order-worker --topic=order-events
gcloud pubsub topics publish order-events \
--message='{"orderId":"A1001","status":"paid"}'Pub/Sub can deliver messages more than once, so consumers should be idempotent. Use a unique event ID, store processed IDs where appropriate, make updates conditional, and design side effects such as email sending or payment capture carefully. Acknowledging too early risks losing work after a crash; acknowledging too late increases duplicates.
Dataflow is a managed service for Apache Beam pipelines. It processes batch and streaming data and is commonly used for ETL, event enrichment, aggregations, and moving data between Pub/Sub, Cloud Storage, BigQuery, and other systems.
Secret Manager stores secrets such as API keys, database passwords, and webhook tokens with versioning, IAM, audit logs, and encryption. Environment variables can still be used to inject secret values at runtime, but the source of truth should be managed and auditable.
printf "super-secret-value" | gcloud secrets create payment-api-key \
--data-file=-
gcloud secrets add-iam-policy-binding payment-api-key \
--member="serviceAccount:payments@my-prod-project.iam.gserviceaccount.com" \
--role="roles/secretmanager.secretAccessor"Cloud Key Management Service manages cryptographic keys used to encrypt, decrypt, sign, and verify data. Many Google services can use customer-managed encryption keys when compliance or control requires it.
Artifact Registry stores build artifacts such as Docker images, language packages, and Helm charts. It replaces older Container Registry patterns for many modern projects. A production setup should use regional repositories close to deployment targets, vulnerability scanning where available, IAM-limited push and pull permissions, retention cleanup, and image promotion across environments.
Cloud Build is a managed CI service for building, testing, packaging, and publishing artifacts. A build can run from source repositories, triggers, or manual invocation.
steps:
- name: gcr.io/cloud-builders/docker
args: ["build", "-t", "us-docker.pkg.dev/my-project/apps/api:$SHORT_SHA", "."]
- name: gcr.io/cloud-builders/docker
args: ["push", "us-docker.pkg.dev/my-project/apps/api:$SHORT_SHA"]
images:
- us-docker.pkg.dev/my-project/apps/api:$SHORT_SHATerraform defines Google Cloud resources as code, allowing reviews, repeatable environments, drift detection, and safer changes. Use the Google provider, remote state, service accounts with limited permissions, modules for repeated patterns, and separate state for environments or ownership boundaries.
provider "google" {
project = "my-prod-project"
region = "us-central1"
}
resource "google_compute_network" "app" {
name = "app-vpc"
auto_create_subnetworks = false
}
resource "google_compute_subnetwork" "web" {
name = "web-us-central1"
ip_cidr_range = "10.10.0.0/20"
region = "us-central1"
network = google_compute_network.app.id
}Cloud Logging collects logs from Google Cloud services, applications, and infrastructure. Good logs include request IDs, user or tenant context where safe, severity, operation names, and structured fields.
Cloud Monitoring collects metrics, dashboards, uptime checks, and alerting policies. A practical answer focuses on service-level symptoms: latency, error rate, traffic, saturation, queue age, database connections, CPU, memory, and availability. Good alerts are actionable and tied to user impact.
VPC Service Controls creates security perimeters around supported Google Cloud services to reduce data exfiltration risk. For example, a company can restrict BigQuery and Cloud Storage access so data cannot be copied to an unauthorized project.
Cloud Armor is a web application firewall and DDoS protection service integrated with Google Cloud load balancing. It can enforce IP allowlists or denylists, geo rules, rate limiting, preconfigured WAF rules, and custom expressions.
Identity-Aware Proxy protects access to applications or administrative endpoints based on user identity and context, without requiring a traditional VPN for every case. It is commonly used to secure internal web tools and SSH access to VMs.
Organization policies enforce governance constraints across the resource hierarchy. Examples include disabling service account key creation, restricting allowed regions, requiring shielded VMs, or blocking public IP usage. They are useful for compliance and consistency, but they can surprise teams if applied without communication.
Use budgets and alerts, billing export to BigQuery, labels, committed use discounts where stable, autoscaling, lifecycle rules, rightsizing recommendations, log volume controls, and regular cleanup of idle resources. Tie cost to teams or products so owners can act on it.
Choose regions based on user latency, data residency, service availability, cost, and disaster recovery requirements. Use multiple zones in a region for high availability when the service supports it.
A typical design uses a global external HTTPS load balancer, Cloud Armor, Cloud CDN for static content, serverless or multi-zone compute, a managed database with high availability, private networking, Secret Manager, Cloud Logging, Cloud Monitoring, and automated deployments. Static assets may live in Cloud Storage.
Users
-> HTTPS Load Balancer + Cloud Armor
-> Cloud Run service or GKE service
-> Cloud SQL with HA / Firestore / Spanner
-> Pub/Sub for async work
-> Cloud Storage for objects
-> Cloud Logging + Cloud Monitoring for operationsStart with RTO and RPO. Then configure database backups, object versioning or retention, infrastructure-as-code, cross-region replication where needed, and documented restore runbooks. Test restores regularly because a backup that has never been restored is only an assumption.
Common mistakes include granting Owner or Editor broadly, using downloaded service account keys, exposing databases publicly, opening SSH to the internet, leaving buckets public, mixing production and development in one project, ignoring audit logs, storing secrets in source code, and forgetting egress paths. A strong answer pairs each mistake with a fix: least privilege, private networking, IAP, Secret Manager, organization policies, monitoring, and regular review.
A complete pipeline starts when code is committed. CI tests and scans one build artifact; CD promotes that same artifact through staging and production.
Use curated frontend, Java, Python, or cloud and DevOps packs with 200 questions, model answers, code examples, and a seven-day plan.
Combine four related topic areas into one focused role-preparation path.
Practise explaining code, design decisions, limitations, and failure modes.
Move from baseline review to a timed mock interview and final checklist.
Explore 500+ free tutorials across 20+ languages and frameworks.