1. What is Google Cloud Platform and what are its main service categories?
Google Cloud Platform (GCP) is Google's suite of public cloud services that runs on the same infrastructure as Search and YouTube. It offers compute (Compute Engine, GKE, Cloud Run), storage and databases (Cloud Storage, Cloud SQL, Firestore, Spanner), data and analytics (BigQuery, Pub/Sub, Dataflow), networking, security, and AI/ML services such as Vertex AI. You pay for what you use, and you manage everything through the console, gcloud CLI, APIs, or Terraform.
2. What is a GCP project and why is it important?
A project is the basic organizing unit in GCP: every resource you create belongs to exactly one project. It is the boundary for billing (linked to a billing account), IAM permissions, enabled APIs, and quotas. A project has a name, a globally unique project ID, and a project number, and the ID cannot be changed after creation. Projects sit under folders and an organization in the resource hierarchy.
3. Explain the GCP resource hierarchy.
The hierarchy is Organization, Folders, Projects, and then resources. The organization is the root node tied to a Google Workspace or Cloud Identity domain, folders group projects by team or environment, and projects hold the actual resources. IAM policies and organization policies are inherited downward, so a role granted on a folder applies to every project inside it. Inherited permissions cannot be removed lower down, only added to.
4. What is the difference between regions and zones in GCP?
A region is an independent geographic location such as us-central1, and a zone is an isolated deployment area inside a region, such as us-central1-a. Each region has at least three zones, which act as separate failure domains. For high availability you spread resources across multiple zones in a region, and for disaster recovery or latency you use multiple regions. Some resources are zonal (VMs, disks), some regional (GKE regional clusters, subnets), and some global (VPC networks, global load balancers).
5. What is Compute Engine and what are its common machine type families?
Compute Engine is GCP's IaaS service for running virtual machines with full control over the OS and software. Machine families include general-purpose (E2, N2, N4, C3), compute-optimized (C2), memory-optimized (M-series), and accelerator-optimized (A and G series with GPUs). You can also define custom machine types with your own vCPU and memory counts. VMs are billed per second with sustained and committed use discounts, and Spot VMs offer large discounts for interruptible work.
gcloud compute instances create web-1 \
--zone=us-central1-a \
--machine-type=e2-medium \
--image-family=debian-12 \
--image-project=debian-cloud
6. What are preemptible and Spot VMs, and when would you use them?
Spot VMs are heavily discounted Compute Engine instances (typically 60-91% cheaper) that Google can reclaim at any time when it needs the capacity. They suit fault-tolerant, stateless, or batch workloads such as data processing, CI jobs, and rendering. Spot VMs replace the older preemptible VMs, with no 24-hour maximum runtime. You should handle the shutdown signal and checkpoint work, and avoid them for databases or latency-critical services.
7. What is a managed instance group (MIG)?
A managed instance group is a set of identical VMs created from an instance template and managed as one unit. It provides autoscaling, autohealing through health checks, rolling updates, and regional (multi-zone) deployment. MIGs are typically placed behind a load balancer to serve traffic. Use a MIG instead of individual VMs whenever you need scale or resilience.
8. Compare App Engine, Cloud Run, and Cloud Functions. When would you choose each?
App Engine is a PaaS for web apps in supported runtimes, Cloud Run runs any stateless container on a fully managed serverless platform, and Cloud Functions (now Cloud Run functions) runs single-purpose event-driven code. Choose Cloud Run for most new HTTP services and containerized workloads, functions for small glue code triggered by events like Pub/Sub or Cloud Storage, and App Engine mainly to maintain existing apps. All three scale automatically, including to zero for Cloud Run and functions.
9. What is Cloud Run and how does it scale?
Cloud Run is a managed serverless platform that runs stateless containers and scales them automatically based on incoming requests. It can scale to zero when idle, so you pay only while requests are processed (or for always-allocated CPU if configured). Each instance can handle many concurrent requests, set with the --concurrency flag. You can also run Cloud Run jobs for batch tasks that run to completion.
gcloud run deploy my-api \
--image=us-docker.pkg.dev/my-proj/repo/api:1.0 \
--region=us-central1 \
--allow-unauthenticated \
--max-instances=10
10. What are the triggers for Cloud Functions, and what is a cold start?
Cloud Functions can be triggered by HTTP requests or by events from Pub/Sub, Cloud Storage, Firestore, and other sources through Eventarc. A cold start is the extra latency when a new instance must start because no warm instance is available. You can reduce it by setting minimum instances, keeping dependencies small, and initializing heavy clients in global scope so warm instances reuse them. Newer functions are built on Cloud Run, so these tuning options mirror Cloud Run's.
11. What is Google Kubernetes Engine (GKE)?
GKE is Google's managed Kubernetes service that runs and upgrades the control plane for you. It supports Standard mode, where you manage node pools, and Autopilot mode, where Google manages nodes and you pay per pod resource requests. GKE provides autoscaling, auto-repair, auto-upgrade, and integration with Cloud Load Balancing, IAM, and Cloud Logging. It is a good fit when you need the full Kubernetes API, complex orchestration, or portability.
gcloud container clusters create-auto demo-cluster --region=us-central1
gcloud container clusters get-credentials demo-cluster --region=us-central1
kubectl get nodes
12. What is the difference between GKE Standard and Autopilot?
In Standard mode you choose machine types, configure node pools, and pay for the nodes whether pods fill them or not. In Autopilot, Google provisions and manages nodes, applies hardened defaults, and bills for the CPU, memory, and storage your pods request. Autopilot reduces operational work and wasted capacity but restricts some node-level customization such as privileged pods. Choose Standard when you need that low-level control.
13. What are the storage classes in Cloud Storage?
Cloud Storage offers four classes: Standard for frequently accessed data, Nearline for data accessed about once a month, Coldline for about once a quarter, and Archive for about once a year. All provide the same low latency and durability, but colder classes have lower storage prices, higher retrieval costs, and minimum storage durations (30, 90, and 365 days). Lifecycle rules and Autoclass can move objects between classes automatically.
gsutil mb -l us-central1 gs://my-unique-bucket
gcloud storage cp report.pdf gs://my-unique-bucket/
14. What is the difference between Cloud Storage, Persistent Disk, and Filestore?
Cloud Storage is object storage accessed over HTTP APIs, ideal for unstructured data, backups, and static assets. Persistent Disk is block storage attached to Compute Engine VMs or GKE nodes like a hard drive. Filestore is managed NFS file storage that many VMs can mount at once. Pick based on access pattern: objects, a single-VM block device, or a shared file system.
15. What is Cloud SQL and when would you use Cloud Spanner instead?
Cloud SQL is a managed relational database service for MySQL, PostgreSQL, and SQL Server that handles backups, patching, replication, and failover. It scales vertically and with read replicas, within a single region. Use Cloud Spanner instead when you need horizontal scaling, strong consistency, and relational semantics across regions at very large scale. Cloud SQL is simpler and cheaper for typical application databases.
16. How do you connect securely to a Cloud SQL instance from an application?
The recommended way is the Cloud SQL Auth Proxy or the language connectors, which use IAM-based authorization and encrypt traffic with TLS, so you do not manage IP allowlists or certificates. Alternatively, use a private IP inside your VPC through private services access. Cloud Run and App Engine can connect via built-in Cloud SQL connections. Store credentials in Secret Manager rather than in code.
cloud-sql-proxy my-proj:us-central1:my-db --port 5432
17. What is Firestore and how does it differ from Cloud SQL?
Firestore is a serverless, document-oriented NoSQL database that stores data in collections of documents and scales automatically. It offers real-time listeners, offline support for mobile and web SDKs, strong consistency, and ACID transactions. Unlike Cloud SQL it has no fixed schema and no joins, so you design data around your queries and rely on indexes. Use it for app backends with flexible data, and Cloud SQL for relational data with complex joins.
18. What is BigQuery and why is it fast?
BigQuery is Google's serverless, petabyte-scale data warehouse for running SQL analytics. It is fast because storage and compute are separated, data is stored in a columnar format, and queries are executed in parallel across thousands of slots. You pay either on-demand per bytes scanned or with reserved slot capacity. Partitioning and clustering tables reduces the data scanned and lowers cost.
SELECT country, COUNT(*) AS orders
FROM `my-proj.shop.orders`
WHERE order_date >= '2026-01-01'
GROUP BY country
ORDER BY orders DESC;
19. How do you reduce BigQuery query costs?
Query only the columns you need instead of SELECT *, since on-demand pricing is based on bytes scanned. Partition tables by date or integer range and cluster by commonly filtered columns so queries prune data. Preview costs with a dry run, set maximum bytes billed, and use materialized views or cached results where possible. For heavy predictable workloads, consider capacity (slot) pricing.
20. What is Pub/Sub and what delivery guarantees does it provide?
Pub/Sub is a global, fully managed messaging service that decouples publishers from subscribers using topics and subscriptions. By default it provides at-least-once delivery, so subscribers must handle duplicates idempotently. Subscriptions can be pull, push, or BigQuery and Cloud Storage exports. Features such as ordering keys, dead-letter topics, and an exactly-once option for pull subscriptions are available.
gcloud pubsub topics create orders
gcloud pubsub subscriptions create orders-sub --topic=orders
gcloud pubsub topics publish orders --message="order-42"
21. What is IAM in GCP and how do roles work?
Cloud IAM controls who (a principal) can do what (a role) on which resource. Principals include Google accounts, groups, service accounts, and domains. Roles are collections of permissions and come in three types: basic roles (Owner, Editor, Viewer), predefined roles managed by Google for specific services, and custom roles you define. Follow least privilege by using predefined or custom roles instead of the broad basic roles.
22. What is a service account and how should applications authenticate with it?
A service account is a special non-human identity used by applications and VMs to call Google Cloud APIs. Workloads running on GCP should attach a service account to the resource and use Application Default Credentials, avoiding downloaded key files, which are a security risk. For GKE use Workload Identity, and for external systems like GitHub Actions use Workload Identity Federation. Grant each service account only the roles it needs.
gcloud iam service-accounts create api-sa
gcloud projects add-iam-policy-binding my-proj \
--member="serviceAccount:api-sa@my-proj.iam.gserviceaccount.com" \
--role="roles/storage.objectViewer"
23. What is a VPC in GCP and how is it different from other clouds?
A Virtual Private Cloud is a global, private virtual network that contains regional subnets and controls traffic with firewall rules. Unlike some other clouds, a GCP VPC spans all regions, so VMs in different regions can talk over internal IPs without peering inside the same VPC. Subnets are regional, and routes and firewall rules are defined at the VPC level. Auto mode creates default subnets, while custom mode gives full control over IP ranges.
24. What types of load balancers does GCP offer?
GCP offers global and regional load balancers in application (Layer 7, HTTP/HTTPS) and network (Layer 4, TCP/UDP) forms, each external or internal. The global external Application Load Balancer uses a single anycast IP to route users to the closest healthy backend and supports URL maps, Cloud CDN, Cloud Armor, and managed SSL certificates. Network load balancers are used for non-HTTP protocols and preserve client IPs. Choose based on protocol, scope, and whether traffic is public or internal.
25. How do you set up CI/CD on GCP with Cloud Build?
Cloud Build is a serverless CI/CD service that runs build steps, each in a container, defined in a cloudbuild.yaml file. A trigger connected to a repository (GitHub, Cloud Source Repositories, or others) starts a build on push, which can test code, build an image, push it to Artifact Registry, and deploy to Cloud Run or GKE. Pair it with Cloud Deploy for managed release pipelines across environments.
steps:
- name: 'gcr.io/cloud-builders/docker'
args: ['build', '-t', 'us-docker.pkg.dev/$PROJECT_ID/repo/app:$SHORT_SHA', '.']
- name: 'gcr.io/cloud-builders/docker'
args: ['push', 'us-docker.pkg.dev/$PROJECT_ID/repo/app:$SHORT_SHA']
26. How do you design a highly available, multi-region architecture on GCP?
Run stateless services in at least two regions behind a global external Application Load Balancer, which routes users to the nearest healthy backend and fails over automatically. Use multi-region or dual-region data stores such as Spanner, Cloud Storage multi-region, or Firestore multi-region, because compute failover is useless if data is stuck in one region. Define RTO and RPO first, since they decide whether active-active or active-passive is worth the cost. Test failover regularly.
27. What is Shared VPC and when would you use it instead of VPC Peering?
Shared VPC lets a host project own a VPC network whose subnets are used by resources in multiple service projects, so network and security teams centralize control while app teams keep their own projects. VPC Peering instead connects two separate VPCs privately, and it is non-transitive. Use Shared VPC inside one organization for centralized governance, and peering to connect independent networks or organizations whose IP ranges do not overlap.
28. What is Private Google Access and how does it differ from Private Service Connect?
Private Google Access lets VMs with only internal IPs reach Google APIs and services, such as Cloud Storage and BigQuery, without external IP addresses. Private Service Connect goes further by creating a private endpoint with an internal IP inside your VPC for Google APIs or for services published by other VPCs and vendors. Use Private Google Access for simple egress to Google APIs, and Private Service Connect when you need a dedicated internal IP, cross-VPC service publishing, or tighter control.
29. How can a VM without an external IP access the internet?
Use Cloud NAT, a managed, software-defined NAT service that lets instances with only private IPs make outbound connections while blocking unsolicited inbound traffic. It is configured on a Cloud Router per region and VPC, with no proxy VMs to manage. Watch the number of NAT ports allocated per VM, because exhausting them causes dropped connections under heavy outbound load. Increase the minimum ports per VM or add NAT IPs if that happens.
gcloud compute routers create nat-router --network=my-vpc --region=us-central1
gcloud compute routers nats create my-nat --router=nat-router \
--region=us-central1 --auto-allocate-nat-external-ips \
--nat-all-subnet-ip-ranges
30. What are organization policies and how do they differ from IAM?
IAM controls who can do what, while organization policies set constraints on what is allowed at all, regardless of who asks. For example, you can restrict resource locations, block service account key creation, or disallow external IPs on VMs. Policies are set on the organization, a folder, or a project and are inherited downward. Together they give guardrails: IAM grants access, and org policy limits the possible configurations.
31. How would you securely give a GitHub Actions pipeline access to GCP without service account keys?
Use Workload Identity Federation: create a workload identity pool and an OIDC provider that trusts GitHub, then let the pool's identity impersonate a service account. The workflow exchanges its short-lived GitHub OIDC token for a Google access token, so no long-lived key is stored in secrets. Add an attribute condition restricting the repository or branch, otherwise any repo from that provider could assume the account.
32. How do you manage secrets in GCP and how do you rotate them?
Store secrets in Secret Manager, which provides versioning, IAM per secret, audit logging, and optional customer-managed encryption keys. Applications read a specific version or latest at runtime, and Cloud Run and GKE can mount secrets directly. For rotation, add a new version, deploy consumers to use it, then disable and destroy the old version. Configure rotation schedules that publish Pub/Sub notifications to trigger automation.
echo -n "s3cr3t" | gcloud secrets create db-pass --data-file=-
gcloud secrets versions access latest --secret=db-pass
33. What is Cloud KMS and what is the difference between CMEK and Google-managed encryption?
Cloud KMS is a managed service for creating and controlling cryptographic keys. By default, GCP encrypts all data at rest with Google-managed keys at no effort. With customer-managed encryption keys (CMEK), you hold the key in Cloud KMS, control its rotation, and can disable it to make data unreadable, which helps with compliance. Customer-supplied keys (CSEK) go further but you must provide the key on every request. CMEK adds operational duty and key cost.
34. What are VPC Service Controls and what problem do they solve?
VPC Service Controls create a security perimeter around Google-managed services like BigQuery and Cloud Storage to reduce the risk of data exfiltration. Even a user with valid IAM permissions cannot copy data out of the perimeter to a project outside it. You define perimeters, access levels, and ingress and egress rules. Test with dry-run mode first, because a misconfigured perimeter can break pipelines and cross-project integrations.
35. How do you control costs in GCP and avoid surprise bills?
Set budgets and alerts on billing accounts, and export billing data to BigQuery to analyze spend by project, label, and service. Use labels consistently, rightsize VMs with recommender suggestions, and apply committed use discounts for steady workloads and Spot VMs for batch work. Delete idle resources, use lifecycle rules on storage, and set quotas or maximum instances. Note that budgets only alert by default and do not stop spending unless you automate a response.
36. What is the difference between committed use discounts and sustained use discounts?
Sustained use discounts are applied automatically when certain VM types run for a large part of the month, with no commitment. Committed use discounts require a one- or three-year commitment to a resource amount (resource-based) or to a spend level (flexible, spend-based) in exchange for a larger discount. Sustained use discounts do not apply to newer families like E2, so for steady workloads committed use is the dependable way to save. Commit only for baseline usage you are sure to keep.
37. How would you migrate an on-premises database to Cloud SQL with minimal downtime?
Use Database Migration Service for continuous replication: it takes an initial snapshot, then streams ongoing changes from the source to a Cloud SQL replica. Once lag is near zero, you stop writes briefly, let the replica catch up, promote it, and switch the application connection. Check version compatibility, networking (VPN or Interconnect), and test the cutover in a rehearsal first. Keep the source available for rollback until you are confident.
38. How do you connect an on-premises network to GCP and what are the options?
There are three main options: Cloud VPN, which uses encrypted IPsec tunnels over the internet; Dedicated Interconnect, a physical connection at a colocation facility; and Partner Interconnect through a service provider. Cloud VPN is quick and cheap, with HA VPN offering a 99.99% SLA. Interconnect gives higher bandwidth, lower latency, and more predictable performance. All use Cloud Router with BGP for dynamic route exchange. Choose based on bandwidth, latency, and budget.
39. How do you troubleshoot a GKE pod stuck in Pending or CrashLoopBackOff?
For Pending, run kubectl describe pod and read the Events: typical causes are insufficient CPU or memory on nodes, unsatisfied node selectors or taints, or an unbound PersistentVolumeClaim. For CrashLoopBackOff, check kubectl logs --previous for the crashed container, and look for bad config, missing secrets, failing probes, or out-of-memory kills. Also review Cloud Logging and cluster autoscaler status.
kubectl describe pod my-pod
kubectl logs my-pod --previous
kubectl get events --sort-by=.lastTimestamp
40. What is Workload Identity in GKE and why is it better than node service accounts?
Workload Identity maps a Kubernetes service account to a Google service account, so each pod gets its own short-lived credentials for calling GCP APIs. Without it, every pod on a node shares the node's service account, which violates least privilege and widens the blast radius of a compromised pod. With it, you grant narrow IAM roles per workload and need no key files. It is the recommended way to authenticate GKE workloads.
41. How do you optimize BigQuery performance beyond partitioning and clustering?
Avoid cross-joining or joining huge tables without filters, filter early, and use approximate aggregation functions like APPROX_COUNT_DISTINCT when exact counts are not required. Denormalize with nested and repeated fields (STRUCT and ARRAY) to avoid expensive joins, and use materialized views for repeated aggregations. Check the query execution graph for skew and spilled stages. Avoid ORDER BY on large results without LIMIT, and prefer the Storage Write API for efficient streaming ingestion.
42. When would you use Dataflow versus Dataproc?
Dataflow is a serverless service that runs Apache Beam pipelines for batch and streaming, with autoscaling and no cluster management. Dataproc is managed Hadoop and Spark, best when you already have Spark or Hadoop jobs to migrate or need ecosystem tools. Choose Dataflow for new streaming pipelines, such as Pub/Sub to BigQuery, with exactly-once processing. Choose Dataproc for lift-and-shift of existing Spark code, using ephemeral clusters to control cost.
43. How do you handle failed messages in Pub/Sub so a bad message does not block processing?
Configure a dead-letter topic on the subscription with a maximum delivery attempts value, so messages that repeatedly fail are forwarded there instead of being retried forever. Add exponential backoff as the retry policy to avoid hammering a failing downstream system. Make consumers idempotent because delivery is at-least-once. Monitor the dead-letter subscription and alert on its backlog, then fix and replay messages as needed.
gcloud pubsub subscriptions update orders-sub \
--dead-letter-topic=orders-dlq \
--max-delivery-attempts=5
44. How do you do a safe deployment with traffic splitting on Cloud Run?
Each deploy creates a new revision, and you can deploy it with no traffic, then shift a percentage gradually while watching error rates and latency. If metrics degrade, route 100% back to the previous revision instantly, since revisions are immutable. Tagging a revision also gives it a dedicated URL for testing before any real users hit it. This gives canary and blue-green releases without extra infrastructure.
gcloud run deploy api --image=IMAGE --no-traffic --tag=canary
gcloud run services update-traffic api --to-tags=canary=10
45. What are the main observability tools in GCP and how do they fit together?
Cloud Logging collects and queries logs, Cloud Monitoring handles metrics, dashboards, uptime checks, and alerting, Cloud Trace shows distributed request latency, and Error Reporting groups application exceptions. Log-based metrics turn log patterns into alertable metrics, and log sinks export logs to BigQuery, Storage, or Pub/Sub for long retention or analysis. Use SLOs and alerting policies on symptoms such as error rate and latency rather than on every low-level resource metric.
46. How do you reduce log ingestion costs in Cloud Logging?
Use exclusion filters on the _Default sink to drop noisy, low-value logs such as health checks and debug output before they are stored. Route high-volume logs to Cloud Storage or BigQuery through sinks instead of keeping them in log buckets with long retention. Adjust retention periods per bucket, and fix applications that log excessively. Audit logs for admin activity are free and always on, while data access logs can be costly, so enable them selectively.
47. How would you serve a static website globally with HTTPS on GCP?
Put the files in a Cloud Storage bucket, then create a global external Application Load Balancer with a backend bucket pointing to it, a Google-managed SSL certificate, and Cloud CDN enabled for edge caching. Point your domain's DNS A record to the load balancer's anycast IP. This gives HTTPS, a custom domain, and low latency worldwide. Firebase Hosting is a simpler alternative if you do not need the load balancer features.
48. What is Cloud Armor and how do you protect an application from DDoS and common attacks?
Cloud Armor is a network security service that works with the global external Application Load Balancer to filter traffic at the edge. It provides always-on DDoS protection, preconfigured WAF rules for threats like SQL injection and XSS, IP and geography allow or deny lists, and rate limiting. Create a security policy with prioritized rules and attach it to a backend service. Run new rules in preview mode first to avoid blocking legitimate users.
49. What is Infrastructure as Code on GCP, and why use Terraform over clicking in the console?
Infrastructure as Code defines resources in version-controlled files, so environments are reproducible, reviewable, and auditable. Terraform is the most common choice on GCP, using the Google provider, a plan step to preview changes, and state to track resources. Compared with console clicks, it prevents configuration drift and makes recreating dev, staging, and production consistent. Store state remotely in a Cloud Storage bucket with locking, and never commit secrets.
resource "google_storage_bucket" "assets" {
name = "my-assets-bucket"
location = "US"
uniform_bucket_level_access = true
}
50. How would you design a secure, cost-effective data pipeline from app events to analytics on GCP?
Publish events to Pub/Sub, process them with a Dataflow streaming job (or a BigQuery subscription for simple cases), and land the results in partitioned, clustered BigQuery tables. Archive raw events to Cloud Storage for replay and cheap long-term retention. Secure it with dedicated least-privilege service accounts, CMEK if required, and VPC Service Controls. Control cost with partition expiration, dead-letter topics, and monitoring on backlog and slot usage.