Google Cloud Platform interview questions

What a strong answer covers

• Explain Compute Engine as an IaaS offering, providing VMs with full OS control.
• Describe App Engine as a PaaS offering, abstracting infrastructure for application deployment.
• Highlight key differences: level of control, operational overhead, scaling mechanisms, and pricing models.
• Provide use cases for Compute Engine (e.g., custom OS, legacy apps, specific hardware needs).
• Provide use cases for App Engine (e.g., rapid development, web apps, microservices with less infra management).

Where people lose the point

• ×Confusing the level of abstraction, e.g., stating App Engine gives full OS control.
• ×Failing to mention the 'as-a-Service' categories (IaaS vs. PaaS).
• ×Not providing clear examples of when to choose each service.

What a strong answer covers

• List and briefly describe the main Cloud Storage classes: Standard, Nearline, Coldline, Archive.
• Explain the trade-offs between access frequency, availability, and cost for each class.
• Provide typical use cases for Standard (frequently accessed data, active websites).
• Provide typical use cases for Nearline (data accessed less than once a month, backups).
• Provide typical use cases for Coldline and Archive (disaster recovery, long-term archival, compliance).

Where people lose the point

• ×Incorrectly stating the access frequency or retrieval costs for a specific class.
• ×Not mentioning the 'lifecycle management' feature for transitioning between classes.
• ×Confusing the purpose of Coldline vs. Archive, or Nearline vs. Standard.

What a strong answer covers

• Explain primitive roles (Owner, Editor, Viewer) and their broad, project-level permissions.
• Describe predefined roles as fine-grained, service-specific roles (e.g., `compute.admin`, `storage.objectViewer`).
• Explain custom roles, allowing users to define a specific set of permissions.
• Discuss the principle of least privilege and how predefined/custom roles support it.
• Mention how roles are assigned to members (users, groups, service accounts) on resources.

Where people lose the point

• ×Confusing the scope or granularity of primitive vs. predefined roles.
• ×Failing to mention the 'principle of least privilege' as a core IAM concept.
• ×Not explaining *why* custom roles are useful (specific, minimal permissions).

What a strong answer covers

• Explain that VPC firewall rules control traffic to and from Compute Engine instances.
• Describe the components of a firewall rule: direction (ingress/egress), action (allow/deny), source/destination, protocols/ports, and targets.
• Mention that rules are stateful and processed in order of priority (lower number = higher priority).
• Provide a common use case, such as allowing SSH (port 22) or HTTP/HTTPS (ports 80/443) traffic to web servers.
• Explain how network tags can be used to apply rules to specific groups of instances.

Where people lose the point

• ×Incorrectly stating that firewall rules are stateless.
• ×Forgetting to mention the concept of 'targets' (e.g., network tags) for applying rules.
• ×Not explaining the default implicit deny rules for both ingress and egress.

What a strong answer covers

• Define Cloud Pub/Sub as a global, real-time messaging service for asynchronous communication.
• Explain the core components: topics (where publishers send messages) and subscriptions (where subscribers receive messages).
• Highlight its key features: decoupling services, scalability, durability, and at-least-once delivery.
• Describe primary use cases: event ingestion, real-time data processing, fan-out notifications, and reliable asynchronous task execution.
• Mention its role in building event-driven architectures and microservices.

Where people lose the point

• ×Confusing Pub/Sub with a traditional message queue that requires explicit queue management.
• ×Failing to mention the 'at-least-once' delivery guarantee.
• ×Not emphasizing the decoupling aspect between publishers and subscribers.

What a strong answer covers

• Explain GKE as a managed Kubernetes service offering high control and flexibility for container orchestration.
• Describe Cloud Run as a fully managed serverless platform for stateless containers, emphasizing simplicity and automatic scaling.
• Discuss GKE's strengths: complex orchestration, stateful workloads, custom networking, GPU support, multi-cluster management, and deep Kubernetes ecosystem integration.
• Discuss Cloud Run's strengths: rapid deployment, minimal operational overhead, cost-effectiveness for stateless services, event-driven architectures.
• Provide clear scenarios for choosing GKE (e.g., complex microservices, stateful apps, existing Kubernetes expertise) and Cloud Run (e.g., APIs, webhooks, event processors, simple microservices).

Where people lose the point

• ×Suggesting GKE for simple stateless services where Cloud Run would be more efficient.
• ×Overlooking the operational complexity and learning curve associated with GKE.
• ×Not mentioning Cloud Run's limitation to stateless containers or its event-driven nature.

What a strong answer covers

• Define Cloud SQL as a fully managed relational database service for MySQL, PostgreSQL, and SQL Server.
• Define Cloud Spanner as a globally distributed, strongly consistent, relational database service with unlimited scalability.
• Highlight key differences: scalability (vertical for SQL, horizontal for Spanner), consistency model (strong for both, but Spanner globally), cost, and complexity.
• Discuss Cloud SQL's ideal use cases: traditional OLTP, existing relational workloads, smaller to medium-sized applications.
• Discuss Cloud Spanner's ideal use cases: mission-critical applications, global scale, high transactional throughput, strong consistency across regions.

Where people lose the point

• ×Incorrectly stating Cloud SQL offers global horizontal scalability.
• ×Underestimating the cost or operational complexity of Cloud Spanner.
• ×Failing to emphasize Spanner's unique combination of relational structure with global distribution and strong consistency.

What a strong answer covers

• Define a service account as a special type of Google account used by applications or Compute Engine instances, not by individual end-users.
• Explain its purpose: to provide an identity for your applications to authenticate and authorize access to GCP resources.
• Describe how service accounts use IAM roles to grant specific permissions, adhering to the principle of least privilege.
• Discuss the security benefits: avoids embedding user credentials, enables fine-grained access control, and simplifies credential management.
• Provide examples of where service accounts are used (e.g., VM instances, Cloud Functions, GKE pods, CI/CD pipelines).

Where people lose the point

• ×Confusing service accounts with regular user accounts or API keys.
• ×Not emphasizing the 'least privilege' aspect of assigning roles to service accounts.
• ×Failing to explain how they improve security by removing the need for hardcoded credentials.

What a strong answer covers

• Introduce the concept of load balancing for distributing traffic and ensuring high availability.
• Explain Global External Load Balancers (HTTP(S) Load Balancer, SSL Proxy, TCP Proxy) for global traffic distribution.
• Explain Regional External Load Balancers (Network Load Balancer, Internal TCP/UDP Load Balancer) for regional traffic.
• Explain Internal Load Balancers (Internal HTTP(S) Load Balancer, Internal TCP/UDP Load Balancer) for traffic within a VPC network.
• Provide use cases for each type, considering factors like protocol, global vs. regional, and external vs. internal traffic.

Where people lose the point

• ×Confusing external vs. internal load balancers or global vs. regional scope.
• ×Incorrectly assigning protocols (e.g., HTTP(S) Load Balancer for raw TCP traffic).
• ×Not mentioning the benefits of global load balancers for latency and failover across regions.

What a strong answer covers

• Describe BigQuery as a serverless, highly scalable, and cost-effective enterprise data warehouse.
• Explain its columnar storage format and massively parallel processing (MPP) architecture (Dremel).
• Highlight its key features: automatic scaling, built-in machine learning (BigQuery ML), real-time analytics, and separation of compute and storage.
• Provide a typical use case: analyzing large datasets for business intelligence, marketing analytics, or IoT data streams.
• Explain why it excels in this use case (e.g., speed of query execution on petabytes of data, no infrastructure management).

Where people lose the point

• ×Confusing BigQuery with a traditional relational database for OLTP workloads.
• ×Failing to mention its serverless nature or the separation of compute and storage.
• ×Not emphasizing its ability to query petabytes of data quickly without index management.

What a strong answer covers

• Discuss online transfer options: `gsutil` (command-line tool for Cloud Storage), Storage Transfer Service (for scheduled transfers from other clouds/on-prem), and Transfer Appliance (physical appliance for petabyte-scale offline transfer).
• Explain network connectivity options: Cloud VPN (IPsec VPN over public internet) and Cloud Interconnect (dedicated private connection).
• Mention streaming options: Cloud Pub/Sub for real-time data ingestion and Dataflow for ETL pipelines.
• Consider factors influencing choice: data volume, network bandwidth, security requirements, and frequency of transfer.
• Provide specific scenarios for each option, e.g., `gsutil` for smaller ad-hoc transfers, Transfer Appliance for initial large migrations.

Where people lose the point

• ×Only mentioning `gsutil` and overlooking other specialized services for large-scale or offline transfers.
• ×Not differentiating between online and offline transfer methods.
• ×Failing to consider network bandwidth and security as key decision factors.

What a strong answer covers

• Explain the hierarchical structure: Organization > Folders > Projects > Resources.
• Describe the purpose of each level: Organization (root node, central control), Folders (grouping projects, policy inheritance), Projects (billing, resource isolation), Resources (individual services like VMs, buckets).
• Explain how IAM policies are inherited down the hierarchy, enabling consistent policy enforcement.
• Discuss the benefits: centralized management, consistent policy application, billing isolation, and improved security.
• Provide an example of how a policy set at the Folder level would affect projects and resources within it.

Where people lose the point

• ×Confusing the order or purpose of different hierarchy levels.
• ×Failing to explain the concept of policy inheritance.
• ×Not emphasizing the benefits of the hierarchy for large organizations or complex environments.

What a strong answer covers

• Start with a global HTTP(S) Load Balancer for entry point, distributing traffic across regions/zones.
• Utilize Managed Instance Groups (MIGs) with Compute Engine or GKE for stateless web servers, configured for auto-scaling and auto-healing.
• Implement Cloud SQL (for relational data) or Cloud Spanner (for global scale) for the database layer, with replication and failover.
• Incorporate Cloud Storage for static assets and user-generated content, leveraging its global availability and durability.
• Add Cloud CDN for caching static content closer to users, reducing latency and origin load, and Cloud Memorystore for caching frequently accessed data.

Where people lose the point

• ×Omitting key components for high availability (e.g., load balancing, multi-zone/region deployment, database replication).
• ×Not justifying the choice of each service for scalability or availability.
• ×Failing to consider caching strategies (CDN, in-memory cache) for performance.

What a strong answer covers

• Explain Cloud VPN for secure IPsec VPN tunnels over the public internet, suitable for lower bandwidth or initial connections.
• Describe Cloud Interconnect (Dedicated Interconnect or Partner Interconnect) for high-bandwidth, low-latency private connections.
• Detail the setup process for Cloud Interconnect: ordering circuits, establishing BGP sessions, and configuring VLAN attachments.
• Discuss network topology considerations: shared VPC, custom routes, and firewall rules to control traffic flow.
• Mention DNS resolution strategies (Cloud DNS peering) and security best practices (encryption, network segmentation).

Where people lose the point

• ×Only mentioning Cloud VPN and overlooking Cloud Interconnect for enterprise-grade connectivity.
• ×Not explaining the difference between Dedicated and Partner Interconnect.
• ×Failing to address DNS resolution or routing considerations in a hybrid setup.

What a strong answer covers

• Define RTO (Recovery Time Objective) and RPO (Recovery Point Objective) as key metrics for DR planning.
• Discuss backup and restore strategies: Cloud Storage for object backups, Persistent Disk snapshots, Cloud SQL automated backups.
• Explain multi-region deployment for high availability and disaster recovery, using global load balancers and regional failover.
• Detail data replication strategies: Cloud Spanner for global consistency, Cloud SQL read replicas, or custom database replication.
• Outline automated recovery procedures using Infrastructure as Code (e.g., Deployment Manager, Terraform) and CI/CD pipelines for rapid provisioning.

Where people lose the point

• ×Not defining RTO and RPO as fundamental DR metrics.
• ×Failing to consider data replication and consistency across regions.
• ×Overlooking the importance of automated recovery and testing the DR plan.

What a strong answer covers

• Leverage Committed Use Discounts (CUDs) for predictable workloads and Sustained Use Discounts (SUDs) for long-running instances.
• Utilize rightsizing recommendations from Cloud Monitoring to match instance types and sizes to actual usage.
• Implement auto-scaling for Compute Engine MIGs or GKE to scale resources up/down based on demand.
• Choose appropriate Cloud Storage classes based on access frequency and implement lifecycle management policies.
• Optimize database costs by selecting the right service (e.g., Cloud SQL vs. Spanner), using read replicas, and monitoring query performance.

Where people lose the point

• ×Only focusing on compute costs and ignoring storage, networking, or database expenses.
• ×Not mentioning the importance of monitoring and rightsizing resources.
• ×Failing to consider serverless options (Cloud Functions, Cloud Run) for cost-efficiency on intermittent workloads.

What a strong answer covers

• Implement the principle of least privilege using IAM, granting only necessary permissions via predefined or custom roles.
• Utilize service accounts for applications and services, avoiding the use of user credentials for programmatic access.
• Enforce strong network security with VPC firewall rules, VPC Service Controls, and private IP addresses where possible.
• Ensure data encryption at rest (Cloud Storage, Persistent Disk) and in transit (SSL/TLS, Cloud VPN/Interconnect).
• Regularly audit logs (Cloud Logging) for suspicious activity and set up security alerts (Cloud Monitoring).

Where people lose the point

• ×Overlooking the importance of the resource hierarchy for consistent policy application.
• ×Not mentioning data encryption for both at-rest and in-transit data.
• ×Failing to include logging and monitoring as critical components of a security strategy.