Most Google Cloud interviews test the same handful of ideas: who can do what (IAM), where things live (the resource hierarchy and networking), which service fits which workload, and how you keep cost and risk under control. The product names change often; those ideas do not.
Below are the questions that come up most, grouped by level. Each model answer is short enough to say aloud in about a minute, and each one is checked against Google’s current documentation. Where a question is really a design discussion, we say so, because a one-line answer will not be enough.
How to use these answers
- Freshers and career changers: focus on the first two sections. Interviewers expect accurate definitions and one example of where you would use each service.
- Experienced engineers: the later sections matter more. You will be asked to choose between options and defend the trade-off, often with follow-up questions on security and cost.
- Everyone: say what you have actually built. “I partitioned a BigQuery table by event date and query cost dropped” is worth more than a perfect definition.
Foundations: questions for freshers
1. What is the Google Cloud resource hierarchy?
Model answer: Resources are organised in a tree. The organisation is the root node, folders sit beneath it to group projects (often by department or environment), projects contain the actual resources, and resources such as VMs, buckets and datasets sit inside projects. The hierarchy matters because access policies set on a parent apply to everything beneath it.
What they are checking: whether you understand that structure drives access control and billing, not just tidiness.
2. How does IAM inheritance work?
Model answer: If you set an allow policy on a container such as a folder, it also applies to every resource in that container. The access a principal actually has on a resource is the union of the policy on that resource and the policies on all its ancestors; Google calls this the effective allow policy. So you cannot take away at project level a role that was granted at folder level. If you need to block a permission regardless of grants, that is what deny policies are for.
3. What is the difference between basic, predefined and custom roles?
Model answer: Basic roles are very broad and cover thousands of permissions. Google now lists Admin, Writer and Reader as the current basic roles, with Owner, Editor and Viewer as the legacy versions. Predefined roles are created and maintained by Google for specific services. Custom roles are bundles of permissions you define yourself, at organisation or project level but not at folder level. Google’s guidance is not to grant basic roles in production unless there is no alternative; use the narrowest predefined or custom role that does the job.
Tip: many study guides still describe only Owner, Editor and Viewer. Mentioning the newer names shows you read current documentation.
4. What is a principal, and what is a service account?
Model answer: A principal is any identity that can be granted access. Human principals include Google Accounts, Google groups and federated identities. Workload principals include service accounts and federated identities in a workload identity pool. A service account is an identity for an application or VM rather than a person, so the workload can call Google Cloud APIs with only the permissions it needs.
5. Name the Cloud Storage classes and when you would use each.
| Class | Minimum storage duration | Retrieval fee | Typical use |
|---|---|---|---|
| Standard | None | None | Frequently accessed (“hot”) data |
| Nearline | 30 days | Yes | Data read about once a month or less |
| Coldline | 90 days | Yes | Data read at most once a quarter |
| Archive | 365 days | Yes | Data accessed less than once a year |
Model answer: pick the class by how often the data is read, not just how much it costs to store. A common follow-up: “Is Archive data slow to retrieve?” No. Google states that all classes have low latency and Archive data is available within milliseconds; the trade-off is retrieval cost and minimum duration, not speed.
6. Is a VPC network regional or global?
Model answer: VPC networks are global resources; subnets are regional. An auto mode network creates a subnet in each region automatically. A custom mode network starts with no subnets, so you decide which regions and IP ranges to use. Custom mode is also required if you need IPv6 subnet ranges.
Why it matters: candidates coming from AWS often assume networks are regional. Getting this right early in the interview builds credibility.
7. Compute Engine, GKE or Cloud Run: what is each?
Model answer: Compute Engine is Google Cloud’s core infrastructure-as-a-service platform: you run VMs or bare metal and control the operating system, but you also own scaling and reliability set-up. GKE is managed Kubernetes for container orchestration. Cloud Run is a serverless platform for containers where Google manages the infrastructure, including capacity.
Applied questions: the middle of most interviews
8. When would you choose GKE Autopilot over Standard?
Model answer: In both modes Google manages the control plane. In Autopilot, Google also manages the nodes and capacity, so it suits teams that want Kubernetes without node-pool administration. In Standard, you manage node pools yourself, which you might want for specific machine types or tight control over node configuration. I would ask what the team needs to control before choosing.
9. When is Cloud Run a better fit than GKE?
Model answer: When the workload is a stateless containerised web service, API or batch job and the team does not need cluster-level orchestration. Cloud Run services scale instances with incoming requests or CPU use, and Cloud Run jobs handle asynchronous or batch tasks. If the system needs many interdependent services with custom networking, operators or sidecars, GKE is usually the stronger fit.
10. How does BigQuery partitioning reduce cost?
Model answer: A partitioned table is split into segments on one column. When a query filters on that column, BigQuery reads only the matching partitions, so fewer bytes are scanned and cost falls. Partitions can be based on a time-unit column (DATE, TIMESTAMP or DATETIME), on ingestion time, or on an integer range. The partitioning column is chosen when the table is created.
An illustrative query that benefits from pruning on a table partitioned by event_date:
SELECT user_id, COUNT(*) AS sessions
FROM analytics.events
WHERE event_date BETWEEN '2026-10-01' AND '2026-10-31'
GROUP BY user_id;11. When would you cluster rather than partition?
Model answer: Google’s documentation suggests clustering when you need finer granularity than partitions give, when queries filter on several columns, when the column has high cardinality, or when partitioning would leave only small amounts of data per partition (roughly under 10 GB). You can also combine both: partition by date, cluster by customer ID.
12. What delivery guarantee does Pub/Sub give by default?
Model answer: At-least-once delivery with no ordering guarantee. Subscribers must acknowledge each message within the acknowledgement deadline or Pub/Sub may redeliver it. So consumers should be idempotent. If order matters, use ordering keys; if duplicates are unacceptable, Pub/Sub also offers exactly-once delivery as an option.
What they are checking: whether you design for duplicates. Saying “I would make the handler idempotent, for example by recording processed message IDs” is the answer they want.
13. What subscription types does Pub/Sub support?
Model answer: Pull, where the subscriber requests messages; push, where Pub/Sub sends requests to your endpoint; and export subscriptions that write directly to BigQuery or Cloud Storage (with Bigtable in preview at the time of writing).
Experienced: security and design questions
14. A pod on GKE needs to read from a Cloud Storage bucket. How do you give it access?
Model answer: Use Workload Identity Federation for GKE, so the Kubernetes workload gets its own identity and IAM grants, with no key file. The alternatives both have problems: relying on the node’s service account means every workload on that node shares the same permissions, which tends to over-provision access, and exported service account keys are a security risk if they are not managed carefully because you become responsible for protecting the private key.
15. A developer has Editor on the production project. What would you change?
Model answer: I would replace the basic role with the narrowest predefined roles for the services they actually touch, probably granted to a group rather than the individual, and check where the grant sits in the hierarchy, because a grant at folder level would still apply. If certain permissions must never be used in production, a deny policy can block them regardless of other grants.
16. How would you lay out projects and folders for a company with dev, test and production?
This is a design discussion. A strong answer covers: separate projects per environment so blast radius and billing are isolated; folders for business units or environments so policies can be set once; groups rather than individuals in IAM bindings; and a note that, because effective policy is a union, broad grants high in the tree are hard to undo lower down.
17. Two teams in different projects need private connectivity. What are your options?
Model answer: Shared VPC if the organisation wants one central team to own the network and let service projects attach to it; VPC Network Peering if the two networks should stay separately administered. I would ask about IP range overlap first, because overlapping ranges complicate peering.
Note: treat this as an opening for discussion. Interviewers usually push on who owns firewall rules and how routes are shared.
18. Logs must be kept for seven years but are almost never read. Where do you put them?
Model answer: Archive storage class in Cloud Storage, because it is designed for data accessed less than once a year and still returns data in milliseconds. I would check the 365-day minimum storage duration and retrieval fees against the access pattern, and use lifecycle rules to move objects from Standard as they age.
19. A BigQuery bill doubled last month. How do you investigate?
Expect follow-ups here. A sound answer: find the most expensive queries and who ran them, check whether large tables are partitioned and whether queries filter on the partition column, look for SELECT * on wide tables, and consider clustering for frequently filtered columns. Close by saying how you would stop it recurring, for example with review of scheduled queries.
20. How would you migrate a VM-based web app to Google Cloud?
No single right answer. Interviewers listen for a staged approach: lift to Compute Engine first if speed matters, then containerise and move to Cloud Run or GKE once the app is stateless; move state to managed services; and set up IAM, networking and monitoring before cutover. Name the risks you would test: data migration, DNS cutover and rollback.
21. Which Google Cloud certification do you hold, and what did it change in your work?
If you hold one, link it to practice. For context, Google’s Professional Cloud Architect page (checked November 2026) describes a two-hour exam of 50 to 60 multiple-choice and multiple-select questions, including two case studies that make up 20 to 30 percent of the exam, with a recommended three or more years of industry experience including at least one year on Google Cloud. The certification is valid for two years. Certification shows study; interviewers still want to hear what you built.
Common mistakes in GCP interviews
- Treating AWS knowledge as transferable word for word. Global VPCs and the folder-based hierarchy behave differently from what many AWS users expect.
- Granting broad roles in answers. If your design hands out Editor, expect the interviewer to stop you.
- Forgetting duplicates in messaging. At-least-once delivery means your consumer must cope with the same message twice.
- Choosing storage on price per gigabyte alone. Minimum durations and retrieval fees can make a “cheap” class expensive.
Putting it on your CV
Interview questions often start from your CV, so list the specific services you have used and what changed because of them, such as reduced query cost, faster deployments or tighter access. Our software engineer resume builder has sections for cloud projects and certifications, and you can run the finished file through the ATS resume score checker to see whether it reads cleanly. For broader questions about formatting technical CVs, see our resume questions hub.
Frequently asked questions
What GCP topics should a fresher focus on first?
The resource hierarchy, IAM roles and inheritance, Cloud Storage classes, VPC basics, and the difference between Compute Engine, GKE and Cloud Run. These come up in almost every entry-level interview.
Are GCP interview questions for experienced candidates mostly theory?
No. Experienced candidates usually get design and troubleshooting questions, such as reducing a BigQuery bill or giving a workload least-privilege access, followed by probing questions on the trade-offs.
Do I need a Google Cloud certification to get a cloud job?
Not always. A certification shows structured study, but interviewers still test what you have built. A small, well-explained project can carry as much weight.
How do I answer a GCP question I do not know?
Say what you do know, reason from first principles, and explain how you would check, for example by reading the service’s documentation. Guessing a product feature confidently is riskier than admitting a gap.
Sources
- IAM overview (Google Cloud documentation)
- Roles and permissions overview (Google Cloud documentation)
- Storage classes (Google Cloud documentation)
- Subnets (Google Cloud documentation)
- Choose compute options (Google Cloud documentation)
- Introduction to partitioned tables (Google Cloud documentation)
- Subscription overview (Google Cloud documentation)
- About Workload Identity Federation for GKE (Google Cloud documentation)
- Professional Cloud Architect certification (Google Cloud)