# Interview Questions: GCP Cloud Engineer Foundations

# Part 1 Questions: Fundamentals & Resource Hierarchy

## Conceptual

### 1. What are the three identifiers every GCP project has, and which one is permanent?
Project ID (permanent, globally unique), project name (mutable display label), and project number (auto-assigned, used internally). Only the Project ID cannot be changed after creation.

### 2. How does GCP's VPC model differ structurally from AWS's or Azure's?
A GCP VPC is global by default — one VPC can have subnets in every region on Earth with no peering or transit gateway required to route between them. AWS VPCs and Azure VNets are both scoped to a single region.

### 3. What's the difference between an org policy and IAM?
Org policies control what resources can exist or be configured, regardless of who's asking. IAM controls who can perform which actions. A user with full IAM permissions still cannot violate an active org policy.

### 4. Why doesn't a new org policy retroactively fix existing violating resources?
Org policies only block *new* violations going forward — they don't scan for or remediate resources that already violated the constraint before it was added.

### 5. What's the difference between labels, network tags, and Resource Manager tags?
Labels are free-form annotations for cost tracking/filtering (can't gate policies). Network tags target firewall rules. Resource Manager tags are IAM-governed and can conditionally enforce org policies or IAM conditions.

### 6. What happens when you delete a GCP project?
It enters a 30-day PENDING_DELETION state, recoverable via `gcloud projects undelete`, before being permanently purged.

## Applied / Scenario

### 7. A project owner can't create a VM despite having `roles/compute.admin`. What's the most likely cause?
The Compute Engine API likely isn't enabled in that project — API enablement and IAM permission are independent gates. Check with `gcloud services list --enabled`.

### 8. Why should a resource hierarchy be designed around policy/IAM boundaries rather than an org chart?
A folder that mirrors reporting structure but shares identical policies with its sibling adds hierarchy depth with no governance benefit, making inheritance harder to reason about during an incident for no real gain.

### 9. Your finance team wants clean per-team cost attribution across all projects immediately. What's the fastest correct mechanism?
Labels — they're free-form, queryable in Cloud Billing immediately, and need no IAM setup. Resource Manager tags require org-level setup overhead not justified for simple cost attribution.

### 10. Why is a Resource Manager tag exception at a folder level (e.g., relaxing a public-IP restriction for Non-Production) preferable to setting it at each individual project?
A folder-level exception applies to every current and future project under it automatically — setting it per-project requires re-authoring the exception for every new project created.

# Part 2 Questions: Billing, gcloud CLI & Infrastructure Tooling

## Conceptual

### 11. What's the difference between self-serve and invoiced Cloud Billing accounts?
Self-serve charges automatically via card on a monthly or threshold cycle. Invoiced billing accrues costs and issues a monthly invoice paid by check/bank transfer, typically set up through a Google sales relationship.

### 12. Does a budget alert stop spending?
No — by default, a budget only sends alerts (email, Monitoring channel, or Pub/Sub). Only a Pub/Sub-triggered automation can actually act to stop spending.

### 13. Why is Deployment Manager not a recommended starting point for new IaC work?
It's deprecated, with support ending April 2026 and full service turn-down after June 2027. Terraform or Infrastructure Manager are the current supported paths.

### 14. What's the difference between Terraform and Infrastructure Manager?
They use identical Terraform configuration — Infrastructure Manager is Google's own managed runner executing that same Terraform through Cloud Build, with state kept in a Google-managed Cloud Storage location, removing the need to operate your own runner/backend.

### 15. Why should Terraform state live in a remote backend rather than a local file?
Local state means only one machine can safely apply, with no locking — two people applying concurrently can corrupt or conflict over the same state. Remote (GCS) backends add real locking.

## Applied / Scenario

### 16. A team wants to split billing accounts by environment (prod/non-prod) for cost visibility. Is this the right move?
No — labels already solve per-environment cost visibility via billing export. Splitting billing accounts adds real operational overhead without solving a problem labels don't already address.

### 17. A Terraform apply fails with a permission-denied-shaped error even though the service account has `roles/compute.admin`. What else should be checked?
Whether the relevant API (e.g., `compute.googleapis.com`) is actually enabled in the project — an unclear error can look like a permissions issue but actually be a missing API enablement.

### 18. Why does Google Cloud's own Cloud Function example for automating a budget response deliberately scope to one named project rather than "any project over budget"?
An automated billing-disable action is destructive — scoping broadly risks accidentally disabling billing for a production project with a real SLA, when the intent was only a non-critical dev/test safety net.

# Part 3 Questions: IAM & Identity

## Conceptual

### 19. Why should IAM roles be granted to groups rather than individuals?
Onboarding/offboarding becomes a group-membership change instead of an IAM-policy audit across every resource a person ever touched — a departed employee's access is revoked as a side effect of removing them from a group.

### 20. What are the three IAM role tiers, and which should be avoided in production?
Primitive (Owner/Editor/Viewer — avoid, extremely broad), Predefined (Google-maintained, service-scoped — the default choice), and Custom (exact permissions, but you maintain it).

### 21. What's the difference between a service account and an AWS IAM role?
A GCP service account is a real, persistent identity with its own email and its own IAM policy governing who can act as it. An AWS IAM role has no independent existence outside being assumed — a genuine structural difference, not just naming.

### 22. What's the difference between impersonation and Workload Identity Federation?
Impersonation lets an already-authenticated principal (a human) temporarily act as a service account. Workload Identity Federation lets an external workload (CI/CD, another cloud) exchange its own native identity for a GCP token — neither requires a downloaded key file.

### 23. What is a deny policy, and how does it differ from careful IAM role scoping?
A deny policy is a hard "no" for specific permissions, evaluated before and overriding any allow grant, regardless of future role changes. Careful scoping reduces the chance of over-permission today but doesn't guarantee against a future mistake reintroducing it.

## Applied / Scenario

### 24. A new engineer needs Cloud SQL access in staging for exactly one week. What's the best mechanism?
An IAM condition with a time-based expression (`request.time <`) — it expires automatically with no human remembering step required, unlike a plain binding plus a calendar reminder.

### 25. A CI/CD pipeline currently uses a downloaded service account key. What's the migration path to remove it?
Set up Workload Identity Federation: create a workload identity pool and OIDC provider trusting the CI platform's issuer, grant the target service account's `roles/iam.workloadIdentityUser` to the federated principal (scoped narrowly via an attribute condition), update the pipeline config, then revoke the old key.

### 26. Why does an unscoped `--attribute-condition` on a Workload Identity Federation provider undermine its security benefit?
Without it, the provider trusts any token the external issuer signs org-wide — potentially broader access than the single key file it replaced, even though no key file exists anymore.

# Part 4 Questions: Compute Engine & Autoscaling

## Conceptual

### 27. What's the difference between E2, N4, and C4 machine families?
E2 optimizes for cost efficiency (general-purpose, budget-sensitive workloads). N4 is the current balanced price/performance default. C4 optimizes for maximum single-thread performance and very high vCPU counts, at a real cost premium.

### 28. Why is manually editing a running instance inside a managed instance group a mistake?
MIG instances are disposable by design — the next rolling update, autoscaling event, or health-check-triggered recreation silently discards the manual change, since the instance template is the real source of record.

### 29. What's the trade-off of running a workload entirely on Spot VMs?
Deep discount (60-91% off) in exchange for reclaimable capacity with only 30 seconds' notice — appropriate only for workloads specifically designed to tolerate interruption, never as a full fleet with no reliable floor.

### 30. Why does the autoscaler take the largest recommendation across multiple signals rather than averaging them?
It biases toward availability over cost when signals disagree — averaging could under-provision relative to whichever signal is correctly detecting real strain.

## Applied / Scenario

### 31. A GPU-attached instance can't use live migration. What must be configured instead, and why?
`--maintenance-policy=TERMINATE` — GPU hardware can't be transparently migrated between hosts, so the workload needs its own restart/checkpoint strategy instead of relying on seamless host maintenance.

### 32. A fleet's minimum autoscaling replica count is set to zero, and the fleet size oscillates constantly during steady traffic. What's the likely cause and fix?
A metric averaged across very few instances is statistically noisy — raising the minimum replica floor stabilizes the signal the autoscaler reads, independent of any actual capacity need.

### 33. A golden image was refreshed twice, but some running instances still show the old software version. Why, and what fixes it without forcing a fleet-wide recreation?
A golden image only affects instances created after the refresh — already-running instances that haven't been recreated never pick it up. OS Config Management in enforcement mode continuously corrects drift on already-running instances.

# Part 5 Questions: GKE & Serverless Compute

## Conceptual

### 34. What's the core trade-off between GKE Autopilot and Standard mode?
Autopilot: Google manages nodes entirely, billed per-pod resource consumption, operationally simpler. Standard: you manage node pools/machine types fully, billed for full VM capacity — cheaper above roughly 60-70% sustained utilization, required for privileged workloads Autopilot doesn't support.

### 35. What does the 2026 hybrid ComputeClass option solve?
It lets specific workloads inside an otherwise-Standard cluster opt into Autopilot-managed nodes, so one workload's hard requirement (needing Standard) doesn't force every other workload in the cluster to lose Autopilot's simplicity.

### 36. Why does every Cloud Run deployment create a new revision rather than mutating a running one?
It's what makes traffic splitting, gradual canary rollouts, and instant rollback possible — both the old and new revision exist simultaneously, and traffic assignment is a separate, explicit routing decision.

### 37. What's the trade-off of Cloud Run's scale-to-zero?
Cost savings for idle time, at the cost of a cold start (container pull, boot, dependency init) on the first request after idle — unacceptable for a customer-facing service, fine for an internal, rarely-used tool.

## Applied / Scenario

### 38. A Cloud Run canary at 10% traffic shows an elevated error rate five minutes in. What's the fastest correct response?
Reassign 100% of traffic back to the previous stable revision — an instant routing change, since the previous revision never stopped running.

### 39. A team wants to run every workload on GKE Standard "for simplicity of one platform." What's the flaw?
It optimizes for platform-count simplicity over workload-fit — a spiky HTTP API loses Cloud Run's scale-to-zero and instant rollback, event-driven work loses Eventarc's purpose-built integration, and steady batch work likely runs more expensively than on Compute Engine with Spot capacity.

# Part 6 Questions: Storage & Managed Databases

## Conceptual

### 40. What's the ACE-relevant default database choice, and when should you look elsewhere?
Cloud SQL is the safe default for relational workloads. Look elsewhere only against a specific, measured requirement: AlloyDB for a proven analytical/transactional performance bottleneck, Spanner for genuine global distribution with strong consistency.

### 41. Why can't Autoclass and manual lifecycle rules coexist on the same Cloud Storage bucket?
They represent different guarantees — Autoclass optimizes cost against observed access patterns; manual rules guarantee exact minimum-duration timing for compliance needs. A bucket needs one guarantee or the other, not both simultaneously.

### 42. Why is BigQuery's cost model fundamentally different from a typical relational database's?
BigQuery bills primarily by data scanned per query, not by provisioned infrastructure — an unpartitioned table forces every query to scan its full history, directly driving cost, unlike index-based relational performance tuning.

### 43. Why does deleting a CMEK key have a more severe consequence than deleting a database backup?
A destroyed CMEK key makes its encrypted data permanently unreadable, including by Google — it's not recoverable the way a backup restore is, making key management as critical as the database itself.

## Applied / Scenario

### 44. Read-replica replication lag worsens whenever analytics runs complex ad-hoc queries against it. What's the correct next step?
Evaluate AlloyDB — the actual problem (analytical query performance against transactional data, in one region) is exactly what it's built for, without reaching for Spanner's unneeded global-distribution complexity.

### 45. A compute fleet autoscales successfully to handle a traffic spike, but the database starts rejecting connections. What's the likely cause?
Connection exhaustion — each new instance opening its own direct connection pool multiplies total database connections past its configured limit, independent of the database's actual CPU/query load. Connection pooling (e.g., Cloud SQL's built-in pooled PgBouncer) is the fix.

# Part 7 Questions: Networking Fundamentals

## Conceptual

### 46. What's the difference between Shared VPC and VPC Peering?
Shared VPC centralizes one network under a host project, consumed by multiple service projects under common management. Peering connects two genuinely separate, independently-managed VPCs without merging administration.

### 47. Why is peering not transitive?
If A peers with B and B peers with C, A cannot reach C through B — a direct A-C peering is required, since each peering relationship is independently established.

### 48. What's the difference between Cloud NAT and Private Google Access?
Cloud NAT provides general outbound internet access for no-public-IP resources. Private Google Access is scoped specifically to reaching Google APIs (Cloud Storage, BigQuery) over Google's internal network — narrower, but doesn't require NAT translation.

### 49. Why can't a Network Load Balancer implement HTTP path-based routing?
It operates at Layer 4, with no visibility into HTTP semantics like paths or headers — only an Application Load Balancer (Layer 7) understands HTTP well enough to route on request content.

## Applied / Scenario

### 50. A correctly-scoped, service-account-targeted firewall rule causes every load balancer health check to fail. Why?
Health checks originate from Google's own load-balancer infrastructure IP ranges, not from any application identity — an explicit rule allowing those documented ranges is needed alongside the application-traffic rule.

### 51. Two teams want private connectivity but each insists on independently managing their own network. Shared VPC or Peering?
Peering — Shared VPC requires centralizing network management in one host project, which conflicts with both teams wanting independent control.

# Part 8 Questions: Monitoring, Logging & Operations

## Conceptual

### 52. What's the difference between Admin Activity and Data Access audit logs?
Admin Activity logs configuration changes, always on and free, cannot be disabled. Data Access logs record reads/writes to actual data, must be explicitly enabled per service, and can generate substantial volume/cost.

### 53. What's the difference between Cloud Trace and Cloud Profiler?
Trace shows where time goes across a request's path through multiple services (a waterfall of spans). Profiler shows where CPU/memory goes within the application's own code, continuously, independent of any single request.

### 54. Why is alert fatigue a genuine reliability risk, not just an annoyance?
A team that learns to dismiss a too-frequent alert without investigating will eventually dismiss a genuine incident hiding among the noise, delaying real detection — the alert stops providing its actual safety-net function.

## Applied / Scenario

### 55. An error-rate alert fires 3-4 times weekly for months, and the team stops investigating each occurrence. What's the root cause and the fix?
The threshold was never validated against real traffic variance — the fix is pulling historical data, computing genuine normal variance, and resetting the threshold meaningfully above it, restoring the alert's actual signal value.

### 56. A team wants to know which specific service in a multi-service request chain is responsible for latency. Which tool answers this, and why not just add more logging?
Cloud Trace, via distributed tracing spans — it directly shows per-span timing across the whole chain. More logging surfaces more discrete events but doesn't inherently connect them into one coherent cross-service timing picture.

## Quick-Fire Recall

| Term/Question | One-line answer |
|---|---|
| GCP's isolation/billing unit | The project — three identifiers, only Project ID is permanent |
| Is a GCP VPC regional or global? | Global by default — a real structural difference from AWS/Azure |
| Org policy vs. IAM | Org policy: what can exist. IAM: who can act |
| Labels vs. network tags vs. Resource Manager tags | Cost tracking / firewall targeting / IAM-governed policy gating |
| Recovering a deleted project | `gcloud projects undelete`, within 30 days |
| Self-serve vs. invoiced billing | Auto-charged card vs. monthly invoice via sales relationship |
| Does a budget alert stop spending? | No — only a Pub/Sub-triggered automation can |
| Deployment Manager's status | Deprecated — use Terraform or Infrastructure Manager |
| Local vs. remote Terraform state | Remote (GCS) adds real locking against concurrent applies |
| Best default IAM grant target | A group, not an individual |
| Riskiest IAM role tier | Primitive (Owner/Editor/Viewer) |
| Service account vs. AWS IAM role | GCP's is a real persistent identity; AWS's only exists when assumed |
| Best CI/CD auth mechanism | Workload Identity Federation — no key file |
| Deny policy's unique guarantee | Overrides any future role grant, unlike careful scoping alone |
| E2 vs. N4 vs. C4 | Cost-optimized / balanced default / max single-thread performance |
| Why not edit a MIG instance manually | The template is the source of record — changes get discarded |
| Spot VM trade-off | Deep discount for 30-second-notice reclaimable capacity |
| Autopilot vs. Standard GKE | Google-managed nodes vs. full node control; hybrid ComputeClass bridges both |
| Why Cloud Run revisions matter | They enable traffic splitting and instant rollback |
| Cloud Run's scale-to-zero trade-off | Cost savings vs. cold-start latency on first request |
| Default managed database choice | Cloud SQL — reach further only with a measured reason |
| Autoclass vs. manual lifecycle rules | Access-pattern-driven cost optimization vs. exact compliance timing |
| BigQuery's cost driver | Data scanned per query — partition and cluster to reduce it |
| CMEK's real risk | A destroyed key makes data permanently unreadable, even to Google |
| Shared VPC vs. Peering | Centralized one network vs. two independently-managed networks |
| Why peering isn't transitive | Each peering relationship is independent — no implicit path through a shared peer |
| Cloud NAT vs. Private Google Access | General internet egress vs. Google-API-specific private path |
| Layer 4 vs. Layer 7 load balancer | No HTTP visibility vs. path/header-based routing capability |
| Admin Activity vs. Data Access logs | Always-on/free vs. opt-in/can be costly |
| Cloud Trace vs. Cloud Profiler | Cross-service request timing vs. in-application CPU/memory |
| Root cause of alert fatigue | An unvalidated threshold firing too often on normal variance |