Top 35 GCP Interview Questions and Answers [2026]

TL;DR: GCP interviews in 2026 test how a candidate picks between Cloud Run, GKE and VMs, how workloads get credentials without keys, and how data and messaging services behave under failure. Candidates should know that Cloud Functions is now Cloud Run functions, that Container Registry is shut down, and that Deployment Manager lost support on April 1, 2026.

Cloud Run worker pools reached general availability on April 14, 2026. Cloud Run now covers request-driven services, run-to-completion jobs and always-on background workers.

That shift moves many workloads that used to need GKE or a VM, and it changes the first question in most GCP system design rounds. The IAM, networking and data questions below still decide most interviews.

Compute and GKE

1. Compare GKE Autopilot and GKE Standard. When would you choose each?

Choose Autopilot by default and Standard only when you need to manage nodes yourself. In Autopilot, Google manages the nodes, scaling and security settings. You describe Pods and their resource requests, and GKE provides the capacity.

Google's own Autopilot overview recommends it "for the most streamlined experience".

Billing differs too. General-purpose Autopilot workloads pay per Pod request. Workloads that ask for specific hardware pay for the node plus a management premium.

Standard clusters bill by node, so you pay for idle capacity in half-empty node pools.

The line has blurred since 2025: Standard clusters can now run chosen workloads in Autopilot mode through ComputeClasses (see question 33).

2. How do concurrency and autoscaling work in Cloud Run?

Concurrency is the maximum number of requests one instance handles at the same time, and Cloud Run adds instances when existing ones reach it.

Per the concurrency docs, services deployed with the gcloud CLI or Terraform default to 80 requests per vCPU. The console default is 80, and the ceiling is 1,000.

The value is a limit, not a target. If an instance's CPU is already busy, Cloud Run may send it fewer requests. Setting concurrency to 1 suits code that is not thread-safe, but it multiplies the instance count.

Cloud Run scales to zero by default. Minimum instances keep some instances warm to avoid cold starts, and since October 2024 you can set them for the whole service, not only per revision.

3. How do you choose between Cloud Run, GKE and Compute Engine?

Start with the most managed option that fits and move down only for a concrete reason. A stateless container that answers HTTP or events belongs on Cloud Run. A batch task that exits belongs in a Cloud Run job.

A platform with many services that needs Kubernetes APIs belongs on GKE. Software that needs a full OS, a license tied to a machine, or special kernel settings belongs on a VM.

A strong candidate also names what each choice costs. Cloud Run gives up control over the host. GKE brings a cluster to upgrade and secure. A VM brings patching, images and instance groups.

4. What are Spot VMs, and when do you use them?

Spot VMs are spare Compute Engine capacity sold at a deep discount, and Google can reclaim them at any time. The Spot VM docs list discounts of up to 91% and call them "the latest version of preemptible VMs".

Unlike the older preemptible VMs, Spot VMs have no 24-hour maximum runtime. A preempted Spot VM gets a best-effort shutdown window of up to 30 seconds. A longer 120-second preemption notice is in Preview.

Use them for work that can restart: batch jobs, CI runners, rendering, and GKE node pools behind a regular pool. Do not run a single-instance database on one.

5. What is Workload Identity Federation for GKE?

It lets Pods call Google Cloud APIs with IAM permissions and no service account key files. It is the Google-recommended way to authenticate GKE workloads, and it also replaces metadata concealment.

The GKE docs describe the flow. The GKE metadata server intercepts the token request and gets a Kubernetes ServiceAccount token. Security Token Service then swaps it for a short-lived federated token.

You can grant IAM roles straight to a principal such as principal://iam.googleapis.com/projects/PROJECT_NUMBER/locations/global/workloadIdentityPools/PROJECT_ID.svc.id.goog/subject/ns/NAMESPACE/sa/KSA.

Linking the Kubernetes ServiceAccount to an IAM service account is now optional.

6. What is a managed instance group, and why use one?

A managed instance group (MIG) runs identical VMs from one instance template and keeps them healthy.

It recreates VMs that fail a health check (autohealing), adds or removes VMs based on load (autoscaling), and rolls out a new template gradually (rolling updates).

A regional MIG spreads VMs across zones in a region, so one zone outage does not take down the group. MIGs are also the usual backend for a load balancer when a workload must run on VMs.

Databases and Storage

7. What is Spanner, and when is it worth the cost?

Spanner is a relational database that scales horizontally and keeps strong consistency, including across regions. It offers SQL, schemas and ACID transactions, and it splits data across servers as the database grows.

Its ordering guarantee comes from TrueTime, a distributed clock that lets Spanner give every transaction a timestamp matching its real commit order. Google calls this external consistency.

Spanner is worth it when writes outgrow one primary database, or when an app needs consistent writes in several regions. For a single-region app that fits on one server, Cloud SQL is cheaper and simpler.

8. What is the difference between Firestore Native mode and Datastore mode?

Native mode is the full Firestore product, and Datastore mode is a compatibility mode for apps built on the older Datastore API. Native mode adds real-time listeners, mobile and web client libraries, and richer queries.

Google's comparison page recommends Datastore mode "only for applications with a dependency on the Datastore APIs, such as legacy App Engine apps". You pick the mode when you create the database, so it is a design decision, not a toggle.

9. How does the Cloud SQL Auth Proxy work?

The proxy is a small local process that opens an encrypted, IAM-checked tunnel to a Cloud SQL instance. The app connects to it on localhost with its normal database driver.

The proxy fetches a short-lived certificate from the Cloud SQL Admin API and forwards traffic over TLS 1.3.

Per the Auth Proxy docs, this removes the need for authorized networks or manual SSL setup. For Java, Python and Go, Google recommends the Cloud SQL language connectors instead, which do the same work inside the app.

./cloud-sql-proxy --port 5432 my-project:us-central1:orders-db

10. When would you choose Bigtable?

Choose Bigtable for large volumes of key-based reads and writes with low latency, such as time series, IoT telemetry, ad events or user feature stores.

It is a wide-column NoSQL database that scales by adding nodes, and it supports the HBase API.

It is the wrong tool for relational data, multi-row transactions or ad hoc SQL analysis. Row key design decides its performance.

A key that starts with a timestamp sends every new write to one server, so good keys lead with something that spreads writes, such as a device ID.

11. Explain the Cloud Storage classes.

The classes trade storage price against access cost, and all of them return data in milliseconds. The storage class docs list:

• Standard: frequently read data, no minimum duration, no retrieval fee.
• Nearline: about once a month, 30-day minimum.
• Coldline: about once a quarter, 90-day minimum.
• Archive: backups and compliance copies, 365-day minimum.

Nearline, Coldline and Archive charge retrieval fees. A common wrong answer is that Archive takes hours to restore; the docs say its data "is available within milliseconds, not hours or days".

Autoclass can move objects between classes automatically based on access.

12. What is a signed URL?

A signed URL gives anyone who holds it time-limited access to one Cloud Storage object, with no Google account needed. It is signed with a service account's credentials, so it can do only what that account can do.

Typical uses are a browser uploading a large file straight to a bucket, or a customer downloading a private invoice. A V4 signed URL lasts at most 604,800 seconds, which is 7 days, per the signed URL docs.

Keep expiry short, because anyone with the link can use it.

Networking

13. Compare VPC Network Peering, Cloud VPN and Cloud Interconnect.

Peering links two VPC networks inside Google Cloud; VPN and Interconnect link Google Cloud to your own network. Peered networks talk over internal IPs and must not have overlapping ranges.

• Cloud VPN: IPsec tunnels over the internet. HA VPN offers a 99.99% SLA for most setups, against 99.9% for Classic VPN, per the Cloud VPN overview.
• Cloud Interconnect: a private physical link, Dedicated or through a Partner. It gives more bandwidth and steadier latency than VPN.

Peering is not transitive: if A peers with B and B with C, A cannot reach C through B.

14. What types of load balancer does Google Cloud offer?

There are two families: Application Load Balancers for HTTP and HTTPS, and Network Load Balancers for TCP, UDP and other traffic. Each comes as external or internal, and as global, regional or cross-region.

Network Load Balancers split again into proxy and passthrough. A proxy load balancer ends the client connection and opens a new one to the backend. A passthrough load balancer forwards packets, so the backend sees the client's IP address.

The overview uses these names; "HTTP(S) Load Balancer" is the old one.

15. How does Cloud Run reach private resources in a VPC?

Use Direct VPC egress, which gives Cloud Run instances an IP address in your subnet with no connector in between. It reached GA in April 2024 and works for services, jobs, functions and worker pools.

Its network costs scale to zero with the service.

The older option is a Serverless VPC Access connector, which runs its own VMs that you pay for. The Direct VPC egress docs note one exception.

With Cloud NAT, Direct VPC egress can add cold start delays of 30 seconds or more, and a connector is the better choice there.

16. What is Cloud Armor?

Cloud Armor is Google Cloud's web application firewall and DDoS protection, attached to external load balancers as security policies.

Rules can allow or deny by IP range or region, match requests with custom expressions, and apply preconfigured WAF rules for attacks such as SQL injection and cross-site scripting.

Rate limiting rules can throttle or ban clients that send too many requests. A candidate should know that Cloud Armor only protects traffic that passes through a supported load balancer.

17. What is Shared VPC?

Shared VPC lets one host project own a VPC network while other service projects run resources in its subnets. The network team controls subnets, firewall rules and routes in one place. App teams keep their own projects for billing and IAM.

It is the usual layout for a company with many teams, because it avoids a web of peering links. Access is granted per subnet, so a team can use only the subnets it has been given.

Messaging and Workflows

18. Compare Pub/Sub pull, push and export subscriptions.

The subscription type decides who controls delivery. With pull, the subscriber asks for messages and controls its own rate, and it can sit behind a firewall.

With push, Pub/Sub sends each message to an HTTPS endpoint, which suits Cloud Run and needs no client library. Export subscriptions write messages straight to BigQuery or Cloud Storage with no subscriber code.

Pull, especially StreamingPull, gives the most throughput and control. Push is simpler for serverless targets but needs an endpoint that can handle bursts.

19. How does exactly-once delivery work in Pub/Sub?

It is a subscription setting that stops redelivery once a message is acknowledged, and it works only for pull subscriptions.

Per the exactly-once docs, the guarantee holds when subscribers connect in the same region, based on Pub/Sub's own message ID.

With it on, the subscriber learns whether each acknowledgment succeeded. Only the latest ack ID for a message can acknowledge it. Push and export subscriptions do not support it.

20. When would you use Cloud Tasks instead of Pub/Sub?

Use Cloud Tasks when one specific handler must do one job, and you need control over when and how fast it runs. Use Pub/Sub when an event should reach any number of independent subscribers.

Cloud Tasks offers per-queue rate limits, scheduled delivery and retry settings. That makes it a good fit for calling a rate-limited third-party API. Pub/Sub fits fan-out, where the publisher does not know who listens.

Recurring jobs on a timetable belong in Cloud Scheduler, not in either one.

21. What is Workflows used for?

Workflows runs a sequence of steps, such as calls to Cloud Run, Google APIs or outside HTTP APIs, as a managed state machine. You define it in YAML or JSON, with conditions, loops, retries and error handling.

It suits processes like "reserve stock, charge the card, then send the email", where each step must finish before the next and failures need clear handling. It keeps that order out of application code and records each run's history.

IAM and Security

22. What are basic, predefined and custom roles?

They are the three kinds of IAM role, from broadest to most specific. Basic roles (Owner, Editor, Viewer) apply across a whole project. Predefined roles are managed by Google for one service, such as roles/pubsub.publisher.

Custom roles are sets of permissions you define.

The IAM roles overview is direct: "In production environments, do not grant basic roles unless there is no alternative." Older material calls them primitive roles.

23. What are IAM Conditions? Give an example.

IAM Conditions add a rule to a role binding, and the role applies only when the rule is true. Rules use Common Expression Language and can check attributes such as the time of the request or the name of the resource.

A common use is temporary access for a contractor:

request.time < timestamp("2026-12-31T00:00:00Z")

Another is limiting a role to buckets whose names start with a team prefix. Conditions cut down on custom roles, but not every service supports every attribute.

24. What is Identity-Aware Proxy?

IAP checks a user's identity and IAM role before a request reaches an app, so internal tools need no VPN. It sits in front of apps served through a load balancer or on App Engine.

IAP also offers TCP forwarding, so admins can SSH into VMs with no public IP address. Access depends on the user's identity instead of their network location, which is the core of a zero-trust model.

25. What is envelope encryption in Cloud KMS?

Envelope encryption encrypts data with a data encryption key (DEK), then encrypts the DEK with a key encryption key (KEK) held in Cloud KMS. The encrypted DEK is stored next to the data.

The KEK never leaves KMS, and every use of it is logged and controlled by IAM. Rotating the KEK means re-encrypting small DEKs, not the whole dataset.

Customer-managed encryption keys (CMEK) on services such as Cloud Storage and BigQuery work this way.

26. How should an app on Google Cloud handle secrets?

Store them in Secret Manager and let the app's service account read them at runtime with roles/secretmanager.secretAccessor. Secrets are versioned, access is logged, and IAM can be set per secret.

Cloud Run can expose a secret as an environment variable or as a mounted file. Pin a version number in production so a rotation does not change a running app without a deploy.

Better still is to need no secret: use IAM database authentication or Workload Identity Federation where the target supports them.

Architecture and DevOps

27. How would you design an app to survive a region outage?

Run the app in at least two regions behind a global external Application Load Balancer, which sends users to the nearest healthy backend. Keep compute stateless so any region can serve any user.

The data layer is the hard part. Spanner multi-region configurations keep writes consistent across regions. Cloud SQL offers cross-region read replicas that can be promoted, with some data loss risk.

Dual-region or multi-region buckets cover object storage. A senior answer states the recovery point and recovery time targets first, then picks services to meet them.

28. What do Cloud Logging, Cloud Monitoring and Cloud Trace each do?

Logging stores and queries logs, Monitoring stores metrics and sends alerts, and Trace follows one request across services. Together they are Google Cloud Observability, formerly called Stackdriver.

Log-based metrics turn log lines into Monitoring metrics you can alert on. Trace shows where time goes inside a slow request, such as a single database call.

29. How do you manage GCP infrastructure as code today?

Use Terraform, either run by your own CI or through Google's Infrastructure Manager, which runs Terraform for you. Cloud Deployment Manager, Google's older YAML-based tool, lost support on April 1, 2026.

Per the Infrastructure Manager overview, it runs terraform init, validate and apply in a Cloud Build job. It keeps the state file in a Cloud Storage bucket it creates.

Teams already running Terraform in CI with a GCS backend often keep that setup. The key interview point is the same either way: state is shared, locked and never edited by hand.

30. What is Cloud Build, and where do its images go?

Cloud Build is Google Cloud's managed CI service: it runs build steps, each in a container, from a cloudbuild.yaml file. Triggers start builds on a push or pull request.

Images go to Artifact Registry, which also stores language packages such as npm and Maven. Container Registry (gcr.io) no longer accepts pushes.

A typical pipeline builds the image, scans it, pushes it to Artifact Registry and deploys to Cloud Run.

steps:
- name: gcr.io/cloud-builders/docker
  args: ["build", "-t", "us-docker.pkg.dev/$PROJECT_ID/app/api:$SHORT_SHA", "."]
images: ["us-docker.pkg.dev/$PROJECT_ID/app/api:$SHORT_SHA"]

What Changed Recently

31. What happened to Cloud Functions?

It was renamed Cloud Run functions on August 21, 2024, and functions now deploy as Cloud Run services. The release notes say Cloud Functions (2nd gen) "is now known as Cloud Run functions". 1st gen became Cloud Run functions (1st gen).

Since February 2025, deploying functions directly in Cloud Run is GA. Functions made with the older v2 API can be detached to the Cloud Run Admin API and keep their cloudfunctions.net URLs.

A candidate who still says "Cloud Functions 2nd gen is built on Cloud Run" is right about the history but behind on the name.

32. What should a team still using gcr.io do?

Move to Artifact Registry. Per Google's transition guide, "Effective March 18, 2025, Container Registry is shut down and writing images to Container Registry is unavailable."

Artifact Registry can host gcr.io repositories, so old image paths keep working after migration. A good answer also covers the IAM change.

Artifact Registry uses its own roles per repository instead of permissions on the Cloud Storage bucket behind Container Registry.

33. Can a GKE Standard cluster use Autopilot?

Yes. Since September 25, 2025, Standard clusters can run chosen workloads in Autopilot mode, with fully managed nodes and the container-optimized compute platform.

The feature started in the Rapid channel on GKE 1.33.1-gke.1107000 and reached the Regular channel in December 2025, per the GKE release notes.

A workload opts in by selecting an Autopilot ComputeClass. That lets a team keep hand-tuned node pools for a few special workloads and hand everything else to Google, with no migration to a new cluster.

34. What are Cloud Run worker pools and GPUs for?

Worker pools run continuous background work, and GPUs run inference and other accelerated jobs, both inside Cloud Run. The Cloud Run release notes date GPU support GA to April 7, 2025 and worker pools GA to April 14, 2026.

A worker pool has no load-balanced URL and does not autoscale; you set its instance count. That suits a consumer that pulls from Pub/Sub or Kafka all day.

Before worker pools, teams faked this with a service that had minimum instances and CPU always allocated.

35. Why does Deployment Manager matter in a 2026 interview?

Because code that still depends on it needs a migration plan. Google's deprecation notice says support "was discontinued on April 1, 2026". It adds that after June 30, 2027, the service "will be turned down".

Google points users to Infrastructure Manager or another tool.

For a candidate, the useful answer is how they would move: export or rewrite the templates as Terraform, import the live resources into state, and check the plan shows no changes before the old tool is retired.

Signs of a Strong Answer

• They pick Cloud Run, GKE or a VM by naming the constraint that rules out the simpler option.
• They reach for Workload Identity Federation and IAM service accounts, and treat a downloaded JSON key as a last resort.
• They know exactly-once in Pub/Sub still needs idempotent consumers, and why.
• They design Bigtable row keys and Spanner primary keys to avoid hotspots without being prompted.
• They use current names (Cloud Run functions, Application Load Balancer, Artifact Registry) and know what was retired.
• They state recovery targets before choosing a multi-region data design.

Hiring GCP Engineers

Engineers who know Google Cloud in depth are harder to find than generalists, and many strong ones work remotely from Asia. Second Talent matches companies with pre-vetted DevOps and cloud engineers, screened with questions like these.

Tell us the stack and we send a shortlist within 24 hours. Start hiring, or see our Kubernetes and Azure interview guides.

Ready to hire? Hire Cloud Engineers: vetted AI-native talent, with first profiles in 24 hours.