Welcome to the GCP interview questions and answers section of ComputerGeek. These guides are written for senior Architect, Data Engineer, DevOps and Platform Engineer interviews, in simple English, with a short answer, the concept, common mistakes and tips for each role.

Start here: Resource hierarchy and IAM

• GCP IAM & Resource Hierarchy Interview Questions (2026) (main guide)

The 10 questions

1. GCP Resource Hierarchy Explained: Interview Q&A
2. GCP IAM Policy Inheritance: Can a Child Remove a Role?
3. GCP IAM Roles: Basic vs Predefined vs Custom
4. GCP IAM Deny Policy vs Principal Access Boundary
5. GCP Folder Structure Best Practices for 200 Projects
6. IAM vs Organization Policy in GCP: Interview Answer
7. GCP Least Privilege at Scale: Interview Answer
8. GCP IAM Conditions and Tags Explained
9. GCP Organization Admin and Break-Glass Account
10. GCP Permission Denied Error: How to Troubleshoot

Extra resources

• GCP IAM Glossary for Beginners: Simple Definitions
• GCP IAM gcloud Commands Cheat Sheet (Interview)
• 10 Common GCP IAM Mistakes Interviewers Look For
• GCP IAM Interview Revision Sheet: 10 Answers

Coming next

More GCP topics will be added here as the series continues, such as project strategy, networking, security and Terraform.

This blog is independent and not affiliated with Google. Check the current Google Cloud documentation for the latest details.

This one-page GCP IAM interview revision sheet gives you the key idea of each of the top 10 resource hierarchy and IAM questions in a few words. Read it the day before your interview, then open the full post for any line you cannot explain.

How to use this sheet

Skim the table once to see the whole map. Pick any row where the key idea feels fuzzy and read the linked article for a 30-second spoken answer. On interview day, use the checklist below after you can explain every row without reading. If you have five minutes left, rehearse questions 1 (hierarchy), 4 (allow/deny/PAB), and 10 (permission denied)—those three show up most often in senior GCP conversations.

Return to the GCP interview questions hub for glossary, gcloud cheat sheet, and common mistakes.

10 answers in 10 words

Interview-day checklist

• Draw the Organization, Folders, Projects, Resources tree and say what flows down.
• Name one real example for each answer.
• Say least privilege, groups and code review in your answers.
• Know your troubleshooting steps for 'permission denied'.

Disclaimer: This blog is independent and not affiliated with or endorsed by Google. Google Cloud features, limits and commands change, so always check the current documentation. Official references: Resource hierarchy, IAM policy types, IAM quotas and limits.

For example: use gcloud projects get-iam-policy PROJECT_ID to inspect bindings on a project.

Interviewers do not only listen for correct answers. They listen for mistakes you avoid. Here are 10 common GCP IAM and resource hierarchy mistakes from the top 10 questions, with a tip for how to say it like a senior engineer.

10 mistakes to avoid

1. Resource Hierarchy: Building the hierarchy to copy the HR org chart. Org charts change often; your folders should not. Say instead: Say 'inheritance, billing and blast radius' - three words that show you think beyond the diagram. (full post)
2. IAM Inheritance: Granting Editor at folder level 'for convenience'. It silently reaches every project below it today and tomorrow. Say instead: Mention deny policies. Many candidates only know 'additive' and stop there. (full post)
3. Role Types: Giving roles/editor to a service account because 'it just works'. Say instead: Name one real predefined role and one real reason you would build a custom one. (full post)
4. Allow, Deny, PAB: Using deny for everything. Prefer least-privilege allow, and use deny for hard guardrails. Say instead: This is the freshest topic in IAM. Showing you know PAB signals you keep up with the platform. (full post)
5. Folder Design: Folders per team that is later reorganised, forcing mass moves. Say instead: Open with 'where does policy differ?' and the interviewer will relax - you are thinking in rules, not boxes. (full post)
6. IAM vs Org Policy: Thinking Org Policy replaces IAM. It does not grant anything. Say instead: Use the one-liner: 'IAM is who, Org Policy is what.' Then add a concrete example. (full post)
7. Least Privilege at Scale: Nested groups that nobody can understand. Say instead: Say 'groups, code, review, expiry' - four words that cover the whole answer. (full post)
8. Conditions & Tags: Complex conditions that no one can read in six months. Say instead: Always add 'labels vs tags' - it is a classic follow-up trap. (full post)
9. Org Admin & Break-glass: Individual users as Org Admin instead of a group. Say instead: Mention testing the break-glass process. It shows you have seen real incidents. (full post)
10. Permission Denied: Granting Owner to 'make the error go away'. Say instead: Tell it as a step-by-step story. Interviewers love a calm, ordered debugging path. (full post)

How to avoid these in practice

• Grant to groups, not people.
• Grant the smallest predefined role at the lowest sensible level.
• Keep production, test and sandbox separate.
• Manage access as code, and review it regularly.

Keep going with the revision sheet or read the glossary.

Disclaimer: This blog is independent and not affiliated with or endorsed by Google. Google Cloud features, limits and commands change, so always check the current documentation. Official references: Resource hierarchy, IAM policy types, IAM quotas and limits.

For example: use gcloud projects get-iam-policy PROJECT_ID to inspect bindings on a project.

If you are preparing for a Google Cloud interview, the resource hierarchy and IAM are almost always the first topics. This guide lists the top 10 GCP resource hierarchy and IAM interview questions that I would expect at senior level for Architect, Data Engineer, DevOps and Platform Engineer roles. Each question links to a full post with a 30-second answer, the concept in plain English, common mistakes and tips by role.

In one sentence: Google Cloud is a tree (Organization, Folders, Projects, Resources). Access rules and company rules are set at one level and flow down. Most IAM interview questions test whether you understand that flow.

Who is this guide for?

Engineers with some cloud experience who want clear, short answers in simple English. If some words are new, start with the GCP IAM glossary for beginners.

The 10 questions and short answers

1. Explain the GCP resource hierarchy. Why does it matter? GCP has four levels: Organization at the top, then Folders, then Projects, then the actual resources like VMs and buckets.
2. How does IAM policy inheritance work? Can a child remove a parent's grant? Allow policies are additive.
3. Basic vs predefined vs custom roles - which do you use and when? Basic roles like Owner, Editor and Viewer are very broad, so I avoid them in production.
4. What are allow policies, deny policies and Principal Access Boundary policies? How do they work together? Allow policies grant access.
5. How would you design the folder structure for a company with 200 projects? I design folders around where policy differs, not around the org chart.
6. What is the difference between IAM and Organization Policy? IAM answers who can do what.
7. How do you manage least privilege at scale across hundreds of users and projects? I never grant roles to individual users.
8. How do IAM Conditions and Tags help control access? An IAM Condition adds an 'only if' to a role binding.
9. Who should have Organization Administrator access? How do you protect the top of the hierarchy? Very few people, and never daily-use accounts.
10. A user says 'permission denied'. How do you troubleshoot it? First I get the exact principal, the exact permission and the exact resource from the error.

How to use this list

1. Read each short answer, then open the full post for the concept and mistakes.
2. Say each answer aloud once. Time yourself: about 30 seconds.
3. Use the revision sheet the day before your interview.
4. Check the common mistakes list. Interviewers often probe these.

More resources in this series

• GCP IAM gcloud commands cheat sheet
• 10 Common GCP IAM Mistakes Interviewers Look For
• All topics: GCP interview questions and answers

Disclaimer: This blog is independent and not affiliated with or endorsed by Google. Google Cloud features, limits and commands change, so always check the current documentation. Official references: Resource hierarchy, IAM policy types, IAM quotas and limits.

For example: use gcloud projects get-iam-policy PROJECT_ID to inspect bindings on a project.

These gcloud commands support the top 10 GCP IAM and resource hierarchy interview questions. You do not need to memorise them, but showing one real command in an interview makes your answer more believable.

Important: replace ORG_ID, FOLDER_ID, PROJECT_ID and email addresses with your own values. Flags and features change, so check gcloud help and the current documentation before running anything in a real environment.

Commands by interview question

Q1. Resource Hierarchy

gcloud organizations list
gcloud resource-manager folders list --organization=ORG_ID
gcloud projects list --filter='parent.id=FOLDER_ID'

Read the full answer: GCP Resource Hierarchy Explained: Interview Q&A

Q2. IAM Inheritance

gcloud projects get-iam-policy PROJECT_ID
gcloud resource-manager folders get-iam-policy FOLDER_ID
# See all policies that apply to a resource
gcloud asset analyze-iam-policy --organization=ORG_ID --full-resource-name=//cloudresourcemanager.googleapis.com/projects/PROJECT_ID

Read the full answer: GCP IAM Policy Inheritance: Can a Child Remove a Role?

Q3. Role Types

gcloud iam roles describe roles/bigquery.dataViewer
gcloud iam roles create customDeployer --organization=ORG_ID --file=role.yaml
gcloud recommender recommendations list --recommender=google.iam.policy.Recommender --project=PROJECT_ID --location=global

Read the full answer: GCP IAM Roles: Basic vs Predefined vs Custom

Q4. Allow, Deny, PAB

gcloud iam policies list --attachment-point=cloudresourcemanager.googleapis.com/projects/PROJECT_ID --kind=denypolicies --format=yaml
# Use Policy Troubleshooter in the console to see allow + deny + PAB for a principal and permission

Read the full answer: GCP IAM Deny Policy vs Principal Access Boundary

Q5. Folder Design

# Terraform sketch
resource "google_folder" "prod" {
  display_name = "Production"
  parent       = "organizations/${var.org_id}"
}

Read the full answer: GCP Folder Structure Best Practices for 200 Projects

Q6. IAM vs Org Policy

gcloud org-policies list --organization=ORG_ID
gcloud org-policies describe constraints/iam.disableServiceAccountKeyCreation --organization=ORG_ID

Read the full answer: IAM vs Organization Policy in GCP: Interview Answer

Q7. Least Privilege at Scale

gcloud asset analyze-iam-policy --organization=ORG_ID --identity='group:data-team@example.com'
gcloud projects add-iam-policy-binding PROJECT_ID --member='group:data-team@example.com' --role='roles/bigquery.dataViewer'

Read the full answer: GCP Least Privilege at Scale: Interview Answer

Q8. Conditions & Tags

# Condition expression examples
request.time < timestamp('2026-12-31T00:00:00Z')
resource.matchTag('ORG_ID/env', 'dev')

Read the full answer: GCP IAM Conditions and Tags Explained

Q9. Org Admin & Break-glass

gcloud organizations get-iam-policy ORG_ID
# Alert idea: log filter on SetIamPolicy at organization level

Read the full answer: GCP Organization Admin and Break-Glass Account

Q10. Permission Denied

gcloud policy-troubleshoot iam //cloudresourcemanager.googleapis.com/projects/PROJECT_ID --principal-email=user@example.com --permission=storage.objects.get
gcloud logging read 'protoPayload.status.code=7' --project=PROJECT_ID --limit=20

Read the full answer: GCP Permission Denied Error: How to Troubleshoot

Tips for using commands in an interview

• Describe what the command shows, not just the syntax.
• Mention that production changes go through code review (for example Terraform).
• Never say you grant Owner to fix an error. Use the troubleshooting steps in GCP Permission Denied Error: How to Troubleshoot.

Disclaimer: This blog is independent and not affiliated with or endorsed by Google. Google Cloud features, limits and commands change, so always check the current documentation. Official references: Resource hierarchy, IAM policy types, IAM quotas and limits.