These gcloud commands support the top 10 GCP IAM and resource hierarchy interview questions. You do not need to memorise them, but showing one real command in an interview makes your answer more believable.

Important: replace ORG_ID, FOLDER_ID, PROJECT_ID and email addresses with your own values. Flags and features change, so check gcloud help and the current documentation before running anything in a real environment.

Commands by interview question

Q1. Resource Hierarchy

gcloud organizations list
gcloud resource-manager folders list --organization=ORG_ID
gcloud projects list --filter='parent.id=FOLDER_ID'

Read the full answer: GCP Resource Hierarchy Explained: Interview Q&A

Q2. IAM Inheritance

gcloud projects get-iam-policy PROJECT_ID
gcloud resource-manager folders get-iam-policy FOLDER_ID
# See all policies that apply to a resource
gcloud asset analyze-iam-policy --organization=ORG_ID --full-resource-name=//cloudresourcemanager.googleapis.com/projects/PROJECT_ID

Read the full answer: GCP IAM Policy Inheritance: Can a Child Remove a Role?

Q3. Role Types

gcloud iam roles describe roles/bigquery.dataViewer
gcloud iam roles create customDeployer --organization=ORG_ID --file=role.yaml
gcloud recommender recommendations list --recommender=google.iam.policy.Recommender --project=PROJECT_ID --location=global

Read the full answer: GCP IAM Roles: Basic vs Predefined vs Custom

Q4. Allow, Deny, PAB

gcloud iam policies list --attachment-point=cloudresourcemanager.googleapis.com/projects/PROJECT_ID --kind=denypolicies --format=yaml
# Use Policy Troubleshooter in the console to see allow + deny + PAB for a principal and permission

Read the full answer: GCP IAM Deny Policy vs Principal Access Boundary

Q5. Folder Design

# Terraform sketch
resource "google_folder" "prod" {
  display_name = "Production"
  parent       = "organizations/${var.org_id}"
}

Read the full answer: GCP Folder Structure Best Practices for 200 Projects

Q6. IAM vs Org Policy

gcloud org-policies list --organization=ORG_ID
gcloud org-policies describe constraints/iam.disableServiceAccountKeyCreation --organization=ORG_ID

Read the full answer: IAM vs Organization Policy in GCP: Interview Answer

Q7. Least Privilege at Scale

gcloud asset analyze-iam-policy --organization=ORG_ID --identity='group:data-team@example.com'
gcloud projects add-iam-policy-binding PROJECT_ID --member='group:data-team@example.com' --role='roles/bigquery.dataViewer'

Read the full answer: GCP Least Privilege at Scale: Interview Answer

Q8. Conditions & Tags

# Condition expression examples
request.time < timestamp('2026-12-31T00:00:00Z')
resource.matchTag('ORG_ID/env', 'dev')

Read the full answer: GCP IAM Conditions and Tags Explained

Q9. Org Admin & Break-glass

gcloud organizations get-iam-policy ORG_ID
# Alert idea: log filter on SetIamPolicy at organization level

Read the full answer: GCP Organization Admin and Break-Glass Account

Q10. Permission Denied

gcloud policy-troubleshoot iam //cloudresourcemanager.googleapis.com/projects/PROJECT_ID --principal-email=user@example.com --permission=storage.objects.get
gcloud logging read 'protoPayload.status.code=7' --project=PROJECT_ID --limit=20

Read the full answer: GCP Permission Denied Error: How to Troubleshoot

Tips for using commands in an interview

  • Describe what the command shows, not just the syntax.
  • Mention that production changes go through code review (for example Terraform).
  • Never say you grant Owner to fix an error. Use the troubleshooting steps in GCP Permission Denied Error: How to Troubleshoot.

Disclaimer: This blog is independent and not affiliated with or endorsed by Google. Google Cloud features, limits and commands change, so always check the current documentation. Official references: Resource hierarchy, IAM policy types, IAM quotas and limits.