This one-page GCP IAM interview revision sheet gives you the key idea of each of the top 10 resource hierarchy and IAM questions in a few words. Read it the day before your interview, then open the full post for any line you cannot explain.

How to use this sheet

Skim the table once to see the whole map. Pick any row where the key idea feels fuzzy and read the linked article for a 30-second spoken answer. On interview day, use the checklist below after you can explain every row without reading. If you have five minutes left, rehearse questions 1 (hierarchy), 4 (allow/deny/PAB), and 10 (permission denied)—those three show up most often in senior GCP conversations.

Return to the GCP interview questions hub for glossary, gcloud cheat sheet, and common mistakes.

10 answers in 10 words

# Topic Key idea
1 Resource Hierarchy Org → Folder → Project → Resource
2 IAM Inheritance Allow is additive; use deny to block
3 Role Types Predefined roles first; custom roles rarely
4 Allow, Deny, PAB Three gates: eligible, not denied, granted
5 Folder Design Folders follow policy, not the org chart
6 IAM vs Org Policy IAM = who. Org Policy = what
7 Least Privilege at Scale Groups, code, review, expiry
8 Conditions & Tags Conditions + tags = 'only if'
9 Org Admin & Break-glass Few admins, split duties, test break-glass
10 Permission Denied Troubleshooter first, then other layers

Interview-day checklist

  • Draw the Organization, Folders, Projects, Resources tree and say what flows down.
  • Name one real example for each answer.
  • Say least privilege, groups and code review in your answers.
  • Know your troubleshooting steps for 'permission denied'.

Disclaimer: This blog is independent and not affiliated with or endorsed by Google. Google Cloud features, limits and commands change, so always check the current documentation. Official references: Resource hierarchy, IAM policy types, IAM quotas and limits.

For example: use gcloud projects get-iam-policy PROJECT_ID to inspect bindings on a project.