If you are preparing for a Google Cloud interview, the resource hierarchy and IAM are almost always the first topics. This guide lists the top 10 GCP resource hierarchy and IAM interview questions that I would expect at senior level for Architect, Data Engineer, DevOps and Platform Engineer roles. Each question links to a full post with a 30-second answer, the concept in plain English, common mistakes and tips by role.

In one sentence: Google Cloud is a tree (Organization, Folders, Projects, Resources). Access rules and company rules are set at one level and flow down. Most IAM interview questions test whether you understand that flow.

GCP resource hierarchy diagram: Organization, Folders, Projects and Resources with policies flowing down

 

Who is this guide for?

Engineers with some cloud experience who want clear, short answers in simple English. If some words are new, start with the GCP IAM glossary for beginners.

The 10 questions and short answers

  1. Explain the GCP resource hierarchy. Why does it matter? GCP has four levels: Organization at the top, then Folders, then Projects, then the actual resources like VMs and buckets.
  2. How does IAM policy inheritance work? Can a child remove a parent's grant? Allow policies are additive.
  3. Basic vs predefined vs custom roles - which do you use and when? Basic roles like Owner, Editor and Viewer are very broad, so I avoid them in production.
  4. What are allow policies, deny policies and Principal Access Boundary policies? How do they work together? Allow policies grant access.
  5. How would you design the folder structure for a company with 200 projects? I design folders around where policy differs, not around the org chart.
  6. What is the difference between IAM and Organization Policy? IAM answers who can do what.
  7. How do you manage least privilege at scale across hundreds of users and projects? I never grant roles to individual users.
  8. How do IAM Conditions and Tags help control access? An IAM Condition adds an 'only if' to a role binding.
  9. Who should have Organization Administrator access? How do you protect the top of the hierarchy? Very few people, and never daily-use accounts.
  10. A user says 'permission denied'. How do you troubleshoot it? First I get the exact principal, the exact permission and the exact resource from the error.

How to use this list

  1. Read each short answer, then open the full post for the concept and mistakes.
  2. Say each answer aloud once. Time yourself: about 30 seconds.
  3. Use the revision sheet the day before your interview.
  4. Check the common mistakes list. Interviewers often probe these.

More resources in this series


Disclaimer: This blog is independent and not affiliated with or endorsed by Google. Google Cloud features, limits and commands change, so always check the current documentation. Official references: Resource hierarchy, IAM policy types, IAM quotas and limits.

For example: use gcloud projects get-iam-policy PROJECT_ID to inspect bindings on a project.