skip to main |
skip to sidebar
RSS Feeds
Technical interview questions for software engineers — languages, databases, cloud, DevOps, and CS fundamentals.
GCP IAM Policy Inheritance: Can a Child Remove a Role?
Interviewers ask, "How does IAM policy inheritance work? Can a child remove a parent's grant?" because they want to know: Do you understand that allow policies are additive, and that you cannot 'override' a parent? This post gives you a ready 30-second answer, the concept in plain English, common mistakes and tips for different roles. It is question 2 of the top 10 GCP resource hierarchy and IAM interview questions.
Short answer (30 seconds): Allow policies are additive. The effective access on a resource is the combination of its own policy and every parent's policy. So if a user gets Viewer at folder level, I cannot take that away at the project level by simply not granting it there. If I need to block access, I use an IAM deny policy, or I fix the grant at the level where it was given. That is why I grant at the lowest level that still makes sense.
What is the interviewer really asking?
Do you understand that allow policies are additive, and that you cannot 'override' a parent?
IAM Inheritance in plain English
- Effective access = union of allow policies from resource up to Org
- A child cannot remove a role granted by a parent
- Use deny policies to block, not 'remove'
Easy picture: A master key given at floor level opens every room on that floor. The room manager cannot take that key back. You must change it at the floor, or add an extra lock (a deny policy).
Detailed explanation
- An IAM allow policy is a list of bindings: who (principal) gets which role on which resource. Policies are inherited by child resources.
- Because allow policies are additive, there is no 'override down'. A project cannot cancel a folder-level binding. This surprises people coming from other systems where child rules can override parent rules.
- To explicitly block, use IAM deny policies. They can be attached to an organization, folder or project, and a matching deny rule beats any allow. Deny policies are part of the IAM v2 API.
- Design rule: grant broad roles rarely and high only for truly broad groups (e.g. security auditors). Grant narrow roles low, close to the resource.
Example commands
gcloud projects get-iam-policy PROJECT_ID
gcloud resource-manager folders get-iam-policy FOLDER_ID
# See all policies that apply to a resource
gcloud asset analyze-iam-policy --organization=ORG_ID --full-resource-name=//cloudresourcemanager.googleapis.com/projects/PROJECT_IDReplace ORG_ID, FOLDER_ID and PROJECT_ID with your own values. Check gcloud help for current flags before you use a command.
Common mistakes
- Granting Editor at folder level 'for convenience'. It silently reaches every project below it today and tomorrow.
- Trying to 'remove' access in a child project and not understanding why the user still has it.
- Forgetting that new projects added under a folder inherit its grants immediately.
Follow-up questions to expect
- How would you give a team access to 40 projects safely? (Folder-level predefined role to a group, not 40 bindings.)
- How do you find who inherits access to a bucket? (Policy Analyzer / Asset Inventory.)
How the answer changes by role
| Role | What to emphasise |
|---|---|
| Architect | Decide at which level each persona gets access; document it as the access model. |
| Data Engineer | Grant dataset-level roles instead of project-wide BigQuery Admin. |
| DevOps Engineer | Manage bindings in Terraform at the right level; avoid per-project copies. |
| Platform Engineer | Bake group-based bindings into the project factory template. |
Senior tip
Mention deny policies. Many candidates only know 'additive' and stop there.
Practice
- Say the 30-second answer aloud without reading it, and time yourself.
- Draw the diagram from memory on paper.
- Explain it once to a junior engineer and once to a CTO.
Keep learning
- Main guide: GCP IAM & Resource Hierarchy Interview Questions (2026)
- Previous question: GCP Resource Hierarchy Explained: Interview Q&A
- Next question: GCP IAM Roles: Basic vs Predefined vs Custom
- New to GCP? Read the GCP IAM glossary for beginners
- Quick revision: GCP IAM interview revision sheet
- More topics: GCP interview questions and answers
Disclaimer: This blog is independent and not affiliated with or endorsed by Google. Google Cloud features, limits and commands change, so always check the current documentation. Official references: Resource hierarchy, IAM policy types, IAM quotas and limits.
GCP Resource Hierarchy Explained: Interview Q&A
Interviewers ask, "Explain the GCP resource hierarchy. Why does it matter?" because they want to know: Do you understand the foundation, and do you know why it matters for security, cost and blast radius? This post gives you a ready 30-second answer, the concept in plain English, common mistakes and tips for different roles. It is question 1 of the top 10 GCP resource hierarchy and IAM interview questions.
Short answer (30 seconds): GCP has four levels: Organization at the top, then Folders, then Projects, then the actual resources like VMs and buckets. The Organization is tied to our Cloud Identity or Workspace domain. The hierarchy matters because IAM policies and Org Policies flow down from parent to child. So I set rules once at a high level and every project below gets them. It also decides who pays, who can do what, and how big the blast radius is when something goes wrong.
What is the interviewer really asking?
Do you understand the foundation, and do you know why it matters for security, cost and blast radius?
Resource Hierarchy in plain English
- Organization → Folders → Projects → Resources
- IAM and Org Policy are set at any level and flow DOWN
- Project = the base unit: APIs, billing link, quota, IAM
Easy picture: Think of a building. The company is the Organization, each floor is a Folder, each room is a Project, and the furniture is the Resources. A rule on the front door applies to every floor and room.
Detailed explanation
- The Organization node is the root. It is created automatically for a Cloud Identity or Google Workspace domain. Without an Organization you only have loose projects, and you cannot use Org Policy or folder-level control.
- Folders are optional grouping nodes. They can be nested (up to 10 levels deep), but good designs stay at 3-4 levels. A folder is where you attach shared rules: 'all production projects must use CMEK', 'the data team can view all their projects'.
- A Project is the real working boundary. It holds the enabled APIs, the billing account link, quotas, and its own IAM policy. Resources (VMs, buckets, datasets) always live inside exactly one project.
- Why it matters: (1) security - inheritance lets you apply least privilege at scale; (2) cost - billing and labels follow projects; (3) governance - Org Policy constraints are enforced from the top; (4) blast radius - a mistake in one project should not touch others.
Example commands
gcloud organizations list
gcloud resource-manager folders list --organization=ORG_ID
gcloud projects list --filter='parent.id=FOLDER_ID'Replace ORG_ID, FOLDER_ID and PROJECT_ID with your own values. Check gcloud help for current flags before you use a command.
Common mistakes
- Building the hierarchy to copy the HR org chart. Org charts change often; your folders should not.
- Putting everything in one project 'to keep it simple'. You lose quota, billing and IAM separation.
- Forgetting that the hierarchy is NOT the same as the network. A VPC does not follow folders.
Follow-up questions to expect
- Can a project be moved between folders? (Yes, with the right permissions; inherited IAM changes immediately.)
- What if we have no Organization? (Create one via Cloud Identity Free; then migrate projects.)
How the answer changes by role
| Role | What to emphasise |
|---|---|
| Architect | Design folder layout by environment and risk, not by org chart. |
| Data Engineer | Separate raw, curated and sandbox projects so access and cost are clear. |
| DevOps Engineer | Automate project creation so every new project lands in the right folder. |
| Platform Engineer | Offer 'project factory' as a self-service product with guardrails built in. |
Senior tip
Say 'inheritance, billing and blast radius' - three words that show you think beyond the diagram.
Practice
- Say the 30-second answer aloud without reading it, and time yourself.
- Draw the diagram from memory on paper.
- Explain it once to a junior engineer and once to a CTO.
Keep learning
- Main guide: GCP IAM & Resource Hierarchy Interview Questions (2026)
- Next question: GCP IAM Policy Inheritance: Can a Child Remove a Role?
- New to GCP? Read the GCP IAM glossary for beginners
- Quick revision: GCP IAM interview revision sheet
- More topics: GCP interview questions and answers
Disclaimer: This blog is independent and not affiliated with or endorsed by Google. Google Cloud features, limits and commands change, so always check the current documentation. Official references: Resource hierarchy, IAM policy types, IAM quotas and limits.
Mysql Database Backup Using PHP / Batch File in Windows System.
Mysql Database Backup Using PHP / Batch File in Windows System.
In this section, I will show how to backup Mysql database using php script and batch file(.bat).
I had created this script for our client as they require automatic mysql database backup for their project.
So You can schedule below script in task schedular of windows system to backup database on daily /monthly basis.
Example: backup.php
"cd c:\\wamp\\bin\\mysql\\mysql5.5.24\\bin" is the path of Mysql folder.
"mysqldump --opt -h $dbhost -u$dbuser -p$dbpass $dbname>c:\\wamp\\backup\\backup.sql" is the Mysql command used to take backup of mysql database.
It is very easy to backup mysql database using batch file as you have to just write commands in batch file and schedule batch file as per your requirment in Task Shedular.
Example: backup.bat
I hope above examples will help you to take backup of mysql database.
In this section, I will show how to backup Mysql database using php script and batch file(.bat).
I had created this script for our client as they require automatic mysql database backup for their project.
So You can schedule below script in task schedular of windows system to backup database on daily /monthly basis.
Mysql Database Backup Using PHP Script :
Example: backup.php
<?php
ini_set("display_errors",1);
$dbhost = 'localhost'; // Datatbase host name.
$dbuser = 'root'; // Database user name
$dbpass = '123'; // database password
$dbname="testdb"; // database name;
system("cd c:\\wamp\\bin\\mysql\\mysql5.5.24\\bin & mysqldump --opt -h $dbhost -u$dbuser -p$dbpass $dbname>c:\\wamp\\backup\\backup.sql");
?>
"cd c:\\wamp\\bin\\mysql\\mysql5.5.24\\bin" is the path of Mysql folder.
"mysqldump --opt -h $dbhost -u$dbuser -p$dbpass $dbname>c:\\wamp\\backup\\backup.sql" is the Mysql command used to take backup of mysql database.
Mysql Database Backup Using Batch File :
It is very easy to backup mysql database using batch file as you have to just write commands in batch file and schedule batch file as per your requirment in Task Shedular.
Example: backup.bat
cd c:\wamp\bin\mysql\mysql5.5.24\bin
@echo off
For /f "tokens=2-4 delims=/ " %%a in ('date /t') do (set dt=%%c-%%a-%%b)
mysqldump --opt -h localhost -uroot -p123 testdb>c:\wamp\backup\testdb_%dt%.sql
I hope above examples will help you to take backup of mysql database.
Update Query using joins in MySql
Update Query using joins in MySql
In this Article, I will show how to write Mysql update query using joins.You can use multiple tables in your single Update query.
Example :
MySql Query to update employee record whose salary is greater than 50000 and department name is R&D.
MySql Query to delete employee record whose salary is greater than 50000 and department name is R&D.
Updating Query Using Joins in PHP Script:
In this Article, I will show how to write Mysql update query using joins.You can use multiple tables in your single Update query.
Example :
| Departments Table : | |
| id | Name |
| 1 | Accounts |
| 2 | R&D |
| 3 | Sales |
Employees Table : id Name Salary Department Id 1 Rajesh 50000 2 2 Sachin 80000 2 3 Rahul 20000 1
MySql Query to update employee record whose salary is greater than 50000 and department name is R&D.
Update employees
inner join departments ON empoyees.department_id=departments.id
SET employees.salary=40000
WHERE employees.salary>50000 and department.name='R&D'
MySql Query to delete employee record whose salary is greater than 50000 and department name is R&D.
DELETE employees
inner join departments ON empoyees.department_id=departments.id
WHERE employees.salary>50000 and department.name='R&D'
Updating Query Using Joins in PHP Script:
<?php
$host = 'localhost:3036';
$user = 'root';
$pass = 'rootpassword';
$conn = mysql_connect($host, $user, $pass);
mysql_select_db('sampledb');
$sql = "Update employees
join departments ON empoyees.department_id=departments.id
SET employees.salary=40000
WHERE employees.salary>50000 and department.name='R&D'";
$result = mysql_query( $sql, $conn );
echo "data updated successfully\n";
mysql_close($conn);
?>
Create Complex polygon on GMap using Google Maps API v3
Create Complex polygon on GMap using Google Maps API v3
In this Section, I will show you how to create polygon on gmap using Google Maps API v3 that has complex edges.This example creates polygon using polyline based on user clicks.I have written this script to create complex geofences.
This example provides everything you need to draw polylines and polygons.You can use the search box to search & zoom location on the map .
1. Click on the gmap to add a Marker.
2. Click on a Marker to remove it.
3. Drag a Marker to move it.
Getting Started :
/**
* Include the Google Maps API JavaScript using a script tag.
*/
/**
* The following code instructs the application to load the Maps API after the page has fully loaded .
*/
/**
* Search and Zoom Location on Map.
*/
}
Example :
This Example will help you to create any shape of polygons on gmap.In next article, I will show you how to integrate Gmaps in Drupal.
In this Section, I will show you how to create polygon on gmap using Google Maps API v3 that has complex edges.This example creates polygon using polyline based on user clicks.I have written this script to create complex geofences.
This example provides everything you need to draw polylines and polygons.You can use the search box to search & zoom location on the map .
How to Draw polygon on Gmap using Google Maps API v3. :
1. Click on the gmap to add a Marker.
2. Click on a Marker to remove it.
3. Drag a Marker to move it.
Getting Started :
/**
* Include the Google Maps API JavaScript using a script tag.
*/
<script type="text/javascript" src="http://maps.google.com/maps/api/js?sensor=false"></script>/**
* The following code instructs the application to load the Maps API after the page has fully loaded .
*/
function initialize() {
map = new google.maps.Map(document.getElementById("gmap"), {
zoom:13,
center: new google.maps.LatLng(18.520430, 73.856744),
mapTypeId: google.maps.MapTypeId.ROADMAP
});
p = new google.maps.Polygon({
strokeWeight: 3,
fillColor: '#5555FF'
});
p.setMap(map);
p.setPaths(new google.maps.MVCArray([path]));
google.maps.event.addListener(map, 'click', addMarker);
}
/** * Handles click events on a map, and adds a new point to the Polyline.*/
function addMarker(event) {
path.insertAt(path.length, event.latLng); //The path element used to draw polygon and polylines.
var marker = new google.maps.Marker({
position: event.latLng,
map: map,
draggable: true
});
markers.push(marker);
google.maps.event.addListener(marker, 'click', function() {
marker.setMap(null);
for (var i = 0, I = markers.length; i < I && markers[i] != marker; ++i);
markers.splice(i, 1);
path.removeAt(i);
}
);
google.maps.event.addListener(marker, 'dragend', function() {
for (var i = 0, I = markers.length; i < I && markers[i] != marker; ++i);
path.setAt(i, marker.getPosition());
}
);
}
/**
* Search and Zoom Location on Map.
*/
function findAddress(address) {
if (!address)
var address=document.getElementById("address").value;
if ((address != '') && geocoder) {
geocoder.geocode( { 'address': address}, function(results, status) {
if (status == google.maps.GeocoderStatus.OK) {
if (status != google.maps.GeocoderStatus.ZERO_RESULTS) {
if (results && results[0] && results[0].geometry && results[0].geometry.viewport)
map.fitBounds(results[0].geometry.viewport);
} else {
alert("No results found");
}
} else {
alert("Geocode was not successful for the following reason: " + status);
}
});
}
}
Example :
<html>
<title>Create Complex polygon on Gmap using Google Maps API v3</title>
<head>
<script type="text/javascript" src="http://maps.google.com/maps/api/js?sensor=false"></script>
<script type="text/javascript">
var poly, map;
var markers = [];
var path = new google.maps.MVCArray;
var geocoder = new google.maps.Geocoder();
function initialize() {
map = new google.maps.Map(document.getElementById("gmap"), {
zoom:13,
center: new google.maps.LatLng(18.520430, 73.856744),
mapTypeId: google.maps.MapTypeId.ROADMAP
});
p = new google.maps.Polygon({
strokeWeight: 3,
fillColor: '#5555FF'
});
p.setMap(map);
p.setPaths(new google.maps.MVCArray([path]));
google.maps.event.addListener(map, 'click', addMarker);
}
function addMarker(event) {
path.insertAt(path.length, event.latLng); //The path element used to draw polygon and polylines.
var marker = new google.maps.Marker({
position: event.latLng,
map: map,
draggable: true
});
markers.push(marker);
google.maps.event.addListener(marker, 'click', function() {
marker.setMap(null);
for (var i = 0, I = markers.length; i < I && markers[i] != marker; ++i);
markers.splice(i, 1);
path.removeAt(i);
}
);
google.maps.event.addListener(marker, 'dragend', function() {
for (var i = 0, I = markers.length; i < I && markers[i] != marker; ++i);
path.setAt(i, marker.getPosition());
}
);
}
function findAddress(address) {
if (!address)
var address=document.getElementById("address").value;
if ((address != '') && geocoder) {
geocoder.geocode( { 'address': address}, function(results, status) {
if (status == google.maps.GeocoderStatus.OK) {
if (status != google.maps.GeocoderStatus.ZERO_RESULTS) {
if (results && results[0] && results[0].geometry && results[0].geometry.viewport)
map.fitBounds(results[0].geometry.viewport);
} else {
alert("No results found");
}
} else {
alert("Geocode was not successful for the following reason: " + status);
}
});
}
}
</script>
</head>
<body style="margin:0px; padding:0px;" onLoad="initialize()">
Find Place: <input type="text" id="address"/><input type="button" value="Go" onClick="findAddress()">
<div id="gmap" style="width:100%; height: 580;"></div>
</body>
</html>
This Example will help you to create any shape of polygons on gmap.In next article, I will show you how to integrate Gmaps in Drupal.
