Answer: Google Cloud Platform and the broader cloud computing ecosystem consist of four primary levels or tiers:

• Infrastructure as a Service (IaaS): Establishes the fundamental virtualized hardware building blocks (e.g., VMs via Compute Engine, storage disks, virtual networks). Users manage the OS, runtimes, and apps.
• Platform as a Service (PaaS): Delivers pre-configured runtimes, middleware, and application development environments. The provider manages VM infrastructure, OS patches, and auto-scaling. Developers only deploy and configure code (e.g., App Engine, Cloud Run).
• Software as a Service (SaaS): Delivers a complete, cloud-hosted software application ready for end-user consumption (e.g., Google Workspace, BigQuery UI).
• Business Process Outsourcing (BPO): Represents the non-technical fourth tier. BPO involves delegating core business operations (like customer support, HR, or finance operations) to a third-party vendor that operates on top of SaaS/PaaS/IaaS platforms to deliver business value.

Answer:

1. OPEX over CAPEX: Eliminates high upfront capital expenditures (CAPEX) for physical servers, network cabling, cooling, and real estate, replacing them with variable operating expenses (OPEX).
2. Resource Pooling & Pay-As-You-Go: Resources are shared dynamically across Google's infrastructure. Organizations only pay for the exact compute, memory, and storage they consume, scaled to the minute.
3. Reduced IT Overhead: Offloads physical hardware maintenance, operating system patching, power management, and hardware security to the cloud provider, reducing the need for large on-site maintenance teams.
4. Elastic Auto-scaling: Scales down resources to zero or minimal instances when idle, preventing over-provisioning.

Answer: Eucalyptus (Elastic Utility Computing Architecture for Linking Your Programs to Useful Systems) is an open-source software platform used to build AWS-compatible private and hybrid cloud computing environments.

• It allows organizations to build private clouds on their own physical hardware using their existing server farms.
• Because it supports AWS APIs, developers can deploy and manage applications on-premises using the same tools they use on public clouds, making it a key historical tool for hybrid cloud deployments.

Answer:

• On-Premises Computing: Traditional IT setup where physical hardware, database servers, and network switches are located directly inside the company's local office or data center. The internal team is responsible for physical maintenance, cabling, virtualization, and scalability.
• Private Cloud: Cloud infrastructure dedicated exclusively to one organization. It can be hosted internally (on-premises) or hosted by a third-party provider at an offshore location. It provides on-demand self-service access, resource pooling, and elasticity similar to public clouds, but isolates the infrastructure for a single tenant.

Answer:

• Region: A specific geographic location where Google hosts its data centers (e.g., us-east1 in South Carolina, europe-west3 in Frankfurt).
• Zone: An isolated deployment area within a region. A zone represents one or more physical data centers. Zones have independent power, cooling, and network connections to ensure fault isolation. Every region has at least three (and up to four) zones (e.g., us-east1-b, us-east1-c, us-east1-d).
• Global Footprint: GCP operates over 35+ active regions spanning the Americas, Asia, Europe, and Australia, continuously expanding its global presence.

Answer: GCP organizes resources in a strict hierarchical structure to control governance and access permissions:

                  [ Domain (e.g., company.com) ]
                                 │
                                 ▼
                         [ Organization ]
                                 │
                                 ▼
                         [ Folders (Teams/Depts) ]
                                 │
                                 ▼
                         [ Projects (Resource Containers) ]
                                 │
                                 ▼
                         [ Resources (VMs, Buckets, DBs) ]

• Inheritance Rule: Permissions (IAM policies) applied at a parent level (e.g., Folder) are automatically inherited by all child resources (Projects, VMs) below it. Access cannot be blocked or overridden at a child level if it was granted at a parent level (no vice-versa inheritance).
• Resource Lifecycle: The lifecycle of a resource is bound to its parent. If you delete a project, all underlying resources (VMs, storage buckets) are deleted as well.

Answer: In Google Cloud, a Project is the fundamental administrative container for organizing, enabling APIs, managing billing, and controlling access to resources.

• Isolation: Projects act as independent domains. By default, resources in Project A cannot communicate with or share assets with Project B unless explicitly configured (via Shared VPC, VPC Peering, or IAM cross-project access).
• Billing Boundary: Every resource must belong to exactly one project, and billing is calculated at the project level.

Answer:

1. Google Cloud Console: A web-based graphical user interface (GUI) used to deploy, configure, and monitor resources manually.
2. Cloud SDK (gcloud CLI): A command-line interface tool installed locally to script and automate GCP resource management.
3. Cloud Shell: A free, browser-accessible, temporary Linux VM equipped with the Cloud SDK, Git, Terraform, and a built-in code editor.
4. Cloud APIs: RESTful APIs that allow custom application code to communicate with and control GCP services programmatically.
5. Third-Party Tools: Infrastructure as Code tools (like Terraform, Ansible, Pulumi) that manage GCP configurations through API endpoints.

Answer:

• Project Association: All GCP costs are billed to a Billing Account linked to specific projects. Resources inside a project generate usage charges, which are aggregated and charged to the project's billing profile.
• Resource Scope: Resources generate costs based on their deployment location (regional/zonal resources vs global resources), but their management and billing remain centralized within the project boundary.

Answer: Google Compute Engine (GCE) is GCP's IaaS virtual machine provider. It runs virtual machines on Google's infrastructure using the KVM hypervisor.

• Resource Allocation: Provides custom machine types (choose custom vCPU/RAM), live migration (moves running VMs to other physical hosts during maintenance without rebooting), and Spot/Preemptible VMs for low-cost, interruptible tasks.

Answer: Google App Engine (GAE) is a managed PaaS platform designed for building and deploying web applications quickly without operational overhead.

• App Engine Standard: Runs code inside secure, sandboxed language runtimes (Java, Python, Go, Node.js). It scales from 0 to thousands of instances in milliseconds, making it highly cost-effective for variable traffic.
• App Engine Flexible: Runs custom Docker containers on GCE virtual machines. It has slower boot times and cannot scale down to zero, but supports any language, binary, or custom library.

Answer: GKE is Google's managed Kubernetes service, providing an automated environment to run containerized workloads.

Deployment Steps:#

1. Create GKE Cluster: Provision the cluster master plane and worker nodes via Cloud Console or Terraform.
2. Build & Register Image: Compile the application into a container image and push it to Artifact Registry.
3. Write Deployment manifest: Write a Kubernetes YAML file defining pods, replicas, containers, environment variables, and ports.
4. Apply manifest: Run kubectl apply -f deployment.yaml to deploy pods to the cluster.
5. Expose Service: Deploy a Kubernetes Service of type: LoadBalancer or configure an Ingress resource to route internet traffic to the containers.

Answer:

• Cloud Run:
  • Concept: Serverless container platform. You supply a container, and Cloud Run provisions VMs, sets up load balancing, scales from 0 to thousands, and manages SSL certificates automatically.
  • Choose when: You have stateless web applications, simple API backends, or background microservices, and you want zero cluster infrastructure to manage.
• GKE:
  • Concept: Full-featured Kubernetes platform. You manage clusters, node configurations, network policies, and persistent storage templates.
  • Choose when: You have stateful workloads (databases), complex microservice architectures with custom sidecars, non-HTTP network protocols, or need fine-grained control over compute kernels and cluster configuration.

Answer: Workload Identity is the recommended way for applications running on GKE to authenticate against Google Cloud APIs.

• How it works: It maps a Kubernetes ServiceAccount (inside GKE) directly to a GCP IAM Service Account. When the pod runs, GKE automatically exchanges Kubernetes credentials for short-lived, temporary GCP OAuth tokens.
• Why it is preferred:
  • Eliminates the security risk of downloading static, long-lived JSON service account keys that can be leaked or committed to Git.
  • Zero manual key rotation overhead.
  • Provides granular, pod-level access control rather than node-level access.

Answer: Google Cloud Storage (GCS) is a highly durable, scalable object storage service for unstructured data.

• Role of a Bucket: A bucket is a flat container that holds your files (objects). To store any data in GCS, you must first create a bucket. Buckets have a globally unique name, define data access controls, set default storage classes, and determine the geographic location of the stored files.

Answer: Object Versioning keeps a history of modifications made to files in a bucket.

• Mechanism: When versioning is enabled, overwriting or deleting an object does not delete it permanently. Instead, GCS retains the original file as a noncurrent version, assigning it a unique generation number, and creates a new current version.
• Safety: Allows complete recovery from accidental deletions or programmatic overwrite bugs.
• Note: Noncurrent versions incur standard storage charges, so use lifecycle policies to delete older versions after a set number of days.

Answer:

• BigQuery:
  • Type: Serverless, columnar data warehouse (OLAP - Online Analytical Processing).
  • Best for: Running complex SQL queries over petabytes of analytical data, data warehousing, BI dashboards, and ML analysis.
• Cloud SQL:
  • Type: Managed relational database for MySQL, PostgreSQL, and SQL Server (OLTP - Online Transaction Processing).
  • Best for: Application backends needing fast real-time read/write transactions, consistency, and structured data storage (e.g., e-commerce orders, user profiles).

Answer:

1. Provision Instance: Create a Cloud SQL instance, choosing the DB engine (MySQL, PostgreSQL, SQL Server), storage type (SSD/HDD), and capacity configuration.
2. High Availability (HA): Enable HA to deploy a standby instance in a different zone with synchronous replication.
3. Scaling: Scale compute vertically (adjust vCPUs and RAM) or scale storage horizontally by enabling storage auto-increase to expand disk space automatically when usage approaches limits.
4. Read Replicas: Deploy read replicas to scale read traffic geographically and reduce load on the primary instance.
5. Backups: Enable automated daily backups and write binary logs to facilitate Point-in-Time Recovery (PITR).

Answer: Cloud Dataproc is a fully managed service for running Apache Spark, Hadoop, Presto, and Flink clusters on GCP.

• Efficiency: Dataproc allows you to spin up cluster nodes in less than 90 seconds (compared to 10+ minutes on-premises).
• Cost Savings: Supports preemptible/spot VMs for worker nodes and allows setting up ephemeral clusters that spin up to run a job, output results to GCS, and immediately tear themselves down.

Answer: Cloud Composer is a fully managed workflow orchestration service built on Apache Airflow.

• Role: Used to author, schedule, and monitor complex workflows. It connects and coordinates data engineering tasks (such as triggering a Dataproc job, running a BigQuery SQL script, and moving files in GCS) across cloud systems using Directed Acyclic Graphs (DAGs) written in Python.

Answer: A Virtual Private Cloud (VPC) is a logically isolated virtual network where you run VMs, GKE clusters, and databases.

• Global Scope: Unlike AWS where a VPC is confined to one region, a GCP VPC is global. A single VPC can have subnetworks in different regions (e.g., us-central1 and asia-east1) without requiring VPN tunnels or complex routing peering configurations.

Answer: VPC Network Peering connects two VPC networks privately using internal IP addresses.

• Overlapping Subnets: Peering setup will fail if any subnets in the two networks have overlapping IP ranges.
• Non-Transitive: Peering is not transitive. If VPC A is peered with VPC B, and VPC B is peered with VPC C, VPC A cannot access VPC C without a direct peering link between A and C.

Answer: Private Service Connect (PSC) allows you to privately access Google APIs or services hosted in a different tenant VPC.

• It provisions a private endpoint (internal IP address) in your local VPC.
• Traffic to this endpoint travels entirely over Google's internal network, preventing data from traversing the public internet.

Answer: Cloud VPN connects on-premises networks to GCP VPCs securely via IPsec VPN tunnels.

• HA VPN: Google provisions two active public IP endpoints in different zones, guaranteeing 99.99% SLA. It dynamically routes traffic using Cloud Routers and BGP.
• Classic VPN: Single routing tunnel. Deprecated and should only be used for legacy connections or simple testing.

Answer: Cloud Interconnect provides direct, physical, high-bandwidth connections between your on-premises network and GCP.

• Dedicated Interconnect: Direct physical link to a Google edge facility (10 Gbps or 100 Gbps). Best for large enterprises transferring massive daily volumes of data.
• Partner Interconnect: Physical connection routed through a certified third-party service provider (50 Mbps to 10 Gbps). Best for organizations that do not co-locate in a Google edge facility.

Answer: VPC Firewall Rules allow or block traffic to VM instances.

• Network Tags: Label tags attached to VMs. They are simple to use but less secure because any user with VM write permissions can change tags and bypass rules.
• Service Accounts: Rules apply based on the service account identity of the VM. This is cryptographically secure because running a VM under a specific service account requires strict IAM permissions.

Answer: Routes define where traffic is forwarded for specific destination IP ranges.

• Propagation: Cloud Router uses BGP to dynamically advertise and learn routes from your on-premises routers over Cloud VPN or Interconnect, automatically updating the VPC routing table.

Answer: Alias IP Ranges assign multiple internal IP addresses to a single VM network interface.

• GKE Benefit: Used in VPC-native clusters. GKE pods receive unique alias IPs, allowing them to route traffic directly across the VPC without VM-level NAT translations, enhancing network performance and security.

Answer: A VM needs multi-NIC configurations when acting as a network virtual appliance (like firewalls, NAT gateways, or load balancers) that needs to bridge and route traffic between isolated VPC networks.

• Rules: NICs must be configured when the VM is created; each interface must connect to a different VPC network; and IP ranges cannot overlap.

Answer: Shared VPC allows multiple projects in an organization to share a single central VPC network.

• Host Project: Managed by network admins. Houses the shared VPC, subnets, and firewalls.
• Service Projects: Managed by developers. They deploy VMs and GKE clusters into host subnets but have no control over network rules.

Answer:

• Global HTTPS Load Balancer: Layer 7 load balancer using a single Anycast IP. It terminates SSL and routes HTTP traffic globally based on URL paths and proximity.
• Regional Network Load Balancer: Layer 4 load balancer routing raw TCP/UDP traffic within a single region. Highly performant with minimal latency.

Answer:

• External: Has a public IP and routes traffic from the public internet to your GCP backends.
• Internal: Has a private internal IP and routes traffic inside your VPC.
• Use Case: Use an Internal HTTP(S) Load Balancer to distribute traffic between frontend web VMs and private backend microservice APIs.

Answer: Private Google Access allows VMs without public IPs to access Google APIs (like GCS or BigQuery) over Google's internal network. You enable it at the subnet level.

Answer:

• Premium Tier: Routes traffic globally over Google's private fiber network, entering/exiting Google's network at the edge PoP closest to the user.
• Standard Tier: Routes traffic over the public internet, entering/exiting Google's network only when it reaches the destination region PoP.
• Choose Standard: For cost-sensitive applications where slight latency increases are acceptable.

Answer: GCP achieves high availability through:

1. Multi-region deployments: Running compute instances across multiple regions.
2. Global Load Balancing: Automatically failover traffic to healthy regions if a region goes down.
3. Globally Consistent Databases: Services like Cloud Spanner maintain synchronous replication across regional boundaries.

Answer: IAM Conditions allow applying conditional access control rules to resource permissions based on context, such as:

• Time/Date: Access is granted only during business hours.
• IP Range: Access is granted only from corporate network IPs.
• Resource Name: Access is granted only to specific GCS buckets or VM prefixes.
• Benefit: Enables zero-trust access control by ensuring developers have permissions only when and where required.

Answer:

1. Define Hierarchy: Organize resources using Domain, Org, Folders, and Projects.
2. Assign Roles: Assign predefined or custom roles instead of primitive roles.
3. Enable MFA: Enforce Multi-Factor Authentication on all user accounts.
4. Use Groups: Map IAM roles to Google Groups rather than individuals.
5. Audit Logs: Enable Admin Activity and Data Access audit logs to track permissions.

Answer:

• In Transit: Encrypts data automatically using TLS/HTTPS protocols.
• At Rest: Encrypts data by default before writing it to disk. Keys are managed by Google (default) or you can use Customer-Managed Encryption Keys (CMEK) via Cloud KMS or Cloud HSM.

Answer:

• Terraform: The industry-standard multi-cloud IaC tool using HCL configuration files. Best for managing GCP resources alongside other third-party cloud integrations.
• Cloud Deployment Manager: GCP's native IaC service using YAML, Python, or Jinja2 templates.
• Google Cloud SDK / CLI: Scripting deployment commands using gcloud or gsutil.
• Kubernetes Configs: Managing container configurations using YAML manifests.

Answer:

1. Define Metrics: Select key indicators like the Four Golden Signals (Latency, Traffic, Errors, Saturation).
2. Set Up Cloud Logging: Export structured logs (JSON) from application components and capture system logs.
3. Configure Monitoring: Set up dashboards in Cloud Monitoring showing resource limits and CPU/RAM usage.
4. Alerting: Write alerting policies that trigger when SLOs are violated, routing notifications to Slack or PagerDuty.
5. Review: Regularly audit logs and adjust thresholds to prevent alert fatigue.

Answer:

• CI/CD Pipeline Design: Building, testing, and deploying pipelines using Cloud Build, Artifact Registry, and Google Cloud Deploy.
• Infrastructure Provisioning: Automating GCP resource creation using Terraform.
• Monitoring & Alerting: Designing dashboards and configuring alert thresholds.
• Reliability Management: Working with developers to set SLOs/SLIs and manage error budgets.
• Security Hardening: Enforcing network boundaries, IAM permissions, and secret rotation.

Answer:

• SLI: A quantitative measure of a service's performance (e.g., the proportion of successful HTTP requests).
• SLO: A target reliability goal for the SLI (e.g., "99.9% of requests must succeed over a 30-day window").
• Relationship: You monitor the SLI in Cloud Monitoring to calculate whether the system is operating within the SLO and calculate the remaining error budget.

Answer:

• Training & Budget: Provide resources for certifications and training.
• Informal Learning: Set aside time for team knowledge-sharing sessions.
• Failing Safely: Treat mistakes as learning opportunities.
• Blameless Post-Mortems: When an incident occurs, focus on how the system failed and how to prevent it, rather than blaming the engineer who made the commit.

Answer:

1. Admin Activity Audit Logs: Capture API calls or administrative actions that modify resource configurations (e.g., creating a VM, deleting a bucket). Enabled by default.
2. Data Access Audit Logs: Capture API calls that read resource configurations or read/write user-provided data (e.g., reading a GCS file, querying BigQuery). Disabled by default due to high volume.
3. System Event Audit Logs: Capture system administrative events executed by Google (e.g., migrating a VM during maintenance).
4. Policy Denied Audit Logs: Capture events where a user or service account was denied access due to an IAM policy or security constraint.

Answer:

• Billing Reports: Monitor costs using Cloud Billing reports and set budget alerts.
• Resource Optimization: Downsize idle or oversized VMs using GCP Recommender.
• Auto-scaling: Set scaling policies to shut down resources when traffic is low.
• Committed Use Agreements: Leverage CUDs for predictable, long-term workloads.
• Spot Instances: Use Spot VMs for non-critical batch processing.

Answer: An Error Budget is the allowable downtime or failure rate of an application, calculated as: $$\text{Error Budget} = 100% - \text{SLO}$$

• Balance: If the error budget is full, the team can deploy new features quickly. If the error budget is depleted, deployments are halted, and resources are redirected to system stability.

Answer: Alert Fatigue occurs when engineers are overwhelmed by a high volume of frequent, low-priority, or non-actionable alerts, causing them to ignore critical incidents.

• Prevention: Alert on user-facing symptoms (SLO violations) rather than resource metrics, write clear runbooks for every alert, and route low-priority warnings to tickets instead of waking up engineers.

Answer: Dynamic Blocks allow you to generate repeated nested blocks within a resource dynamically based on a variable list or map.

• Use Case: Dynamically generating multiple ingress ports or IP ranges in a GCP firewall rule based on a configuration map.

Answer:

• Store secrets inside Secret Manager.
• Configure the Cloud Build service account to access Secret Manager using IAM.
• Retrieve the secret dynamically inside the pipeline execution step, preventing credentials from being exposed in source code or build logs.

Answer: The Strangler Fig Pattern is a migration strategy where a legacy monolithic application is gradually replaced by microservices.

• Implementation: Deploy a GCP Global HTTPS Load Balancer in front of the monolith. As you rebuild endpoints as microservices on GKE or Cloud Run, update the Load Balancer's URL map to route traffic for those specific paths (e.g., /api/payments) to the new microservice, keeping the rest of the traffic directed to the monolith.

Options:

• A) Cloud SQL
• B) Cloud Storage (Correct)
• C) BigQuery
• D) Cloud Spanner Explanation: Cloud Storage is the object storage service in GCP designed for storing unstructured data (like files, images, backups, and logs) with high durability and scalability.

Options:

• A) Compute Engine (Correct)
• B) App Engine
• C) Cloud Functions
• D) Cloud Run Explanation: Compute Engine is the Infrastructure as a Service (IaaS) offering that allows you to run virtual machines on Google's physical infrastructure.

Options:

• A) Google Key Encryptor
• B) Google Kernel Engine
• C) Google Kubernetes Engine (Correct)
• D) Global Kubernetes Endpoint Explanation: GKE stands for Google Kubernetes Engine, a managed environment for deploying, scaling, and managing containerized applications using Kubernetes.

Options:

• A) BigQuery (Correct)
• B) Cloud SQL
• C) Firestore
• D) Memorystore Explanation: BigQuery is a serverless, highly scalable, and cost-effective multi-cloud data warehouse designed for business intelligence and data analytics.

Options:

• A) Object storage
• B) Managed SQL
• C) Monitoring & logging
• D) Messaging and event ingestion (publish/subscribe) (Correct) Explanation: Cloud Pub/Sub is an asynchronous messaging service designed for event ingestion and delivery in event-driven, decoupled microservice architectures.

Options:

• A) Viewer
• B) Editor
• C) Owner (Correct)
• D) Billing Admin Explanation: The Owner primitive role grants full administrative control over all resources in a project, including managing roles/permissions and billing associations.

Options:

• A) Coldline
• B) Standard (Correct)
• C) Archive
• D) Nearline Explanation: The Standard storage class is designed for storing frequently accessed data requiring low-latency access, with no minimum storage duration or retrieval fees.

Options:

• A) Cloud Functions (Correct)
• B) Compute Engine
• C) Cloud SQL
• D) BigQuery Explanation: Cloud Functions is a serverless Function-as-a-Service (FaaS) platform designed to run small snippets of code triggered by HTTP requests or cloud events.

Options:

• A) BigQuery
• B) Cloud Storage
• C) Cloud Spanner
• D) Cloud SQL (Correct) Explanation: Cloud SQL is a fully managed relational database service supporting MySQL, PostgreSQL, and SQL Server databases.

Options:

• A) Network TCP/UDP Load Balancer
• B) Internal Load Balancer
• C) HTTP(S) Load Balancer (Global) (Correct)
• D) SSL Proxy Load Balancer Explanation: GCP's Global External HTTP(S) Load Balancer routes traffic to the nearest healthy region globally using a single Anycast IP address, terminating SSL connections at the edge.