Core Compute and Storage Services at a Glance
GCP's compute spectrum ranges from fully managed to fully controlled: Cloud Run and Cloud Functions for serverless containers/functions, App Engine for managed PaaS, GKE for orchestrated containers, and Compute Engine for raw VMs. Storage similarly spans Cloud Storage (object storage, tiered by access frequency into Standard, Nearline, Coldline, Archive), Persistent Disk (block storage for VMs), and Filestore (managed NFS) — picking the right one depends on access pattern, not just data size.
Cricket analogy: This spectrum is like choosing between franchise T20 (Cloud Run, fully managed, quick setup) and building your own domestic cricket board (Compute Engine, full control but full responsibility) — both get you cricket, at very different operational cost.
IAM and Networking Essentials
IAM in GCP follows a resource hierarchy — Organization > Folder > Project > Resource — where policies set higher up are inherited downward, and the effective permission for a user is the union of all bindings across that hierarchy (there's no explicit deny in basic IAM, only allow, aside from IAM Deny policies). Networking is built around VPCs that are global resources with regional subnets, firewall rules that are stateful and default-deny for ingress, and Cloud NAT for giving private instances outbound internet access without public IPs.
Cricket analogy: IAM inheritance is like a national cricket board's rules applying automatically to every state association and club beneath it, unless a specific override is granted at a lower level.
# Common gcloud commands quick reference
gcloud config set project PROJECT_ID
gcloud auth login
gcloud compute instances list
gcloud run deploy SERVICE --image IMAGE_URL --region REGION
gcloud iam service-accounts create SA_NAME
gcloud projects add-iam-policy-binding PROJECT_ID \
--member="serviceAccount:SA_NAME@PROJECT_ID.iam.gserviceaccount.com" \
--role="roles/storage.objectViewer"
gcloud compute firewall-rules list
gcloud logging read "resource.type=gce_instance" --limit 10gcloud config configurations let you maintain multiple named profiles (e.g., dev, staging, prod) and switch between them with gcloud config configurations activate <name>, avoiding accidental commands against the wrong project.
Pricing and Quota Essentials
Most GCP compute pricing follows a pay-as-you-go model with automatic Sustained Use Discounts on Compute Engine for VMs run most of the month, plus optional Committed Use Discounts (1 or 3 year) for predictable workloads offering up to ~57% savings. Quotas exist per-project and per-region (e.g., CPUs per region) to prevent runaway costs and accidental resource exhaustion, and can be viewed and requested for increase under IAM & Admin > Quotas in the console.
Cricket analogy: Committed use discounts are like buying a season pass to your home ground rather than paying full price per match — you commit upfront in exchange for a better per-unit rate.
Quota increases are not instant — regional CPU quota increase requests can take up to a few business days for review, so request increases well before a planned launch or load test, not the day of.
- Compute options range from fully managed (Cloud Run, App Engine) to fully controlled (Compute Engine); storage ranges from object (Cloud Storage) to block (Persistent Disk) to file (Filestore).
- IAM policies inherit down the Organization > Folder > Project > Resource hierarchy, with effective permission being the union of bindings.
- VPCs are global with regional subnets; firewall rules are stateful and default-deny for ingress; Cloud NAT enables outbound-only internet access.
- gcloud config configurations let you safely switch between dev/staging/prod profiles.
- Sustained Use Discounts apply automatically; Committed Use Discounts require a 1- or 3-year commitment for deeper savings.
- Quotas are enforced per-project and per-region and should be requested for increase well ahead of major launches.
- Cloud Storage has four access tiers — Standard, Nearline, Coldline, Archive — chosen by access frequency, not just cost.
Practice what you learned
1. What is the default ingress behavior of GCP VPC firewall rules?
2. What does Cloud NAT primarily provide?
3. How is effective IAM permission determined in the GCP resource hierarchy?
4. What differentiates Committed Use Discounts from Sustained Use Discounts?
5. Which Cloud Storage tier is designed for data accessed less than once a year?
Was this page helpful?
You May Also Like
GCP Interview Questions
Common Google Cloud interview questions with model answers, covering core services, IAM, networking, and architecture trade-offs.
The GCP Architecture Framework
An overview of Google Cloud's Architecture Framework pillars — system design, operational excellence, security, reliability, cost optimization, and performance — for building well-architected workloads.
Deploying a Simple App on GCP
A hands-on walkthrough of deploying a simple containerized web app to Cloud Run, covering build, deploy, environment configuration, and rollback.