Find Interview Questions for Palle technologies

Google Kubernetes Engine (GKE) is a managed service that allows you to run and manage containerized applications using Kubernetes. It automates tasks like deployment, scaling, and operations of application containers across clusters of hosts.

In contrast, Compute Engine provides virtual machines (VMs) that you can use to run applications and workloads without the container orchestration capabilities of Kubernetes. GKE focuses on container management, while Compute Engine focuses on VM management.

Google Compute Engine is a service that allows users to create and run virtual machines (VMs) on Google Cloud's infrastructure. To configure VMs, you can use the Google Cloud Console, the gcloud command-line tool, or the Compute Engine API to specify the machine type, operating system, disk size, network settings, and other configurations before launching the VM.

In Google Cloud Platform (GCP), firewall rules control the traffic to and from virtual machine (VM) instances. They are defined at the network level and specify allowed or denied traffic based on attributes like IP address ranges, protocols, and ports. Each rule can apply to specific targets, such as all instances in a network or specific instances with certain tags. By default, GCP allows all outbound traffic and denies all inbound traffic unless specified otherwise by the firewall rules.

The different types of networks in Google Cloud Platform (GCP) are:

1. **VPC Networks** (Virtual Private Cloud)
2. **Subnets** (Subnetworks)
3. **Peered Networks** (VPC Peering)
4. **Shared VPC Networks**
5. **Hybrid Connectivity** (VPN and Interconnect)
6. **Serverless VPC Access**
7. **Cloud VPN**
8. **Cloud Interconnect**

The different storage options in Google Cloud Platform (GCP) include:

1. Google Cloud Storage (Object Storage)
2. Google Persistent Disk (Block Storage)
3. Google Filestore (File Storage)
4. Google Bigtable (NoSQL Database)
5. Google Cloud SQL (Relational Database)
6. Google Cloud Spanner (Scalable Relational Database)
7. Google Firestore (NoSQL Document Database)
8. Google Cloud Datastore (NoSQL Database for web and mobile apps)

In AWS, role assumption using STS (Security Token Service) and AssumeRole allows a user or service to temporarily take on the permissions of a different IAM role. When a user or service calls the AssumeRole API, they specify the role ARN and any session parameters. AWS STS then returns temporary security credentials (access key, secret key, and session token) that can be used to access AWS resources with the permissions of the assumed role for a limited time.

Common IAM misconfigurations that lead to security risks include:

1. Excessive permissions granted to users or roles.
2. Lack of multi-factor authentication (MFA) for sensitive accounts.
3. Inactive accounts not being disabled or removed.
4. Weak password policies allowing easily guessable passwords.
5. Misconfigured access controls, allowing unauthorized access to resources.
6. Failure to regularly review and audit permissions and roles.
7. Hardcoded credentials in applications or scripts.
8. Not using role-based access control (RBAC) effectively.

The principle of least privilege means giving users and systems only the access they need to perform their tasks, minimizing potential risks. Zero trust is a security model that assumes no user or device is trustworthy by default, requiring verification for every access request, regardless of whether it originates from inside or outside the network.

Custom roles are user-defined roles that allow you to specify a set of permissions tailored to specific needs within an Identity and Access Management (IAM) system. You would create a custom role when the predefined roles do not meet your requirements, enabling you to grant only the necessary permissions to users for their specific tasks or responsibilities.

Multi-Factor Authentication (MFA) is a security process that requires users to provide two or more verification factors to gain access to a system or application. It is important because it adds an extra layer of security, making it harder for unauthorized users to access sensitive information, even if they have the user's password.