Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. Which part of an EKS cluster does AWS operate for you?

   1. AThe worker nodes
   2. BThe Kubernetes control plane (API server, etcd, scheduler, controllers)
   3. CYour pods
   4. DYour load balancers
   Show answer

   B. EKS runs and scales the control plane across AZs. You own the data plane (nodes or Fargate), add-on configuration and everything you deploy.

   From lesson 01 · AWS & EKS services and terms

2. Q2. What's the difference between an access entry and Pod Identity?

   1. AThey are the same
   2. BAccess entries decide who can call the Kubernetes API; Pod Identity gives pods AWS permissions
   3. CAccess entries are for pods, Pod Identity for people
   4. DBoth are ConfigMaps
   Show answer

   B. Two directions: IAM principal → Kubernetes (access entries), and Kubernetes ServiceAccount → IAM role (Pod Identity or IRSA).

   From lesson 01 · AWS & EKS services and terms

3. Q3. Why do most EKS worker nodes live in private subnets?

   1. APrivate subnets are cheaper
   2. BNodes don't need public IPs; inbound traffic comes through load balancers in public subnets, outbound through NAT or endpoints
   3. CEKS requires it
   4. DPods can't run in public subnets
   Show answer

   B. Keeping nodes private shrinks the attack surface. Public subnets hold internet-facing load balancers and NAT gateways.

   From lesson 01 · AWS & EKS services and terms

4. Q4. What is an EKS managed add-on?

   1. AAny Helm chart
   2. BA cluster component (e.g. VPC CNI, CoreDNS, kube-proxy, EBS CSI) whose install and version EKS manages through its API
   3. CA paid AWS support plan
   4. DA node group
   Show answer

   B. Managed add-ons are versioned and updated through the EKS API, with compatibility checks against the cluster version.

   From lesson 01 · AWS & EKS services and terms

5. Q5. In EKS, who operates etcd and the API servers?

   1. AYou
   2. BAWS: the control plane is managed and runs across multiple availability zones
   3. CKarpenter
   4. DThe VPC CNI
   Show answer

   B. AWS runs, scales, patches and backs up the control plane. You own the data plane, add-ons, workloads, IAM and networking design.

   From lesson 02 · EKS architecture & mental model

6. Q6. What happens if you stay on a Kubernetes version after its standard support ends?

   1. AThe cluster is deleted
   2. BIt moves to extended support (at extra cost), and eventually gets upgraded automatically when that ends
   3. CNothing ever
   4. DNodes stop working immediately
   Show answer

   B. EKS versions have standard support, then paid extended support. Planning regular upgrades avoids both cost and forced upgrades.

   From lesson 02 · EKS architecture & mental model

7. Q7. Which data-plane option launches right-sized EC2 nodes directly for pending pods, without predefined node groups?

   1. AManaged node groups
   2. BKarpenter
   3. CFargate
   4. DSelf-managed ASGs
   Show answer

   B. Karpenter reads pending pods' requirements and provisions matching instances, then consolidates. Node groups scale predefined ASGs.

   From lesson 02 · EKS architecture & mental model