Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. Why is a /24 VPC usually a mistake for EKS?

   1. AIt's too expensive
   2. BWith the VPC CNI every pod takes a VPC IP, so 256 addresses run out after a few nodes
   3. CEKS needs IPv6
   4. DIt doesn't support NAT
   Show answer

   B. Pods consume VPC addresses. Size the VPC (and plan a secondary pod CIDR) for the pod count, not the node count.

   From lesson 03 · AWS account & VPC for EKS

2. Q2. Which subnet tag makes the AWS Load Balancer Controller place an internet-facing ALB in a subnet?

   1. Akubernetes.io/role/internal-elb = 1
   2. Bkubernetes.io/role/elb = 1
   3. Ceks.amazonaws.com/public = true
   4. DNo tag is used
   Show answer

   B. Public subnets get kubernetes.io/role/elb=1, private subnets kubernetes.io/role/internal-elb=1, so the controller can discover them automatically.

   From lesson 03 · AWS account & VPC for EKS

3. Q3. What's the main reason to add VPC endpoints for ECR, S3 and STS?

   1. AThey're required for EKS
   2. BImage pulls and credential calls stay on the AWS network: cheaper than NAT data processing, and they enable private clusters
   3. CThey make pods faster to start
   4. DThey replace security groups
   Show answer

   B. Endpoints remove NAT data charges for heavy traffic like image pulls and let nodes in isolated subnets reach AWS services.

   From lesson 03 · AWS account & VPC for EKS

4. Q4. One NAT gateway per AZ or a single shared one?

   1. AAlways one shared
   2. BOne per AZ in production: a single NAT is a cross-AZ single point of failure and adds cross-AZ data charges
   3. CNAT isn't needed
   4. DTwo per AZ
   Show answer

   B. Per-AZ NAT keeps each AZ independent. A single NAT is fine for dev to save cost.

   From lesson 03 · AWS account & VPC for EKS

5. Q5. Pods are Pending with 'failed to assign an IP address to container', but nodes have spare CPU. Likely cause?

   1. ADNS
   2. BIP exhaustion: the node's ENI/IP limit or the subnet's free addresses have run out
   3. CRBAC
   4. DImage pulls
   Show answer

   B. With the VPC CNI every pod needs a VPC IP. Either the instance's ENI capacity or the subnet itself is exhausted.

   From lesson 04 · VPC CNI & IP planning

6. Q6. What does prefix delegation change?

   1. APods get IPv6
   2. BEach ENI slot holds a /28 prefix (16 addresses) instead of one IP, greatly increasing pods per node
   3. CPods share the node IP
   4. DIt disables security groups
   Show answer

   B. Nitro instances can attach prefixes to ENIs. Many more pods fit per node, but subnets need free, contiguous /28 blocks.

   From lesson 04 · VPC CNI & IP planning

7. Q7. Why put pods in a secondary CIDR such as 100.64.0.0/16?

   1. AIt's faster
   2. BTo give pods lots of address space without consuming the scarce, routable corporate ranges used by nodes and other systems
   3. CIt's required by EKS
   4. DTo make pods public
   Show answer

   B. The 100.64.0.0/10 range (reserved for carrier-grade NAT) is commonly used for pod subnets; pods reach other networks through the nodes' addresses.

   From lesson 04 · VPC CNI & IP planning

8. Q8. Your security team wants the Kubernetes API unreachable from the internet. What do you configure?

   1. AA security group on the nodes
   2. BPrivate endpoint access on, public endpoint access off (reach it over VPN, Direct Connect or a bastion/CI inside the VPC)
   3. CA NetworkPolicy
   4. DFargate
   Show answer

   B. Endpoint access is a cluster setting. With only private access, the API is reachable from inside the VPC and connected networks.

   From lesson 05 · The EKS cluster: control plane, compute & add-ons

9. Q9. When is Fargate a poor fit?

   1. AFor small batch jobs
   2. BFor DaemonSets, GPU workloads, privileged pods or very high pod density
   3. CFor isolated workloads
   4. DFor web APIs
   Show answer

   B. Fargate runs one pod per micro-VM: no DaemonSets, no privileged containers, no GPUs, and per-pod pricing. Great for isolation and small footprints, not for everything.

   From lesson 05 · The EKS cluster: control plane, compute & add-ons

10. Q10. What does EKS Auto Mode take over compared with a classic cluster?

    1. ANothing, it's a pricing tier
    2. BNode provisioning and lifecycle (Karpenter-based), plus core storage, load-balancing and networking components
    3. COnly upgrades of the control plane
    4. DYour application deployments
    Show answer

    B. Auto Mode manages compute, and the components for block storage and load balancing, so you run fewer add-ons yourself, at an extra per-instance cost and with less low-level control.

    From lesson 05 · The EKS cluster: control plane, compute & add-ons

11. Q11. Which add-ons does practically every EKS cluster need?

    1. AIstio and Kafka
    2. BVPC CNI, CoreDNS and kube-proxy, plus usually EBS CSI, Pod Identity Agent and metrics-server
    3. COnly CoreDNS
    4. DNone
    Show answer

    B. Networking, DNS and service routing are required; storage, pod credentials and resource metrics are needed by almost every real platform.

    From lesson 05 · The EKS cluster: control plane, compute & add-ons

12. Q12. A pod needs to read one S3 prefix. What's the recommended way on a new EKS cluster?

    1. AAdd S3 permissions to the node role
    2. BCreate an IAM role trusting pods.eks.amazonaws.com with a least-privilege policy, and a Pod Identity association for the pod's ServiceAccount
    3. CPut access keys in a Secret
    4. DUse the cluster role
    Show answer

    B. Pod Identity gives each ServiceAccount its own short-lived role credentials. The node role is shared by every pod on the node, and static keys leak.

    From lesson 06 · IAM & governance: access entries, Pod Identity, IRSA, policies

13. Q13. What does the authentication mode API_AND_CONFIG_MAP allow?

    1. AOnly aws-auth
    2. BBoth access entries and the legacy aws-auth ConfigMap, so you can migrate without downtime
    3. COnly IRSA
    4. DAnonymous access
    Show answer

    B. It's the migration mode: create access entries for everything in aws-auth, verify, then switch to API. You can't go back from API to CONFIG_MAP.

    From lesson 06 · IAM & governance: access entries, Pod Identity, IRSA, policies

14. Q14. Where does a Pod Identity role's trust policy point?

    1. AAt the cluster's OIDC provider
    2. BAt the service principal pods.eks.amazonaws.com, allowing sts:AssumeRole and sts:TagSession
    3. CAt the node role
    4. DAt the account root
    Show answer

    B. Pod Identity uses one fixed service principal, so the same role can be reused across clusters. IRSA trusts each cluster's own OIDC provider instead.

    From lesson 06 · IAM & governance: access entries, Pod Identity, IRSA, policies

15. Q15. Why set the IMDSv2 hop limit to 1 on worker nodes?

    1. AIt speeds up the metadata service
    2. BPods on the pod network can't reach the node's instance metadata, so they can't borrow the node role's credentials
    3. CIt's required for Fargate
    4. DIt enables IRSA
    Show answer

    B. With a hop limit of 1 the metadata response can't cross the extra network hop into a pod's namespace. Pods then only have the credentials you gave them explicitly.

    From lesson 06 · IAM & governance: access entries, Pod Identity, IRSA, policies

16. Q16. Which is a governance control rather than an identity control?

    1. AAn access entry
    2. BA ResourceQuota plus a Kyverno policy requiring resource limits and approved registries
    3. CA Pod Identity association
    4. DAn IAM trust policy
    Show answer

    B. Identity decides who can act; governance bounds what they can do and consume: quotas, admission policies, tagging, audit and cost controls.

    From lesson 06 · IAM & governance: access entries, Pod Identity, IRSA, policies

17. Q17. What's a permissions boundary for?

    1. AEncrypting a role
    2. BCapping the maximum permissions a role can ever have, so teams can create roles without escalating beyond the cap
    3. CReplacing SCPs
    4. DSetting session duration
    Show answer

    B. Delegated role creation is safe when every created role must carry a boundary that limits its effective permissions.

    From lesson 06 · IAM & governance: access entries, Pod Identity, IRSA, policies

18. Q18. What does target-type: ip mean for an ALB created by the controller?

    1. AThe ALB gets a static IP
    2. BThe ALB sends traffic directly to pod IPs (registered in the target group), skipping NodePorts
    3. COnly IPv6 is used
    4. DPods get public IPs
    Show answer

    B. With the VPC CNI, pods have VPC IPs, so the ALB can target them directly: fewer hops, and better health checking.

    From lesson 07 · Ingress: ALB, NLB and the Load Balancer Controller

19. Q19. How do several Ingresses share one ALB (and one bill)?

    1. AThey can't
    2. BGive them the same alb.ingress.kubernetes.io/group.name annotation (IngressGroup)
    3. CUse the same namespace
    4. DUse a NodePort
    Show answer

    B. IngressGroups merge rules from multiple Ingresses into one ALB. Group only Ingresses with the same trust level.

    From lesson 07 · Ingress: ALB, NLB and the Load Balancer Controller

20. Q20. The controller logs 'unable to resolve at least one subnet'. What's missing?

    1. AAn ACM certificate
    2. BSubnet tags (kubernetes.io/role/elb or internal-elb) or explicit subnet annotations
    3. CA PDB
    4. DCoreDNS
    Show answer

    B. The controller discovers subnets by tag. Tag your public and private subnets in Terraform when you create the VPC.

    From lesson 07 · Ingress: ALB, NLB and the Load Balancer Controller

21. Q21. How do EKS nodes get permission to pull from ECR in the same account?

    1. AThrough a Kubernetes imagePullSecret
    2. BThe node IAM role has an ECR pull policy; the kubelet uses it automatically
    3. CECR is public
    4. DVia Pod Identity
    Show answer

    B. Image pulls are done by the kubelet with the node role, so no pull secrets are needed for ECR in the same account (cross-account needs a repository policy too).

    From lesson 08 · ECR & application deployment

22. Q22. Why make ECR tags immutable?

    1. AIt saves storage
    2. BA tag like 1.4.0 can then never be overwritten, so what was tested is exactly what runs
    3. CScanning requires it
    4. DIt speeds up pulls
    Show answer

    B. Mutable tags let a re-push silently change what production runs. Immutable tags (or deploying by digest) make releases reproducible.

    From lesson 08 · ECR & application deployment

23. Q23. A rolling update briefly drops traffic even though pods start fine. What's the most likely missing piece?

    1. AMore replicas
    2. BA readiness probe, so new pods get traffic only when they can serve it (plus a preStop delay for draining)
    3. CA bigger node
    4. DA LoadBalancer Service
    Show answer

    B. Without readiness, pods receive traffic as soon as they start. Without a short preStop delay, terminating pods can still be in the load balancer's target list.

    From lesson 08 · ECR & application deployment

24. Q24. What does a PodDisruptionBudget protect against?

    1. ACrashes
    2. BVoluntary disruptions (node drains during upgrades, Karpenter consolidation) taking down too many replicas at once
    3. COOM kills
    4. DImage pull failures
    Show answer

    B. PDBs make drains and consolidation wait so that at least minAvailable replicas keep serving.

    From lesson 08 · ECR & application deployment

25. Q25. Why must the gp3 StorageClass use volumeBindingMode: WaitForFirstConsumer on EKS?

    1. Agp3 requires it
    2. BEBS volumes are zonal; waiting until the pod is scheduled creates the volume in the pod's AZ
    3. CIt's faster
    4. DIt enables encryption
    Show answer

    B. With Immediate binding, the volume could land in an AZ where the pod can't run, leaving it stuck.

    From lesson 09 · Storage: EBS, EFS and S3

26. Q26. Which option gives pods in different AZs a shared read-write filesystem?

    1. Agp3
    2. BEFS with the EFS CSI driver
    3. CInstance store
    4. Dio2
    Show answer

    B. EFS is regional NFS supporting ReadWriteMany; EBS attaches to one node in one AZ.

    From lesson 09 · Storage: EBS, EFS and S3

27. Q27. How should the EBS CSI driver get permission to create volumes?

    1. AAdmin credentials in a Secret
    2. BA least-privilege IAM role for its ServiceAccount via Pod Identity or IRSA
    3. CThe node role with full EC2 access
    4. DNo permissions needed
    Show answer

    B. The controller calls EC2 APIs. A dedicated role (AWS provides a managed policy for it) keeps those permissions off every node.

    From lesson 09 · Storage: EBS, EFS and S3

28. Q28. What triggers Karpenter to launch a node?

    1. ACPU usage over 80%
    2. BPods that the scheduler can't place (Pending/unschedulable)
    3. CA cron schedule
    4. DThe HPA
    Show answer

    B. Karpenter watches unschedulable pods, computes what capacity they need (resources, zones, architecture, taints) and launches matching instances.

    From lesson 10 · Autoscaling: HPA & Karpenter

29. Q29. What does consolidation do?

    1. AMerges clusters
    2. BRemoves empty or under-used nodes, or replaces them with cheaper ones, when their pods can run elsewhere
    3. CCompresses images
    4. DAdds Spot instances only
    Show answer

    B. Consolidation is how Karpenter saves money continuously, bounded by disruption budgets and PDBs.

    From lesson 10 · Autoscaling: HPA & Karpenter

30. Q30. Why does Karpenter need an interruption queue (SQS) for Spot?

    1. ATo store logs
    2. BTo receive EC2 interruption warnings and rebalance events, so it can cordon and drain nodes before AWS reclaims them
    3. CFor billing
    4. DTo launch nodes faster
    Show answer

    B. Spot instances get a two-minute warning. Handling it gives pods time to move gracefully.

    From lesson 10 · Autoscaling: HPA & Karpenter