AWS DevOps Container Services 5 — Questions and Answers
Question 1: Which EKS add-on provides the CNI plugin responsible for assigning VPC IP addresses directly to Kubernetes pods?
- CoreDNS
- kube-proxy
- Amazon VPC CNI (Correct answer)
- AWS Load Balancer Controller
Correct answer: Amazon VPC CNI
The Amazon VPC CNI plugin assigns each pod an IP address from the VPC subnet, enabling pods to communicate natively within the VPC.
Question 2: A DevOps engineer needs to ensure that only images from a specific ECR repository can be deployed to an ECS cluster. Which mechanism enforces this?
- ECS task placement constraints
- IAM task execution role with an explicit Deny for other registries (Correct answer)
- ECS service-level security groups
- CloudWatch Events rules on ECS task launches
Correct answer: IAM task execution role with an explicit Deny for other registries
An IAM policy on the ECS task execution role can explicitly deny pull actions on ECR repositories outside the approved list, enforcing image source control.
Question 3: In Amazon EKS, what is the purpose of IRSA (IAM Roles for Service Accounts)?
- It assigns IAM roles to EC2 worker nodes
- It maps Kubernetes service accounts to IAM roles, granting pods fine-grained AWS permissions (Correct answer)
- It authenticates kubectl users via IAM
- It controls EKS cluster endpoint access
Correct answer: It maps Kubernetes service accounts to IAM roles, granting pods fine-grained AWS permissions
IRSA uses OIDC federation to let individual Kubernetes pods assume specific IAM roles without sharing node-level credentials.
Question 4: When using AWS CodeBuild to build a Docker image in a CI/CD pipeline, which CodeBuild environment setting is required to run Docker commands?
- Enable GPU support
- Enable privileged mode in the build environment (Correct answer)
- Set the compute type to BUILD_GENERAL1_LARGE
- Use an ARM-based build image
Correct answer: Enable privileged mode in the build environment
Docker-in-Docker requires the CodeBuild environment to run with privileged mode enabled, which grants the build container elevated Linux capabilities.
Question 5: Which Kubernetes resource should a DevOps engineer use to store non-sensitive configuration data (e.g., environment variables) that pods can consume?
- Secret
- ConfigMap (Correct answer)
- PersistentVolumeClaim
- ServiceAccount
Correct answer: ConfigMap
ConfigMaps store non-sensitive key-value configuration that pods can consume as environment variables or mounted files, keeping config separate from the container image.
Question 6: What is the effect of setting 'minimumHealthyPercent: 100' and 'maximumPercent: 200' in an ECS rolling deployment configuration?
- ECS stops all existing tasks before launching new ones
- ECS launches new tasks alongside old ones, doubling capacity temporarily before draining old tasks (Correct answer)
- ECS deploys tasks only during off-peak hours
- ECS enforces a canary deployment with 1% initial traffic
Correct answer: ECS launches new tasks alongside old ones, doubling capacity temporarily before draining old tasks
With 100% minimum healthy and 200% maximum, ECS starts new tasks first (doubling capacity) and only terminates old tasks after the new ones pass health checks.
Question 7: Which tool is used to define, package, and deploy Kubernetes applications as versioned charts in EKS, simplifying complex manifest management?
- kubectl
- Helm (Correct answer)
- eksctl
- AWS CDK
Correct answer: Helm
Helm is the Kubernetes package manager that bundles manifests into charts with templating and versioning, making application deployments repeatable and configurable.
AWS DevOps Container Services 5
Which EKS add-on provides the CNI plugin responsible for assigning VPC IP addresses directly to Kubernetes pods?