AWS DevOps Container Services 5

Question 1

Which EKS add-on provides the CNI plugin responsible for assigning VPC IP addresses directly to Kubernetes pods?

Accepted Answer

Amazon VPC CNI

Answer

The Amazon VPC CNI plugin assigns each pod an IP address from the VPC subnet, enabling pods to communicate natively within the VPC.

Question 2

A DevOps engineer needs to ensure that only images from a specific ECR repository can be deployed to an ECS cluster. Which mechanism enforces this?

Accepted Answer

IAM task execution role with an explicit Deny for other registries

Answer

An IAM policy on the ECS task execution role can explicitly deny pull actions on ECR repositories outside the approved list, enforcing image source control.

Question 3

In Amazon EKS, what is the purpose of IRSA (IAM Roles for Service Accounts)?

Accepted Answer

It maps Kubernetes service accounts to IAM roles, granting pods fine-grained AWS permissions

Answer

IRSA uses OIDC federation to let individual Kubernetes pods assume specific IAM roles without sharing node-level credentials.

Question 4

When using AWS CodeBuild to build a Docker image in a CI/CD pipeline, which CodeBuild environment setting is required to run Docker commands?

Accepted Answer

Enable privileged mode in the build environment

Answer

Docker-in-Docker requires the CodeBuild environment to run with privileged mode enabled, which grants the build container elevated Linux capabilities.

Question 5

Which Kubernetes resource should a DevOps engineer use to store non-sensitive configuration data (e.g., environment variables) that pods can consume?

Accepted Answer

ConfigMap

Answer

ConfigMaps store non-sensitive key-value configuration that pods can consume as environment variables or mounted files, keeping config separate from the container image.

AWS Practice Test

AWS Practice Test

AWS DevOps Container Services 5