Amazon EKS — CI/CD & GitOps Practice Questions
Test your understanding of CI/CD pipelines and GitOps on EKS.
Q1. What is the recommended way to authenticate GitHub Actions to AWS for EKS deployments?
- A. Store AWS access keys as GitHub secrets
- B. Use OIDC federation with IAM roles
- C. Use an EC2 instance profile on the runner
- D. Embed credentials in the workflow file
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Incorrect — long-lived credentials are a security risk and should be avoided |
| B | ✅ Correct — OIDC federation issues short-lived tokens; no stored credentials needed |
| C | Incorrect — GitHub-hosted runners are not EC2 instances |
| D | Incorrect — hardcoded credentials in code are a critical security violation |
Q2. What ECR image tag mutability setting should you use for production?
- A. MUTABLE
- B. IMMUTABLE
- C. VERSIONED
- D. LOCKED
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Incorrect — mutable tags allow overwriting, breaking deployment reproducibility |
| B | ✅ Correct — IMMUTABLE ensures a tag always points to the same image digest |
| C | Incorrect — VERSIONED is not a valid ECR setting |
| D | Incorrect — LOCKED is not a valid ECR setting |
Q3. What is the key difference between push-based CI/CD and pull-based GitOps?
- A. Push-based is faster
- B. Pull-based requires external cluster access
- C. Pull-based provides continuous drift detection and reconciliation
- D. Push-based is more secure
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | Incorrect — speed depends on implementation, not the model |
| B | Incorrect — pull-based agents run inside the cluster, no external access needed |
| C | ✅ Correct — GitOps agents continuously compare Git state with cluster state and reconcile drift |
| D | Incorrect — pull-based is generally more secure since no external kubectl access is needed |
Q4. In ArgoCD, what does selfHeal: true do?
- A. Restarts crashed pods automatically
- B. Reverts manual changes in the cluster to match Git
- C. Fixes broken Helm releases
- D. Auto-repairs failed syncs
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Incorrect — Kubernetes handles pod restarts via liveness probes, not ArgoCD |
| B | ✅ Correct — selfHeal detects and reverts any manual changes made directly to clutser resources |
| C | Incorrect — ArgoCD doesn’t fix Helm chart issues; it reconciles to the desired state in Git |
| D | Incorrect — failed syncs require fixing the source manifests, not self-heal |
Q5. Which Flux CRD is used to deploy Kubernetes manifests from a Git repository?
- A. GitRepository
- B. Kustomization
- C. HelmRelease
- D. Deployment
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Incorrect — GitRepository defines the source but doesn’t deploy anything |
| B | ✅ Correct — Kustomization references a GitRepository and applies manifests from a specified path |
| C | Incorrect — HelmRelease deploys Helm charts, not raw manifests |
| D | Incorrect — Deployment is a Kubernetes resource, not a Flux CRD |
Q6. What should the CodeBuild IAM role have to deploy to EKS?
- A. AmazonEKSClusterPolicy
- B. An EKS access entry granting cluster access
- C. kubectl credentials stored in SSM
- D. Root account access
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Incorrect — AmazonEKSClusterPolicy is for the EKS service role, not for CI/CD |
| B | ✅ Correct — the CodeBuild role needs an EKS access entry (or aws-auth mapping) plus eks:DescribeCluster |
| C | Incorrect — kubectl uses kubeconfig generated at runtime, not stored credentials |
| D | Incorrect — root account access violates least privilege |
Q7. What advantage does ECR enhanced scanning have over basic scanning?
- A. It’s free
- B. It scans application dependencies continuously
- C. It supports Docker Hub images
- D. It runs faster
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Incorrect — enhanced scanning has per-image costs (via Inspector) |
| B | ✅ Correct — enhanced scanning detects both OS and application package vulnerabilities continuously |
| C | Incorrect — ECR scanning works on images in ECR, not Docker Hub directly |
| D | Incorrect — enhanced scanning is continuous, not necessarily faster per scan |
Q8. What is the ArgoCD “App of Apps” pattern?
- A. Running multiple ArgoCD instances
- B. An ArgoCD Application that manages other ArgoCD Applications
- C. A multi-cluster deployment strategy
- D. Using ArgoCD with multiple Git repos
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Incorrect — it uses a single ArgoCD instance |
| B | ✅ Correct — a parent Application contains child Application manifests, bootstrapping all apps from one root |
| C | Incorrect — multi-cluster is handled by ApplicationSets or cluster registration |
| D | Incorrect — multiple repos can be used but that’s not what defines this pattern |
Q9. In a CodePipeline, what provides production deployment safety?
- A. CodeBuild timeout
- B. Manual approval action
- C. CodeDeploy rollback
- D. S3 artifact versioning
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Incorrect — timeout prevents hanging builds, not unsafe deployments |
| B | ✅ Correct — manual approval gates pause the pipeline until a human reviews and approves |
| C | Incorrect — CodeDeploy is separate from the EKS deployment pattern described |
| D | Incorrect — S3 versioning stores artifacts but doesn’t provide deployment safety |
Q10. Why should you use ECR pull-through cache?
- A. To speed up builds in CodeBuild
- B. To avoid Docker Hub rate limits and reduce external dependencies
- C. To encrypt images in transit
- D. To enable multi-arch image support
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Incorrect — pull-through cache helps with pulling images, not building |
| B | ✅ Correct — caching upstream images in ECR avoids rate limits and eliminates dependency on external registries |
| C | Incorrect — image encryption is handled by ECR’s encryption configuration |
| D | Incorrect — multi-arch support is a registry feature, not specific to pull-through cache |
