Amazon EKS — Cluster Creation Practice Questions
Test your understanding of EKS cluster creation with these 10 multiple-choice questions.
Question 1
What infrastructure tool does eksctl use behind the scenes to create AWS resources?
- A. Terraform
- B. AWS CDK
- C. CloudFormation
- D. Pulumi
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | Terraform is a separate IaC tool — eksctl does not use it |
| B | AWS CDK is another IaC tool — not used by eksctl |
| C | eksctl creates CloudFormation stacks for VPC, IAM roles, EKS cluster, and node groups |
| D | Pulumi is a third-party IaC tool — not used by eksctl |
Question 2
Which Terraform module is the recommended community module for creating EKS clusters?
- A. terraform-aws-modules/kubernetes/aws
- B. terraform-aws-modules/eks/aws
- C. hashicorp/eks/aws
- D. aws/eks/terraform
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | This module name doesn’t exist |
| B | terraform-aws-modules/eks/aws is the official, widely-used community module for EKS |
| C | HashiCorp doesn’t publish an EKS-specific module |
| D | This module name doesn’t exist |
Question 3
What command configures kubectl to access an existing EKS cluster?
- A.
kubectl config set-cluster - B.
aws eks connect-cluster - C.
aws eks update-kubeconfig - D.
eksctl config kubectl
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | This sets a cluster in kubeconfig manually but doesn’t configure EKS auth |
| B | This is not a valid AWS CLI command |
| C | aws eks update-kubeconfig adds the cluster context with EKS token authentication to your kubeconfig |
| D | This is not a valid eksctl command |
Question 4
Which three add-ons are installed by default on every new EKS cluster?
- A. CoreDNS, Calico, kube-proxy
- B. VPC CNI, CoreDNS, kube-proxy
- C. VPC CNI, EBS CSI Driver, CoreDNS
- D. kube-proxy, Metrics Server, CoreDNS
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Calico is not a default EKS add-on — it must be installed separately |
| B | VPC CNI (pod networking), CoreDNS (cluster DNS), and kube-proxy (service proxy) are the three default add-ons |
| C | EBS CSI Driver is optional — it must be explicitly installed |
| D | Metrics Server is not installed by default |
Question 5
What is the primary benefit of using EKS-managed add-ons over self-managed add-ons?
- A. They are free of charge
- B. AWS handles installation, upgrades, and conflict resolution
- C. They offer more configuration options
- D. They are faster than self-managed versions
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Both managed and self-managed add-ons are free (the software itself) |
| B | EKS-managed add-ons simplify lifecycle management — AWS handles install, version tracking, and can detect configuration drift |
| C | Self-managed add-ons actually offer more configuration options |
| D | Performance is the same — the software is identical |
Question 6
Why is the AWS Console NOT recommended for creating production EKS clusters?
- A. It costs more than using the CLI
- B. It creates clusters more slowly
- C. It’s not repeatable, has no version control, and is prone to manual errors
- D. The Console doesn’t support all EKS features
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | The cost is the same regardless of creation method |
| B | Speed is comparable |
| C | Manual Console operations aren’t repeatable, can’t be version-controlled in Git, and are prone to human error. Use eksctl or Terraform for production. |
| D | The Console supports most EKS features |
Question 7
How does EKS authentication work when you run kubectl commands?
- A. kubectl uses a static username and password stored in kubeconfig
- B. kubectl uses the exec plugin to call
aws eks get-token, which generates a short-lived STS token - C. kubectl connects directly to EC2 instances via SSH
- D. kubectl uses a long-lived API key created during cluster setup
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | EKS doesn’t use static username/password authentication |
| B | The kubeconfig exec plugin calls aws eks get-token, which uses STS AssumeRole to generate a short-lived bearer token. This token is sent to the API server for authentication. |
| C | kubectl communicates with the API server, not directly with EC2 nodes |
| D | EKS doesn’t use long-lived API keys — tokens are short-lived |
Question 8
What IAM policies must the EKS node IAM role have?
- A. AmazonEKSClusterPolicy only
- B. AmazonEKSWorkerNodePolicy, AmazonEKS_CNI_Policy, and AmazonEC2ContainerRegistryReadOnly
- C. AdministratorAccess
- D. AmazonEKSServicePolicy and AmazonEKSClusterPolicy
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | AmazonEKSClusterPolicy is for the cluster IAM role, not the node role |
| B | Node roles need: WorkerNodePolicy (node registration), CNI_Policy (VPC CNI networking), and ContainerRegistryReadOnly (pulling images from ECR) |
| C | Never use AdministratorAccess for node roles — violates least privilege |
| D | AmazonEKSServicePolicy is deprecated; these are cluster-level, not node-level |
Question 9
What happens if you run eksctl delete cluster --name my-cluster?
- A. Only the control plane is deleted
- B. The cluster, node groups, VPC, IAM roles, and CloudFormation stacks are all deleted
- C. Only the CloudFormation stack is deleted
- D. The cluster is stopped but not deleted
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | eksctl deletes everything it created, not just the control plane |
| B | eksctl deletes all CloudFormation stacks it created, including VPC, subnets, IAM roles, node groups, and the EKS cluster itself |
| C | Deleting the stack deletes the underlying resources too |
| D | EKS doesn’t have a “stop” concept — clusters are either running or deleted |
Question 10
What is the recommended Terraform remote state backend for EKS projects?
- A. Local filesystem
- B. S3 bucket with DynamoDB locking
- C. HashiCorp Consul
- D. Git repository
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Local state doesn’t support team collaboration and has no locking |
| B | S3 for state storage (durable, versioned, encrypted) + DynamoDB for state locking (prevents concurrent modifications) is the standard AWS pattern |
| C | Consul works but is not the standard for AWS-focused projects |
| D | Git is not a supported Terraform backend |
