Amazon EKS — Networking Practice Questions
Test your understanding of EKS networking with these 10 multiple-choice questions.
Question 1
How does the Amazon VPC CNI plugin assign IP addresses to pods?
- A. It creates an overlay network with virtual IPs
- B. It assigns real VPC IP addresses from the node’s subnet
- C. It uses NAT to translate pod IPs to a single node IP
- D. It allocates IPs from a cluster-wide CIDR range not tied to the VPC
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Overlay networks are used by CNIs like Calico or Flannel — VPC CNI does not use an overlay |
| B | VPC CNI assigns each pod a real IP address from the VPC subnet, using secondary IPs on ENIs |
| C | NAT-based networking is not how VPC CNI works — each pod gets its own routable VPC IP |
| D | The pod IPs come from the same VPC CIDR ranges (unless custom networking is enabled) |
Question 2
What subnet tags are required for EKS to auto-discover subnets for internal load balancers?
- A.
kubernetes.io/role/elb = 1 - B.
kubernetes.io/role/internal-elb = 1 - C.
eks.amazonaws.com/subnet-type = private - D.
aws:eks:cluster-name = my-cluster
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | kubernetes.io/role/elb = 1 is for public-facing load balancers (internet-facing ALB/NLB) |
| B | kubernetes.io/role/internal-elb = 1 tells EKS/AWS LB Controller to use these subnets for internal load balancers |
| C | This tag does not exist in the EKS subnet tagging convention |
| D | While this tag is sometimes added, it’s not the tag used for load balancer subnet discovery |
Question 3
What is prefix delegation used for in the VPC CNI?
- A. To delegate DNS resolution to a custom DNS server
- B. To assign /28 prefixes to ENIs, increasing the number of pods per node
- C. To delegate subnet management to the EKS control plane
- D. To enable cross-account VPC sharing
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Prefix delegation has nothing to do with DNS |
| B | Prefix delegation assigns /28 prefixes (16 IPs each) to ENI slots instead of individual IPs, dramatically increasing pod density per node |
| C | Subnet management remains with the VPC owner — EKS doesn’t manage subnets |
| D | Cross-account VPC sharing uses AWS RAM, not prefix delegation |
Question 4
When using custom networking with a secondary CIDR (100.64.0.0/16), where do pod IPs come from?
- A. The primary VPC CIDR
- B. The secondary CIDR subnets configured via ENIConfig
- C. An overlay network created by the VPC CNI
- D. The Kubernetes service CIDR
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | With custom networking enabled, pods no longer get IPs from the primary CIDR |
| B | ENIConfig resources map each AZ to a subnet in the secondary CIDR — pods get IPs from these subnets |
| C | VPC CNI does not create overlay networks even with custom networking |
| D | The service CIDR is for Kubernetes Services (ClusterIPs), not pod IPs |
Question 5
What is a SecurityGroupPolicy used for in EKS?
- A. To create VPC security groups automatically
- B. To assign VPC security groups directly to individual pods
- C. To enforce Kubernetes NetworkPolicy rules using security groups
- D. To restrict which security groups can be attached to EKS nodes
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | SecurityGroupPolicy does not create security groups — they must exist beforehand |
| B | SecurityGroupPolicy maps pod selectors or service account selectors to specific VPC security groups using branch ENIs |
| C | Network policies and security groups are separate mechanisms — SecurityGroupPolicy doesn’t translate between them |
| D | Node security groups are managed separately and are not controlled by SecurityGroupPolicy |
Question 6
What is the most secure API server endpoint configuration for a production EKS cluster?
- A. Public endpoint only with no CIDR restrictions
- B. Public endpoint restricted to office CIDR blocks
- C. Public + private endpoint with CIDR restrictions
- D. Private endpoint only
Show Answer
Correct Answer: D
| Option | Explanation |
|---|---|
| A | Exposing the API server to the entire internet is the least secure option |
| B | CIDR restrictions help but the API server is still internet-facing |
| C | Good compromise — nodes use the private endpoint, but the public endpoint still exists |
| D | Private endpoint only is the most secure — no internet access to the API server. Requires VPN, bastion, or SSM for access |
Question 7
Which VPC endpoint type should you use for S3 access from a private EKS cluster?
- A. Interface endpoint
- B. Gateway endpoint
- C. PrivateLink endpoint
- D. VPN endpoint
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Interface endpoints work for S3 but cost money — gateway endpoints are free and preferred |
| B | Gateway endpoints for S3 are free, have no bandwidth limits, and are added via route table entries |
| C | PrivateLink is the technology behind interface endpoints — not a separate type |
| D | VPN endpoints don’t exist as a VPC endpoint type |
Question 8
A node is running a t3.medium instance. What determines the maximum number of pods it can run using VPC CNI?
- A. A fixed limit of 110 pods per node
- B. The number of ENIs × secondary IPs per ENI
- C. Available CPU and memory only
- D. The Kubernetes default of 250 pods
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | 110 is the default max-pods for some CNIs but not how VPC CNI calculates the limit |
| B | VPC CNI max pods = (Number of ENIs × IPs per ENI) - reserved IPs. For t3.medium: (3 ENIs × 6 IPs) - 3 = 17 pods |
| C | CPU and memory affect scheduling but the VPC CNI IP limit is the hard cap |
| D | 250 is the Kubernetes default but VPC CNI enforces a lower limit based on ENI/IP capacity |
Question 9
An engineer needs to access a private-only EKS cluster without managing SSH keys. Which approach is recommended?
- A. Create a bastion host with SSH access
- B. Use AWS Systems Manager Session Manager
- C. Switch to a public API endpoint
- D. Open a port on the NAT Gateway
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Bastion hosts work but require SSH key management — the question specifically asks to avoid this |
| B | SSM Session Manager provides shell access without SSH keys, with built-in CloudTrail audit logging and no public IP needed |
| C | Switching to public endpoint weakens security — not a good solution |
| D | NAT Gateways are for outbound traffic — you can’t open inbound ports on them |
Question 10
What happens to pod networking when you enable the private API server endpoint in addition to the public endpoint?
- A. All pod traffic is encrypted with TLS
- B. Nodes communicate with the control plane through the private endpoint instead of the internet
- C. Pods receive private IP addresses from a different CIDR
- D. Cross-AZ pod traffic is blocked
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | TLS encryption is always enabled for API server communication regardless of endpoint mode |
| B | With the private endpoint enabled, nodes route control plane traffic through VPC ENIs instead of going through the NAT Gateway and internet |
| C | Enabling the private endpoint does not change pod IP allocation |
| D | Cross-AZ traffic is not affected by API server endpoint configuration |
