Amazon EKS — Observability Practice Questions
Test your understanding of EKS observability — CloudWatch, Fluent Bit, Prometheus, ADOT, and managed services.
Question 1
Which EKS control plane log type is most important for security auditing?
A) api
B) scheduler
C) audit
D) controllerManager
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | API logs show requests but lack the structured who/what/when format of audit logs |
| B | Scheduler logs show pod placement decisions — not security-relevant |
| C | Audit logs capture who performed what action on which resource and when — essential for security investigations and compliance |
| D | Controller Manager logs show reconciliation events — operational, not security-focused |
Question 2
How does Fluent Bit collect logs from Fargate pods?
A) Fluent Bit DaemonSet runs on Fargate nodes
B) Built-in Fluent Bit sidecar configured via aws-observability ConfigMap
C) CloudWatch agent is automatically injected
D) Logs are not available from Fargate pods
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | DaemonSets cannot run on Fargate — there are no visible nodes to schedule on |
| B | Fargate has a built-in Fluent Bit router. You configure it by creating a ConfigMap in the aws-observability namespace |
| C | CloudWatch agent is not auto-injected into Fargate pods |
| D | Incorrect — Fargate logging is fully supported via the built-in router |
Question 3
What is the primary advantage of Amazon Managed Service for Prometheus (AMP) over self-managed Prometheus?
A) AMP uses a different query language with more features
B) AMP provides automatic scaling, HA, and unlimited retention
C) AMP is free for EKS users
D) AMP collects metrics without any agent
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | AMP uses standard PromQL — same query language as self-managed Prometheus |
| B | AMP handles scaling, high availability, and long-term storage automatically — you don’t manage Prometheus servers, Thanos, or storage |
| C | AMP charges per metric sample ingested, stored, and queried — not free |
| D | AMP requires a collector (Prometheus, ADOT, or Grafana Agent) to scrape and remote-write metrics |
Question 4
What does the kube-prometheus-stack Helm chart include?
A) Only Prometheus server
B) Prometheus, Grafana, Alertmanager, node-exporter, and kube-state-metrics
C) CloudWatch Container Insights and Fluent Bit
D) Only Grafana dashboards
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | The chart includes much more than just the Prometheus server |
| B | The kube-prometheus-stack is a comprehensive chart that deploys Prometheus, Grafana, Alertmanager, node-exporter, kube-state-metrics, and pre-built dashboards/alerts |
| C | CloudWatch and Fluent Bit are separate tools — not part of the kube-prometheus-stack |
| D | Dashboards are included but so are all the monitoring components |
Question 5
Which Prometheus CRD is used to define scrape targets for a Kubernetes Service?
A) PrometheusRule
B) PodMonitor
C) ServiceMonitor
D) AlertmanagerConfig
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | PrometheusRule defines alerting and recording rules, not scrape targets |
| B | PodMonitor scrapes pod endpoints directly — not through a Service |
| C | ServiceMonitor discovers and scrapes endpoints behind a Kubernetes Service — the standard way to add scrape targets |
| D | AlertmanagerConfig configures alert routing, not metric collection |
Question 6
What is ADOT’s primary advantage over running separate CloudWatch Agent, Fluent Bit, and X-Ray daemon?
A) ADOT is the only agent that supports EKS
B) ADOT provides a single, vendor-neutral collector for metrics, traces, and logs
C) ADOT is faster than individual agents
D) ADOT is required for Fargate observability
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | CloudWatch Agent, Fluent Bit, and X-Ray daemon all support EKS independently |
| B | ADOT consolidates telemetry collection into one agent using the vendor-neutral OpenTelemetry standard, reducing agent sprawl and config complexity |
| C | Performance is comparable — the advantage is operational simplicity, not speed |
| D | ADOT is not required for Fargate — Fargate has built-in Fluent Bit for logs |
Question 7
You need to monitor 500+ EKS nodes across 10 clusters with 6-month metric retention. Which solution is most cost-effective?
A) Self-managed Prometheus per cluster
B) AMP with a single workspace
C) CloudWatch Container Insights on all clusters
D) Self-managed Prometheus with Thanos and S3
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | 10 separate Prometheus instances need significant compute — expensive and hard to manage |
| B | AMP handles multi-cluster aggregation in a single workspace with built-in long-term retention — no infrastructure to manage at scale |
| C | Container Insights per-metric costs scale linearly — very expensive at 500+ nodes across 10 clusters |
| D | Thanos + S3 works but requires significant operational effort to manage federation, compaction, and querying across 10 clusters |
Question 8
Which Grafana dashboard import ID provides a comprehensive Kubernetes cluster overview?
A) 315
B) 6417
C) 13770
D) 14584
Show Answer
Correct Answer: A
| Option | Explanation |
|---|---|
| A | Dashboard 315 is the classic “Kubernetes cluster monitoring” dashboard — provides cluster-wide CPU, memory, network, and filesystem overview |
| B | Dashboard 6417 focuses on individual pod metrics — not cluster-wide |
| C | Dashboard 13770 is “Node Exporter Full” — OS-level node metrics, not K8s-specific |
| D | Dashboard 14584 focuses on CoreDNS metrics — a single component |
Question 9
What happens if Fluent Bit’s Mem_Buf_Limit is not configured and the destination is unreachable?
A) Fluent Bit drops all logs
B) Fluent Bit buffers logs indefinitely, potentially consuming all node memory
C) Fluent Bit pauses log collection and resumes when destination is available
D) Kubernetes evicts the Fluent Bit pod
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Without Mem_Buf_Limit, Fluent Bit doesn’t drop logs — it keeps buffering |
| B | Without Mem_Buf_Limit, Fluent Bit buffers all undelivered logs in memory, which can grow unbounded and cause OOM on the node |
| C | Fluent Bit doesn’t have a built-in pause — it continues collecting and buffering |
| D | Kubernetes may eventually evict it due to memory pressure, but this is a consequence, not Fluent Bit’s behavior |
Question 10
What is the recommended approach for OpenTelemetry auto-instrumentation on EKS?
A) Modify application source code to add OTel SDK calls
B) Add the instrumentation annotation to pod spec and let the OTel operator inject the agent
C) Install a sidecar container manually in every pod
D) Use CloudWatch Container Insights instead
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Manual SDK integration works but requires code changes — auto-instrumentation avoids this |
| B | The OTel operator watches for pods with instrumentation.opentelemetry.io/inject-* annotations and automatically injects the instrumentation agent — no code changes needed |
| C | Manual sidecar injection is error-prone and hard to maintain at scale |
| D | Container Insights provides infrastructure metrics, not application-level tracing |
