Amazon EKS — Workloads Practice Questions
Test your understanding of deploying and managing workloads on Amazon EKS.
Question 1
Which Kubernetes resource ensures a copy of a pod runs on every node?
- A. Deployment
- B. StatefulSet
- C. DaemonSet
- D. ReplicaSet
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | Deployment runs a specified number of replicas, not one per node |
| B | StatefulSet provides ordered deployment with stable identities |
| C | DaemonSet ensures exactly one pod runs on every (or selected) node |
| D | ReplicaSet maintains a specified number of replicas |
Question 2
What is the key difference between volumeClaimTemplates in a StatefulSet and a regular PVC?
- A. volumeClaimTemplates creates a shared volume for all pods
- B. volumeClaimTemplates creates a unique PVC for each pod replica
- C. volumeClaimTemplates uses ephemeral storage only
- D. volumeClaimTemplates does not support EBS volumes
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Each pod gets its own PVC, not a shared volume |
| B | Each StatefulSet replica gets a unique PVC (e.g., data-postgres-0, data-postgres-1) |
| C | volumeClaimTemplates creates persistent, not ephemeral storage |
| D | EBS volumes are fully supported via the EBS CSI Driver |
Question 3
Which concurrency policy should you set on a CronJob if you want to skip the new run when the previous one is still running?
- A. Allow
- B. Replace
- C. Forbid
- D. Skip
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | Allow lets multiple Jobs run concurrently |
| B | Replace cancels the running Job and starts a new one |
| C | Forbid skips the new Job if the previous one hasn’t completed |
| D | Skip is not a valid CronJob concurrency policy |
Question 4
Which approach should you use to manage sensitive data like database passwords on EKS?
- A. Store in a ConfigMap
- B. Hard-code in the container image
- C. Use AWS Secrets Manager with ASCP or External Secrets Operator
- D. Pass as command-line arguments
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | ConfigMaps are not encrypted and are designed for non-sensitive data |
| B | Hard-coding secrets in images is a security anti-pattern |
| C | AWS Secrets Manager provides encryption, rotation, and audit — ASCP or ESO integrates with K8s |
| D | Command-line arguments appear in process listings and pod specs |
Question 5
What happens to DaemonSet pods on Fargate?
- A. They run as sidecar containers
- B. They run one per Fargate node
- C. They are not supported on Fargate
- D. They run as init containers
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | Sidecar is a workaround, not automatic DaemonSet behavior |
| B | Fargate does not have traditional nodes for DaemonSets to target |
| C | DaemonSets are not supported on Fargate — use sidecars for equivalent functionality |
| D | Init containers serve a different purpose (initialization before main containers) |
Question 6
What does ttlSecondsAfterFinished do on a Job?
- A. Sets the maximum runtime for the Job
- B. Sets how long to wait before retrying a failed Job
- C. Automatically deletes the Job and its pods after the specified time
- D. Sets the timeout for container startup
Show Answer
Correct Answer: C
| Option | Explanation |
|---|---|
| A | Job runtime is controlled by activeDeadlineSeconds |
| B | Retry behavior is controlled by backoffLimit |
| C | ttlSecondsAfterFinished cleans up completed/failed Jobs automatically after the specified duration |
| D | Startup timeout is managed by startup probes |
Question 7
Which probe type removes a pod from Service endpoints without restarting it?
- A. Liveness probe
- B. Readiness probe
- C. Startup probe
- D. Health probe
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | Liveness probe failure causes a container restart |
| B | Readiness probe failure removes the pod from Service endpoints — no restart |
| C | Startup probe holds off liveness/readiness checks during startup |
| D | Health probe is not a specific Kubernetes probe type |
Question 8
What is the stable DNS name for the second pod in a StatefulSet named redis with a headless Service named redis-headless in the cache namespace?
- A. redis-1.redis-headless.cache.svc.cluster.local
- B. redis-2.redis-headless.cache.svc.cluster.local
- C. redis-headless-1.cache.svc.cluster.local
- D. redis.redis-headless.cache.svc.cluster.local
Show Answer
Correct Answer: A
| Option | Explanation |
|---|---|
| A | StatefulSet pods are numbered from 0, so the second pod is redis-1; DNS is <pod>.<service>.<namespace>.svc.cluster.local |
| B | redis-2 would be the third pod (0-indexed) |
| C | The DNS format requires the pod name, not service-index |
| D | This is a generic service DNS, not a specific pod DNS |
Question 9
What is the purpose of a PodDisruptionBudget?
- A. Limits the CPU usage of a pod
- B. Ensures a minimum number of pods remain available during voluntary disruptions
- C. Prevents pods from being scheduled on the same node
- D. Limits the number of replicas in a Deployment
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | CPU usage is controlled by resource limits |
| B | PDB guarantees minimum availability during voluntary disruptions like node drains and upgrades |
| C | Pod anti-affinity handles node distribution |
| D | Replica count is set in the Deployment spec |
Question 10
Which setting in a Deployment strategy ensures zero downtime during a rolling update?
- A. maxSurge: 0, maxUnavailable: 1
- B. maxSurge: 1, maxUnavailable: 0
- C. maxSurge: 0, maxUnavailable: 0
- D. strategy.type: Recreate
Show Answer
Correct Answer: B
| Option | Explanation |
|---|---|
| A | maxUnavailable: 1 allows one pod to be down, risking brief capacity reduction |
| B | maxUnavailable: 0 ensures all existing pods stay running; maxSurge: 1 creates a new pod before terminating an old one |
| C | Both zero is invalid — the update would never progress |
| D | Recreate terminates all pods before creating new ones — causes downtime |
