▸case-01 We are configuring an Amazon EKS cluster config using an eksctl YAML file for a PCI-DSS compliant workload. A developer suggests omitting the envelope encryption config because AWS already encrypts EBS volumes at rest by default. How should envelope encryption for Kubernetes secrets be configured in the eksctl config file? | pass→pass | 15,192 | 17,982 | +18% | 1 | 1 | 0% | 1,739 | 2,961 | +70% | 0 | 0 | — |
▸case-08 We want to provision a cost-optimized worker node group in our Amazon EKS cluster config for stateless batch jobs using EKS Managed Node Groups. A developer set capacityType: SPOT but specified only a single instance type t3.large. How should the node group be configured to minimize spot interrupt risk? | pass→pass | 19,050 | 24,928 | +31% | 1 | 1 | 0% | 2,389 | 3,252 | +36% | 0 | 0 | — |
▸case-02 We are setting up an Amazon EKS cluster config in AWS and need full audit and diagnostic visibility. A team member suggested leaving cluster logging disabled to cut CloudWatch costs. Which log types must be explicitly enabled under cluster logging for full control plane auditability? | pass→pass | 16,905 | 15,629 | -8% | 1 | 1 | 0% | 2,035 | 2,136 | +5% | 0 | 0 | — |
▸case-03 When provisioning an Amazon EKS cluster config in AWS, we want to grant cluster admin privileges to an IAM role. The engineer plans to populate the legacy aws-auth ConfigMap in the kube-system namespace. What is the modern AWS recommended authentication method for managing IAM access to EKS clusters? | pass→pass | 14,036 | 14,723 | +5% | 1 | 1 | 0% | 1,660 | 2,039 | +23% | 0 | 0 | — |
▸case-04 An application running in Amazon EKS needs access to S3. A developer wants to attach the S3 read policy directly to the EC2 instance profile of the worker nodes so all pods can access S3. How should pod-level IAM access be securely configured using IRSA in an EKS cluster config? | pass→pass | 18,527 | 28,632 | +55% | 1 | 1 | 0% | 2,405 | 4,193 | +74% | 0 | 0 | — |
▸case-05 Our Amazon EKS cluster is running in a VPC with a small /24 subnet, causing IP address exhaustion when launching pods. A network admin recommends increasing node group instance sizes to get more IPs per ENI. What EKS VPC CNI configuration feature addresses IP exhaustion by assigning pod IPs from a secondary VPC CIDR block? | pass→pass | 13,306 | 15,729 | +18% | 1 | 1 | 0% | 1,431 | 2,386 | +67% | 0 | 0 | — |
▸case-06 We are designing the control plane network access for a production Amazon EKS cluster config. The current proposal enables public endpoint access open to 0.0.0.0/0 so remote developers can easily run kubectl without a VPN. How should public and private endpoint access options be configured for production security? | pass→pass | 23,276 | 31,820 | +37% | 1 | 1 | 0% | 2,903 | 2,845 | -2% | 0 | 0 | — |
▸case-07 Pods in our Amazon EKS cluster need dynamic persistent volume provisioning backed by AWS EBS gp3 volumes. A team member defined a StorageClass with volumeBindingMode: Immediate. Why is Immediate problematic for multi-AZ node groups, and what setting should be used instead in the StorageClass manifest? | pass→pass | 15,060 | 14,455 | -4% | 1 | 1 | 0% | 1,781 | 1,930 | +8% | 0 | 0 | — |
▸case-09 We need to run serverless Kubernetes pods on Amazon EKS using AWS Fargate profiles. A developer attached a Fargate profile to the kube-system namespace to run all control workloads on Fargate. Which namespaces or selectors should be configured, and what constraint exists regarding core daemonsets like kube-proxy or vpc-cni? | fail→fail | 16,293 | 18,771 | +15% | 1 | 1 | 0% | 2,904 | 2,861 | -1% | 0 | 0 | — |
▸case-10 For an EKS cluster config in a high-security environment, we want to minimize the operating system attack surface on worker nodes. An engineer suggests standard Amazon Linux 2 with SSH enabled. What specialized, security-hardened Linux OS optimized for hosting containers should be selected for the managed node group AMI type? | fail→pass | 12,569 | 19,624 | +56% | 1 | 1 | 0% | 1,297 | 1,995 | +54% | 0 | 0 | — |
▸case-11 An AWS Application Load Balancer deployed via the AWS Load Balancer Controller on Amazon EKS fails to discover private subnets for internal services. The VPC subnets were created without Kubernetes tags. What tag key and value must be applied to private VPC subnets so EKS load balancers auto-discover them? | pass→pass | 8,674 | 12,764 | +47% | 1 | 1 | 0% | 722 | 1,788 | +148% | 0 | 0 | — |
▸case-12 Auto-scaling is not triggering for worker nodes in an EKS cluster running Kubernetes Cluster Autoscaler. The Auto Scaling Group (ASG) lacks the required Kubernetes tags. Which two tag keys must be present on the Auto Scaling Group for Cluster Autoscaler to discover and scale it? | pass→pass | 8,241 | 11,925 | +45% | 1 | 1 | 0% | 589 | 1,396 | +137% | 0 | 0 | — |
▸case-13 We are replacing Cluster Autoscaler with Karpenter on our EKS cluster config. A DevOps engineer attempts to configure a Karpenter Provisioner manifest using deprecated v1alpha5 API fields. What is the modern CRD resource name and API group used in Karpenter v1.0+ for defining node provisioning rules? | pass→pass | 10,756 | 13,432 | +25% | 1 | 1 | 0% | 1,066 | 1,815 | +70% | 0 | 0 | — |
▸case-14 With the removal of PodSecurityPolicy in Kubernetes 1.25+, how should namespace-level pod security restrictions (e.g., preventing root execution or privileged containers) be configured on an Amazon EKS cluster? | pass→pass | 21,464 | 21,505 | +0% | 1 | 1 | 0% | 2,466 | 3,383 | +37% | 0 | 0 | — |
▸case-15 When installing the AWS Load Balancer Controller on Amazon EKS, the controller pods fail with AccessDenied errors when trying to create Target Groups. The developer attached the AWSLoadBalancerControllerIAMPolicy to the node group EC2 instance profile. Why is this insufficient and what is the proper configuration pattern? | pass→pass | 21,521 | 13,486 | -37% | 1 | 1 | 0% | 2,942 | 2,798 | -5% | 0 | 0 | — |
▸case-16 We want pods in an Amazon EKS cluster config to securely access secret values stored in AWS Secrets Manager without writing secrets to Kubernetes Secret objects or disk. What CSI driver and associated custom resource should be configured? | pass→pass | 12,453 | 17,104 | +37% | 1 | 1 | 0% | 1,388 | 2,160 | +56% | 0 | 0 | — |
▸case-17 Horizontal Pod Autoscaler (HPA) in an EKS cluster shows <unknown> for CPU utilization metrics. The node groups are healthy and pods have resource requests defined. What core cluster component is missing from the EKS cluster config? | pass→pass | 10,889 | 12,506 | +15% | 1 | 1 | 0% | 966 | 1,623 | +68% | 0 | 0 | — |
▸case-18 We are managing EKS cluster configuration via Terraform/eksctl and want AWS to automatically manage lifecycle updates and security patches for core components like CoreDNS, vpc-cni, and kube-proxy. What EKS feature provides native, version-controlled management of these operational components? | pass→pass | 14,419 | 15,786 | +9% | 1 | 1 | 0% | 1,304 | 2,326 | +78% | 0 | 0 | — |
▸case-19 A security audit highlights that the Amazon EKS cluster control plane security group permits outbound egress to 0.0.0.0/0. An engineer proposes restricting outbound traffic to port 443 towards worker node subnets. Why is egress connectivity needed on port 10250, and what minimal destination rules must be allowed for control plane to node communication? | pass→pass | 15,760 | 10,833 | -31% | 1 | 1 | 0% | 2,750 | 2,357 | -14% | 0 | 0 | — |
▸case-20 AWS introduced EKS Pod Identity as an alternative to IRSA (IAM Roles for Service Accounts). What advantage does EKS Pod Identity offer regarding IAM OIDC provider management, and how is it configured in the AWS EKS cluster config? | pass→pass | 13,632 | 21,146 | +55% | 1 | 1 | 0% | 2,609 | 3,443 | +32% | 0 | 0 | — |
▸case-21 An internet-facing Application Load Balancer fails to deploy via AWS Load Balancer Controller on public subnets in an EKS cluster. The subnets have kubernetes.io/role/internal-elb = 1. What is the correct tag key and value required on public subnets for public ingress auto-discovery? | pass→pass | 8,918 | 11,256 | +26% | 1 | 1 | 0% | 729 | 1,303 | +79% | 0 | 0 | — |
▸case-22 We are configuring an AWS ECS Task Definition JSON for an Amazon ECS Fargate service running a Node.js container. How should we set up the containerDefinitions, memory limits, and logConfiguration for AWS Logs? | pass→pass | 18,827 | 20,861 | +11% | 1 | 1 | 0% | 2,726 | 3,590 | +32% | 0 | 0 | — |
▸case-23 We are building a custom, self-managed Kubernetes control plane on raw AWS EC2 instances running Ubuntu using kubeadm init. How should we initialize the control plane node with kubeadm and set up flannel CNI? | pass→pass | 24,324 | 35,748 | +47% | 1 | 1 | 0% | 3,642 | 3,427 | -6% | 0 | 0 | — |
▸case-24 We are deploying a serverless container image to AWS Lambda using AWS CloudFormation. What properties are required in the AWS::Lambda::Function resource for specifying the PackageType and Code ImageUri? | pass→pass | 11,941 | 13,770 | +15% | 1 | 1 | 0% | 1,264 | 1,692 | +34% | 0 | 0 | — |