CCA (Cilium Certified Associate) Practice Exam - 80 Questions

Exam Overview

The CCA (Cilium Certified Associate) certification validates foundational knowledge of Cilium and eBPF-based Kubernetes networking.

Item	Details
Duration	90 minutes
Questions	60 questions
Passing Score	75%
Format	Multiple Choice

Domain Weights

Domain	Weight
Architecture	20%
Networking	25%
Network Policy	20%
Service Mesh	15%
Observability	10%
Cluster Mesh and External Workloads	10%

Architecture (Questions 1-16)

Question 1

What step must an eBPF program go through before it can run in the Linux kernel?

A. Compilation B. Verification C. Linking D. Serialization

Show Answer

Answer: B

eBPF programs must pass through the eBPF verifier before being loaded into the kernel. The verifier ensures the program contains no infinite loops, invalid memory accesses, or other safety violations.

Question 2

On what basis does Cilium assign a security Identity to each workload?

A. Pod IP address B. Pod name C. Security-relevant labels of the Pod D. Node where the Pod runs

Show Answer

Answer: C

Cilium assigns a numeric Identity based on the combination of security-relevant labels. All Pods with the same label set share the same Identity.

Question 3

Which of the following is NOT a primary role of the Cilium Agent?

A. Compiling and loading eBPF programs B. Endpoint management C. IPAM allocation management D. CRD validation

Show Answer

Answer: D

CRD validation is handled by the Cilium Operator. The Cilium Agent runs on each node and is responsible for eBPF program management, endpoint management, and policy enforcement.

Question 4

What is a correct role of the Cilium Operator?

A. Loading eBPF programs on each node B. Cluster-wide IPAM management and CRD management C. Collecting Hubble metrics D. Managing Envoy proxies

Show Answer

Answer: B

The Cilium Operator runs at the cluster level and handles cluster-wide tasks such as IPAM (IP Address Management), CRD management, node discovery, and garbage collection.

Question 5

What is the purpose of BPF maps in eBPF?

A. Sharing data between eBPF programs or between kernel and user space B. Buffers for storing network packets C. Storing eBPF program source code D. Loading kernel modules

Show Answer

Answer: A

BPF maps are key-value stores for sharing data between eBPF programs, or between kernel space and user space. Cilium uses them for policy lookups, connection tracking, NAT, and more.

Question 6

What characterizes the veth datapath mode in Cilium?

A. Uses veth pairs between Pod and host network namespaces B. Forwards packets directly via XDP C. Only uses VXLAN tunnels D. Operates based on iptables

Show Answer

Answer: A

In veth mode, Cilium creates veth pairs between the Pod network namespace and the host network namespace, and attaches eBPF programs at tc (traffic control) hooks to process packets.

Question 7

Which is NOT a valid execution context for eBPF programs?

A. XDP (eXpress Data Path) B. tc (traffic control) C. Socket operations D. User space process

Show Answer

Answer: D

eBPF programs execute in kernel space. They operate at kernel hook points such as XDP, tc, socket operations, kprobes, and tracepoints, not as user space processes.

Question 8

Which is NOT an advantage of Cilium's Identity-based security model?

A. Unaffected by IP address changes B. Intuitive label-based policy enforcement C. BPF map size is always smaller than IP-based approaches D. Policies automatically apply when Pods scale

Show Answer

Answer: C

Key advantages of the Identity-based model include immunity to IP changes, intuitive label-based policies, and automatic application during scaling. However, BPF map size is not guaranteed to be always smaller.

Question 9

When does an Endpoint in Cilium undergo regeneration?

A. When a network policy changes B. When node CPU usage is high C. When Hubble restarts D. When DNS cache expires

Show Answer

Answer: A

When network policies change, the Cilium Agent recompiles and reloads the eBPF programs for affected endpoints. This process is called endpoint regeneration.

Question 10

Which BPF map type does Cilium use for CIDR-based policy matching?

A. Hash Map B. LPM Trie C. Array Map D. Ring Buffer

Show Answer

Answer: B

LPM (Longest Prefix Match) Trie is used for CIDR-based policy matching. It can find the most specific matching rule based on IP address prefixes.

Question 11

Why is there a limit on the maximum number of instructions an eBPF program can execute?

A. Memory conservation B. To guarantee program termination C. Network bandwidth limitation D. CPU core limitation

Show Answer

Answer: B

The eBPF verifier enforces instruction limits to guarantee that programs always terminate. This is a safety mechanism for kernel stability, preventing infinite loops and excessive execution.

Question 12

Why is the Cilium Agent deployed as a DaemonSet on each node?

A. For high availability B. Because it needs to manage the network datapath on each node C. For centralized logging D. For storage management

Show Answer

Answer: B

The Cilium Agent must load eBPF programs and manage endpoints on each node. To directly control the node's network datapath, it must run on that node, hence the DaemonSet deployment.

Question 13

What is the primary benefit of using XDP (eXpress Data Path) in Cilium?

A. L7 protocol analysis B. Ultra-fast packet processing at the network driver level C. Automatic TLS termination D. Multi-cluster communication

Show Answer

Answer: B

XDP runs eBPF programs at the network driver level, processing packets before they reach the kernel network stack. This enables ultra-fast performance for DDoS mitigation, load balancing, and more.

Question 14

What characterizes the Kubernetes Host Scope IPAM mode in Cilium?

A. Uses AWS ENIs to allocate IPs B. Allocates IPs from the PodCIDR assigned to each node C. Integrates with external IPAM services D. Supports IPv6 only

Show Answer

Answer: B

In Kubernetes Host Scope mode, IP addresses are allocated from the PodCIDR range assigned to each node by Kubernetes. This is the basic IPAM mode that works without cloud integration.

Question 15

What state store does the Cilium Agent use?

A. Redis B. Local etcd or CRDs (Kubernetes Custom Resources) C. PostgreSQL D. Consul

Show Answer

Answer: B

The Cilium Agent stores state in Kubernetes CRDs (CiliumEndpoint, CiliumIdentity, etc.) or external etcd (kvstore). In recent versions, CRD-based KVStore is the default.

Question 16

What is the purpose of eBPF tail calls?

A. Invoking system calls from eBPF programs B. Transferring execution from one eBPF program to another C. Calling user space applications D. Triggering kernel panics

Show Answer

Answer: B

eBPF tail calls are a mechanism for transferring execution flow from one eBPF program to another. Cilium uses this to split complex packet processing pipelines across multiple programs.

Networking (Questions 17-36)

Question 17

Which is NOT a routing mode supported by Cilium?

A. VXLAN tunneling B. Geneve tunneling C. Direct Routing (native routing) D. MPLS routing

Show Answer

Answer: D

Cilium supports VXLAN, Geneve tunneling modes and Direct Routing (native routing) mode. MPLS routing is not supported by Cilium.

Question 18

What does Cilium do when operating as a CNI (Container Network Interface) plugin?

A. Sets up network interfaces and allocates IPs when Pods are created B. Builds container images C. Kubernetes scheduling D. Mounts storage volumes

Show Answer

Answer: A

As a CNI plugin, Cilium sets up network interfaces, allocates IP addresses, and attaches eBPF programs when Pods are created.

Question 19

How is Pod-to-Pod traffic forwarded in Cilium's Direct Routing mode?

A. Encapsulated with VXLAN headers B. Forwarded directly using the node's routing table C. NAT is always applied D. Forwarded through user space proxies

Show Answer

Answer: B

In Direct Routing mode, packets are not encapsulated but forwarded directly using the node's routing table (or BGP). This has lower overhead but requires network infrastructure to support Pod CIDR routing.

Question 20

What is the core implementation approach for Cilium's kube-proxy replacement feature?

A. Creating iptables rules B. Creating ipvs rules C. eBPF-based service load balancing D. Deploying HAProxy

Show Answer

Answer: C

Cilium can implement Kubernetes service load balancing using eBPF, which allows it to completely replace kube-proxy (iptables/ipvs).

Question 21

What problem does Maglev consistent hashing solve in Cilium service load balancing?

A. DNS resolution speed B. Maintaining existing connections when backends change C. TLS certificate management D. Pod scheduling optimization

Show Answer

Answer: B

Maglev consistent hashing ensures that existing connections are maintained to the same backend when backend Pods are added or removed. It minimizes hash table redistribution to ensure connection stability.

Question 22

What is the advantage of DSR (Direct Server Return) mode?

A. Response packets go directly to the client without passing through the original load-balancing node B. All traffic is encrypted C. L7 protocol analysis is possible D. Multi-cluster communication support

Show Answer

Answer: A

In DSR mode, response traffic is sent directly from the backend to the client, bypassing the original node that performed service load balancing. This reduces unnecessary hops and saves bandwidth.

Question 23

What is the primary purpose of Cilium's BGP Control Plane feature?

A. DNS resolution inside Pods B. Advertising Pod CIDRs and service IPs to BGP peers C. Container image registry management D. etcd cluster management

Show Answer

Answer: B

Cilium's BGP Control Plane (BGPCP) advertises Pod CIDRs, service LoadBalancer IPs, etc. to external BGP routers, enabling direct access to Pods/services from external networks.

Question 24

What is the approximate overhead added by VXLAN tunneling mode?

A. 8 bytes B. 50 bytes C. 100 bytes D. 200 bytes

Show Answer

Answer: B

VXLAN encapsulation adds approximately 50 bytes of additional headers (outer Ethernet + IP + UDP + VXLAN header) to packets. This may reduce MTU, so proper MTU configuration is needed.

Question 25

At which hook point does eBPF acceleration for NodePort services operate in Cilium?

A. Application Layer B. XDP or tc C. syslog D. Netfilter

Show Answer

Answer: B

Cilium processes NodePort service traffic at XDP or tc hook points. In XDP mode, it operates at the network driver level for maximum performance.

Question 26

What is the advantage of socket-level load balancing in Cilium?

A. L7 protocol analysis is possible B. Packets connect directly to the backend without traversing the network stack C. Automatic TLS termination D. DNS caching

Show Answer

Answer: B

Socket-level load balancing translates service IPs to backend IPs directly at the connect() system call time. This means packets avoid unnecessary NAT and conntrack processing.

Question 27

Why is Geneve tunneling preferred over VXLAN in Cilium?

A. Less overhead B. Supports extensible TLV (Type-Length-Value) option fields C. Faster encryption D. Supports only IPv4

Show Answer

Answer: B

Geneve supports TLV options that allow metadata (such as Identity information) to be included in the tunnel header. Cilium uses this to carry additional security context.

Question 28

What does Cilium's Host Firewall feature protect?

A. Pod-to-Pod communication only B. Traffic to and from the host network namespace C. External DNS requests D. etcd data

Show Answer

Answer: B

Cilium Host Firewall applies policies to traffic entering and leaving the node's host network namespace, enhancing node-level security.

Question 29

What configuration is needed to enable IPv4/IPv6 dual stack in Cilium?

A. enable-ipv4: true and enable-ipv6: true B. dual-stack: enabled C. ip-version: both D. network-mode: dual

Show Answer

Answer: A

Dual stack in Cilium is enabled by setting both enable-ipv4: true and enable-ipv6: true. Each protocol can be independently enabled or disabled.

Question 30

What Linux kernel feature does Cilium's Bandwidth Manager use?

A. cgroups B. EDT (Earliest Departure Time) based rate limiting C. tc-filter D. iptables rate limiting

Show Answer

Answer: B

Cilium's Bandwidth Manager uses EDT (Earliest Departure Time) and FQ (Fair Queuing) to implement per-Pod bandwidth limits. This is more efficient than traditional tc-based approaches.

Question 31

What is the purpose of WireGuard integration in Cilium?

A. L7 traffic analysis B. Transparent encryption of inter-node traffic C. DNS query acceleration D. Log collection

Show Answer

Answer: B

Cilium's WireGuard integration transparently encrypts Pod traffic between nodes. It provides simpler configuration and higher performance compared to IPsec.

Question 32

Which Cilium IPAM mode uses ENIs (Elastic Network Interfaces) in cloud environments?

A. Kubernetes Host Scope B. Cluster Scope C. AWS ENI mode D. CRD-backed

Show Answer

Answer: C

In AWS ENI mode, Cilium uses AWS ENIs to assign VPC-native IPs to each Pod, allowing Pods to use VPC routing directly.

Question 33

What is the purpose of BIG TCP in Cilium?

A. Limiting TCP connections B. Improving throughput via GRO/GSO for large packet processing C. Expanding TCP port range D. Adjusting TCP timeouts

Show Answer

Answer: B

BIG TCP leverages GRO (Generic Receive Offload) and GSO (Generic Segmentation Offload) to internally process packets larger than 64KB, significantly improving network throughput.

Question 34

How does Cilium implement session affinity for services?

A. iptables rules B. Storing client IP to backend mappings in BPF maps C. DNS round-robin D. Delegating to external load balancer

Show Answer

Answer: B

Cilium stores the mapping between client IP and selected backend in BPF maps to implement session affinity. Requests from the same client are directed to the same backend for the configured timeout duration.

Question 35

Which statement about IP Masquerading in Cilium is correct?

A. Always applies SNAT to all traffic B. Applies SNAT with node IP for traffic from Pods to destinations outside the cluster C. Applies only to inbound traffic D. Works only with IPv6

Show Answer

Answer: B

IP Masquerading translates the source IP of traffic from Pods to external destinations to the node IP (SNAT). It is implemented in eBPF and is not applied to cluster-internal traffic.

Question 36

What is the LB-IPAM feature for LoadBalancer type services in Cilium?

A. Automatic cloud load balancer provisioning B. Cilium directly allocates IPs from a LoadBalancer IP pool C. DNS-based load balancing D. Ingress controller deployment

Show Answer

Answer: B

LB-IPAM (LoadBalancer IP Address Management) allows Cilium to allocate external IPs from a predefined IP pool for LoadBalancer type services, providing on-premises load balancer functionality similar to MetalLB.

Network Policy (Questions 37-52)

Question 37

What is a correct difference between CiliumNetworkPolicy and Kubernetes NetworkPolicy?

A. CiliumNetworkPolicy supports L7 policies B. Kubernetes NetworkPolicy provides more features C. CiliumNetworkPolicy only supports cluster scope D. They have exactly the same features

Show Answer

Answer: A

CiliumNetworkPolicy is a superset of Kubernetes NetworkPolicy, supporting additional features such as L7 (HTTP, gRPC, Kafka) policies, FQDN-based policies, and Identity-based policies.

Question 38

Where are L3/L4 network policies enforced in Cilium?

A. Envoy proxy B. eBPF programs (kernel level) C. iptables D. User space firewall

Show Answer

Answer: B

L3/L4 policies are enforced directly at the kernel level by eBPF programs attached at tc hook points. This enables high-performance policy enforcement without user space proxy overhead.

Question 39

How do FQDN-based network policies work in Cilium?

A. Periodically querying external DNS servers B. Cilium DNS proxy intercepts DNS responses to learn IP mappings and apply policies C. Referencing /etc/hosts files D. Implemented as a CoreDNS plugin

Show Answer

Answer: B

Cilium transparently intercepts DNS responses through its DNS proxy and learns FQDN-to-IP mappings. Based on this information, it updates BPF maps to enforce FQDN-based policies at the IP level.

Question 40

What traffic does the following CiliumNetworkPolicy allow?

apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: allow-frontend
spec:
  endpointSelector:
    matchLabels:
      app: backend
  ingress:
    - fromEndpoints:
        - matchLabels:
            app: frontend
      toPorts:
        - ports:
            - port: '8080'
              protocol: TCP

A. Traffic from backend to frontend on port 8080 B. TCP traffic from frontend to backend on port 8080 C. Traffic from all Pods to backend D. All outbound traffic from backend

Show Answer

Answer: B

This policy selects endpoints with the app: backend label and allows ingress TCP traffic on port 8080 from endpoints with the app: frontend label.

Question 41

What is the purpose of CiliumClusterwideNetworkPolicy?

A. A policy that applies only to a specific namespace B. A network policy that applies across the entire cluster C. A policy applied to external clusters D. A DNS-only policy

Show Answer

Answer: B

CiliumClusterwideNetworkPolicy defines policies that apply across the entire cluster regardless of namespace. It is used for cluster-level default deny policies or common security rules.

Question 42

Which proxy is used when Cilium applies L7 network policies?

A. Nginx B. HAProxy C. Envoy D. Traefik

Show Answer

Answer: C

Cilium uses the Envoy proxy for L7 policy enforcement. It analyzes and filters L7 protocols such as HTTP, gRPC, and Kafka. Envoy runs as one instance per node.

Question 43

When is default deny behavior activated in Cilium network policies?

A. Automatically when Cilium is installed B. When at least one policy selecting a specific endpoint is applied C. Only when explicitly configured by an administrator D. By namespace labels

Show Answer

Answer: B

In Cilium, when a policy selecting a specific endpoint is applied, all traffic not explicitly allowed in that direction (ingress/egress) is denied.

Question 44

Which protocol is NOT supported in Cilium L7 policies?

A. HTTP B. gRPC C. Kafka D. MQTT

Show Answer

Answer: D

Cilium supports L7 policies for HTTP, gRPC, Kafka, DNS, and other protocols. MQTT is not natively supported by default.

Question 45

What is the purpose of Policy Audit Mode in Cilium?

A. Block and log policy-violating traffic B. Monitor policy-violating traffic without blocking it C. Automatically generate policies D. Optimize policy performance

Show Answer

Answer: B

In Policy Audit Mode, policy-violating traffic is not actually blocked but only logged. This allows you to assess the impact of policies before enforcing them.

Question 46

What is the purpose of CIDR-based egress rules in Cilium network policies?

A. Controlling Pod-to-Pod communication within the cluster B. Controlling egress traffic to specific external IP ranges C. Controlling DNS resolution D. Configuring Ingress controllers

Show Answer

Answer: B

CIDR-based egress rules are used to allow or deny outbound traffic from Pods to specific external IP ranges (e.g., 10.0.0.0/8).

Question 47

What does toEntities: world mean in Cilium?

A. All Pods in the same cluster B. All endpoints outside the cluster C. All endpoints not managed by Cilium D. DNS servers

Show Answer

Answer: B

The world entity represents all endpoints outside the cluster. Cilium provides predefined entities such as world, cluster, host, remote-node, and kube-apiserver.

Question 48

Given the following Cilium L7 policy example:

rules:
  http:
    - method: GET
      path: '/api/v1/users'

What traffic does this rule allow?

A. All HTTP traffic B. Only GET requests to the /api/v1/users path C. All HTTP methods to the /api/v1/users path D. Only POST requests

Show Answer

Answer: B

This L7 policy rule allows only HTTP GET requests to the /api/v1/users path. Other methods (POST, PUT, etc.) or other paths are denied.

Question 49

Where is Identity stored in Cilium's Identity-based policies?

A. Pod environment variables B. BPF maps and KVStore (CRD or etcd) C. ConfigMap D. Secret

Show Answer

Answer: B

Identity is stored in BPF maps for fast lookups in the datapath, and simultaneously stored in the KVStore (CRD or etcd) for cluster-wide sharing.

Question 50

How do you write policies that cross namespace boundaries in Cilium?

A. Directly specifying namespace names B. Using namespaceSelector to match namespace labels C. Always using CiliumClusterwideNetworkPolicy D. Adding iptables rules

Show Answer

Answer: B

In CiliumNetworkPolicy, including namespaceSelector in fromEndpoints or toEndpoints allows matching endpoints in other namespaces.

Question 51

What is the purpose of the toServices field in Cilium policies?

A. Defining egress policies targeting Kubernetes services B. Configuring service mesh C. Configuring service discovery D. Service monitoring

Show Answer

Answer: A

The toServices field defines egress policies based on Kubernetes service names and namespaces, enabling control of outbound traffic to specific services.

Question 52

What is the priority of deny rules in Cilium policies?

A. Always lower than allow rules B. Always higher than allow rules (deny takes precedence) C. By creation time D. By namespace alphabetical order

Show Answer

Answer: B

In Cilium, deny rules always take precedence over allow rules. If both allow and deny rules exist for the same traffic, that traffic is denied.

Service Mesh (Questions 53-64)

Question 53

What is the core principle of Cilium service mesh's sidecar-less architecture?

A. Injecting a sidecar container into each Pod B. One Envoy proxy per node with eBPF-based traffic redirection C. Integration with Istio sidecars D. Modifying application code

Show Answer

Answer: B

Cilium service mesh operates without sidecars, running a single shared Envoy proxy instance per node. It uses eBPF to transparently redirect only traffic that requires L7 policies to Envoy.

Question 54

What is the role of mTLS (Mutual TLS) in Cilium service mesh?

A. DNS encryption B. Mutual authentication and encryption of service-to-service communication C. Log encryption D. Storage encryption

Show Answer

Answer: B

mTLS enables both sides in service-to-service communication to verify each other's certificates and encrypt the communication. Cilium service mesh implements mTLS using SPIFFE-based Identity.

Question 55

Which is NOT an advantage of Cilium's sidecar-less service mesh?

A. Improved resource efficiency B. Reduced latency C. Independent Envoy configuration per Pod D. Reduced operational complexity

Show Answer

Answer: C

In sidecar-less mode, a single shared Envoy instance per node is used, so independent Envoy configuration per Pod is not possible. The benefits include resource efficiency, reduced latency, and reduced operational complexity.

Question 56

What is the purpose of the CiliumEnvoyConfig CRD?

A. Cilium Agent configuration B. Defining L7 traffic management rules for the Envoy proxy C. Hubble configuration D. BGP peer configuration

Show Answer

Answer: B

CiliumEnvoyConfig CRD allows defining Envoy proxy listeners, routes, clusters, and other L7 traffic management rules in a Kubernetes-native manner.

Question 57

What is included in Cilium service mesh's L7 traffic management capabilities?

A. Header-based routing B. GPU scheduling C. Storage provisioning D. Node autoscaling

Show Answer

Answer: A

Cilium service mesh L7 traffic management capabilities include header-based routing, URL path-based routing, traffic splitting (canary deployments), retries, timeouts, and more.

Question 58

What resource does Cilium use to provide Ingress controller functionality?

A. CiliumIngressController CRD B. Standard Kubernetes Ingress resources and CiliumEnvoyConfig C. Nginx ConfigMap D. Istio Gateway

Show Answer

Answer: B

Cilium provides a built-in Ingress controller that supports standard Kubernetes Ingress resources. Additional configuration is possible through CiliumEnvoyConfig.

Question 59

What does Gateway API support mean in Cilium service mesh?

A. Uses only proprietary APIs B. Natively supports Kubernetes Gateway API resources (Gateway, HTTPRoute, etc.) C. AWS API Gateway integration D. Automatic REST API generation

Show Answer

Answer: B

Cilium natively supports Kubernetes Gateway API (Gateway, HTTPRoute, GRPCRoute, TLSRoute, etc.) to provide standards-based traffic management.

Question 60

How are L4-level service mesh features (such as mTLS) implemented in Cilium?

A. Always through the Envoy proxy B. Directly in eBPF (without a proxy) C. Via iptables rules D. Via sidecar containers

Show Answer

Answer: B

Cilium can implement L4-level service mesh features (mTLS, load balancing, etc.) directly in eBPF. Traffic is only redirected to the Envoy proxy when L7 features are needed.

Question 61

What does a SPIFFE ID represent in Cilium's SPIFFE integration?

A. Pod IP address B. Cryptographic identifier of a workload C. Node hostname D. Namespace name

Show Answer

Answer: B

A SPIFFE ID is a URI-format cryptographic identifier that uniquely identifies a workload. Cilium uses SPIFFE to manage certificates used for mTLS authentication between workloads.

Question 62

How do you implement canary deployments in Cilium service mesh?

A. Adjusting Kubernetes Deployment replica count B. Setting weights on backendRefs in HTTPRoute C. DNS round-robin D. Manually changing Pod IPs

Show Answer

Answer: B

In Gateway API's HTTPRoute, you can set weights on backendRefs to split traffic proportionally, enabling canary deployments.

Question 63

Under what conditions is traffic redirected to Envoy in Cilium?

A. All traffic is always redirected B. Only traffic with L7 network policies applied C. Only TCP traffic D. Only UDP traffic

Show Answer

Answer: B

Cilium selectively redirects only traffic with L7 policies to the Envoy proxy. Traffic with only L3/L4 policies is processed directly in eBPF without proxy overhead.

Question 64

How do you configure retry policies in Cilium service mesh?

A. Implement in Pod application code B. Via CiliumEnvoyConfig or HTTPRoute retry settings C. Kubernetes livenessProbe D. sysctl parameters

Show Answer

Answer: B

Retry policies can be configured through CiliumEnvoyConfig or Gateway API HTTPRoute to leverage Envoy's retry capabilities. Retry count, timeout, and conditions can be finely tuned.

Observability (Questions 65-72)

Question 65

Which component in Hubble's architecture collects flow data on each node?

A. Hubble Relay B. Hubble UI C. Hubble embedded in the Cilium Agent D. Prometheus

Show Answer

Answer: C

Hubble runs embedded within the Cilium Agent on each node. It collects network flow events from the eBPF datapath into a ring buffer.

Question 66

What is the role of Hubble Relay?

A. Collecting flows from a single node B. Aggregating Hubble data from multiple nodes for cluster-wide observability C. DNS relay D. Load balancing

Show Answer

Answer: B

Hubble Relay connects to Hubble instances running on all cluster nodes and aggregates flow data, providing cluster-wide network observability.

Question 67

Which L7 protocol is NOT observable through Hubble?

A. HTTP B. DNS C. Kafka D. SMTP

Show Answer

Answer: D

Hubble can observe L7 protocol flows for HTTP, DNS, gRPC, and Kafka. SMTP is not natively supported by default.

Question 68

What is the command to view flows for a specific namespace in Hubble CLI?

A. hubble observe --namespace default B. hubble get flows --ns default C. hubble watch default D. hubble logs --namespace default

Show Answer

Answer: A

hubble observe --namespace default is used to observe network flows for a specific namespace in real time.

Question 69

What functionality does Hubble UI provide?

A. Service dependency topology map visualization B. Kubernetes resource YAML editing C. Container log viewer D. CI/CD pipeline management

Show Answer

Answer: A

Hubble UI visualizes service-to-service communication relationships as a topology map. It shows network flows in real time, allowing intuitive understanding of policy enforcement status and traffic flow.

Question 70

What information can be collected through Hubble's Prometheus metrics integration?

A. Flow counts, policy drop counts, HTTP request latency B. CPU usage C. Disk I/O D. Memory usage

Show Answer

Answer: A

Hubble provides network-related Prometheus metrics including network flow counts, policy drop counts, HTTP request/response latency, DNS query latency, and more.

Question 71

What is the command to view packets dropped by policies in Hubble?

A. hubble observe --verdict DROPPED B. hubble dropped-packets C. hubble observe --type drop D. hubble policy-violations

Show Answer

Answer: A

hubble observe --verdict DROPPED filters and displays traffic denied by network policies.

Question 72

What is the primary use of the Hubble gRPC API?

A. Pod scheduling B. Programmatic querying and streaming of flow data C. Kubernetes API server access D. Image registry management

Show Answer

Answer: B

The Hubble gRPC API allows external systems or custom tools to programmatically query and stream flow data.

Cluster Mesh and External Workloads (Questions 73-80)

Question 73

What is the core architectural component of Cilium ClusterMesh?

A. Centralized control plane B. Each cluster's etcd and clustermesh-apiserver C. Single shared etcd D. Consul

Show Answer

Answer: B

ClusterMesh has each cluster maintaining its own etcd while exposing information to other clusters through the clustermesh-apiserver. This is a fully distributed architecture with no single point of failure.

Question 74

What is a Global Service in ClusterMesh?

A. A service using the same IP across all clusters B. A service that distributes traffic across backends in multiple clusters under the same service name C. A service exposed to the external internet D. A DNS-only service

Show Answer

Answer: B

A Global Service has the same name and namespace across multiple clusters, with traffic distributed to backends in all clusters. It is enabled by the io.cilium/global-service: "true" annotation.

Question 75

How do you set service affinity to prefer the local cluster in ClusterMesh?

A. Add the io.cilium/service-affinity: "local" annotation to the service B. Change affinity-mode in ClusterMesh configuration C. Adjust DNS TTL D. Set BGP priority

Show Answer

Answer: A

Adding the io.cilium/service-affinity: "local" annotation to a service prioritizes local cluster backends, forwarding traffic to remote clusters only when no local backends are available.

Question 76

Why are cross-cluster network policies possible in ClusterMesh?

A. Only IP address-based policies are used B. Identities are synchronized across clusters enabling Identity-based policy enforcement C. A central firewall is used D. VPN tunnels are used

Show Answer

Answer: B

In ClusterMesh, Cilium Identities are synchronized across clusters. This enables label-based Identity policies to be applied to workloads in other clusters.

Question 77

What is the purpose of KVStoreMesh?

A. KVStore backup B. A caching layer to reduce KVStore load in large ClusterMesh environments C. KVStore encryption D. KVStore monitoring

Show Answer

Answer: B

KVStoreMesh caches remote cluster KVStore data locally in ClusterMesh, improving scalability in large multi-cluster environments.

Question 78

What does the Cilium External Workloads feature enable?

A. Installing Cilium Agent on external VMs or bare-metal servers to apply Kubernetes cluster network policies B. Managing external DNS servers C. Automatic cloud instance provisioning D. VPN server deployment

Show Answer

Answer: A

The External Workloads feature allows installing the Cilium Agent on VMs or bare-metal servers and joining them to the Kubernetes cluster, applying the same network policies and security Identities.

Question 79

Which is NOT a required prerequisite for setting up ClusterMesh?

A. Unique cluster ID for each cluster B. Non-overlapping Pod CIDRs between clusters C. All clusters must be on the same cloud provider D. Network connectivity between clusters

Show Answer

Answer: C

ClusterMesh is cloud provider agnostic. Required prerequisites are unique cluster IDs, non-overlapping Pod CIDRs, and network connectivity between clusters. It works across different cloud providers.

Question 80

What is the purpose of the CiliumBGPPeeringPolicy resource in Cilium BGP Control Plane (BGPCP)?

A. Running a BGP daemon inside Pods B. Declaratively defining BGP peering sessions and routes to advertise on nodes C. Automatic external BGP router deployment D. BGP traffic encryption

Show Answer

Answer: B

CiliumBGPPeeringPolicy is a Kubernetes resource that declaratively defines which nodes establish BGP peering sessions with which peers, and which routes (Pod CIDR, Service IPs, etc.) to advertise.

Summary

Domain Review

Domain	Question Range	Key Topics
Architecture	1-16	eBPF verifier, Identity, Agent/Operator, BPF maps, XDP
Networking	17-36	CNI, routing modes, Maglev, DSR, BGP, LB-IPAM, WireGuard
Network Policy	37-52	CiliumNetworkPolicy, L3/L4/L7, FQDN, Identity, Deny precedence
Service Mesh	53-64	Sidecar-less, Envoy, mTLS, Gateway API, SPIFFE
Observability	65-72	Hubble, Relay, UI, Prometheus, gRPC API
Cluster Mesh	73-80	etcd, Global Service, KVStoreMesh, External Workloads, BGPCP

Study Tips

Understand eBPF fundamentals: Verifier, BPF maps, program types (XDP, tc, socket) -- these concepts appear throughout the exam.
Master the Identity-based security model: Understand the label-based Identity allocation and policy enforcement mechanism that differentiates Cilium.
Hands-on practice: Use CLI tools like cilium status, cilium endpoint list, and hubble observe hands-on.
Reference official documentation: The Concepts section of the Cilium official documentation aligns most closely with the exam scope.