Cilium-Associate Linux Foundation Cilium Certified AssociateCCA Free Practice Exam Questions (2026 Updated)

Technical explanation

Ingress provides a comparatively simple API for exposing HTTP and HTTPS applications through host- and path-based routing. Gateway API is a broader, extensible family of resources that separates infrastructure configuration from application routing. Resources such as GatewayClass , Gateway , HTTPRoute , GRPCRoute , TLSRoute , TCPRoute , and UDPRoute model listeners, routes, protocols, ownership, and attachment relationships explicitly.

Gateway API was designed around operational roles. An infrastructure provider can manage the GatewayClass , a cluster operator can provision a Gateway , and an application team can own a route attached to that Gateway. This offers clearer delegation than the single Ingress resource and supports protocols and traffic-management functions beyond the original Ingress model.

The two APIs are not simply different names for identical functionality, so A is false. Option C is also inaccurate because Cilium’s implementations of both Ingress and Gateway API integrate with its eBPF datapath and Envoy; Ingress is not inherently an iptables-only implementation. Option D incorrectly limits Gateway API to internal routing. It can expose internet-facing applications through generated LoadBalancer or NodePort Services or through host-network listeners.

Official references

Migrating from Ingress to Gateway ; Gateway API Support .

Study Guide topic: Service Mesh.

Technical explanation

Hubble obtains its visibility from Cilium’s eBPF datapath, and the Hubble Server is embedded in the Cilium agent. Hubble therefore cannot provide its normal flow-observability capabilities as a standalone installation without Cilium, eliminating B.

CNI chaining allows Cilium to coexist with a supported existing CNI. The original plugin continues to supply base connectivity and IP address management, while Cilium attaches eBPF programs to the created network devices. Those programs provide visibility, policy enforcement, and other Cilium functionality. Hubble can then be enabled on top of the chained Cilium deployment. This approach avoids an immediate, disruptive replacement of the production cluster’s networking layer and is consequently the best answer.

Options C and D could be appropriate in broader migration projects, particularly when a current CNI is incompatible with chaining or when full native-Cilium functionality is required. However, both imply substantially more workload movement or cutover activity than the stated objective of minimizing downtime.

Compatibility, chaining mode, current CNI behavior, kernel requirements, and feature limitations must still be validated before production rollout.

Official references

Cilium CNI Chaining , Hubble Internals , Troubleshooting Hubble

Study Guide topic: Hubble prerequisites, CNI chaining, and production adoption.

Technical explanation

Hubble does not obtain Layer 7 protocol visibility exclusively through eBPF without a proxy. By default, Cilium’s datapath exposes Layer 3 and Layer 4 flow information. To produce supported application-layer events, traffic is selected through an L7 Cilium policy and redirected to the node-local Envoy proxy. Envoy parses the application protocol and forwards access-log information that Cilium and Hubble expose as Layer 7 flow events.

The other capabilities are supported. Hubble flow records contain the observing node, and the CLI provides node-based filtering. HTTP-aware flows can contain response status codes, enabling inspection or filtering for results such as 200 and 404. Hubble also records forwarding verdicts and drop reasons. Operators can filter for DROPPED traffic and distinguish policy-denied connections from forwarded traffic and other failure conditions.

This separation is fundamental to Cilium’s architecture: eBPF provides efficient kernel-level forwarding, security enforcement, and L3/L4 observability, while Envoy supplies protocol parsing when request-level context is required. The integration remains transparent to applications, but the proxy is still present in the traffic path for Layer 7 visibility.

Therefore, B describes the unsupported mechanism and is the correct answer.

Official references

Layer 7 Protocol Visibility ; Envoy ; Hubble CLI .

Study Guide topic: Network Observability.

Technical explanation

Cilium tunnel mode supports VXLAN and Geneve encapsulation. In this routing model, Cilium nodes form an overlay mesh, and traffic exchanged between nodes is carried inside UDP-encapsulated packets. VXLAN is the default tunnel protocol and normally uses UDP port 8472. Geneve is the alternative and normally uses UDP port 6081. Operators select the protocol through the tunnel-protocol configuration setting, whose documented values are vxlan and geneve .

Encapsulation reduces the requirements placed on the underlying network. The underlay only needs to provide IP connectivity between the Kubernetes nodes and permit the selected UDP tunnel port. It does not need to learn or route individual PodCIDRs. Cilium also uses the tunnel metadata to carry information such as the source security identity, avoiding an additional identity lookup on the receiving node.

MPLS, OTV, STT, and EVPN are not supported values for Cilium’s tunnel-protocol setting. EVPN may be used in broader data-center network designs, and MPLS is a carrier-routing technology, but neither is a Cilium overlay encapsulation choice. Therefore, B is the only supported pair.

Official references

Cilium Routing ; System Requirements .

Study Guide topic: Architecture.

Technical explanation

A Cluster Mesh can be created after assigning each cluster a unique name and numeric cluster ID. Cilium uses the cluster ID when constructing Cluster Mesh security identities, so duplicate values cannot safely identify endpoints from different clusters. The name must likewise be unique. These values can be changed after installation, although all existing workloads must then be restarted so their security identities are regenerated.

The other listed conditions are compatible. Both clusters use the same encapsulation datapath mode, their PodCIDRs are intended to be non-overlapping, and the nodes possess the required inter-cluster connectivity. Different Kubernetes patch or minor versions do not inherently prevent Cluster Mesh. Cilium versions may differ by one minor release, so versions 1.14 and 1.13 satisfy the documented compatibility rule.

Different certificate authorities are not an irreversible blocker under current documentation. Every cluster must trust certificates presented by the others. Operators may use a shared root CA or configure a CA bundle containing all trusted CA certificates. Consequently, B is too absolute. C is also false because changing the cluster identity is possible, subject to workload restarts. D is unnecessary because a one-minor Cilium difference is supported.

The source’s option A is truncated, but its intended corrective action is technically accurate.

Official references

Setting up Cluster Mesh .

Study Guide topic: Cluster Mesh.

Technical explanation

The manifest specifies both interface: net1 and egressIP: 10.3.4.5 in the same egressGateway configuration. These properties are mutually exclusive. Cilium ignores an Egress Gateway policy containing both, so A correctly identifies the defect.

When interface is supplied, Cilium uses the selected interface and chooses its first suitable IPv4 and IPv6 addresses as the SNAT addresses. When egressIP is supplied, that address must already be assigned to a network device on the chosen gateway node; Cilium determines the corresponding interface through a route lookup. Administrators may also omit both fields, causing Cilium to select the default-route interface and its addresses.

Option B is incorrect because matchLabels can contain multiple label key-value pairs, as the exhibit does with app: blog and component: backend . Option C is false because the egress address need not be publicly routable; private addresses are valid when routing and upstream network design support them. Option D is false because Cilium does not restrict gateway interfaces to names beginning with eth .

Official references

Cilium Egress Gateway

Study Guide topic: Egress Gateway node selection, interface selection, and SNAT addresses.

Technical explanation

Option B correctly represents the Ingress as a Gateway and an attached HTTPRoute . The Gateway is named cilium , uses gatewayClassName: cilium , and exposes an HTTP listener on port 80. The HTTPRoute uses parentRefs with the same Gateway name, cilium , so the route attaches to the declared listener. Its two rules preserve the original routing behavior: /details with PathPrefix targets the details Service on port 9080, while / with PathPrefix targets productpage on port 9080.

Option A declares a Gateway named cilium but attaches its route to nginx-gateway . Because the parent reference does not identify the displayed Gateway, it is not equivalent. Options C and D use kind: Route ; the correct resource kind for HTTP path routing is HTTPRoute . They also contain malformed or altered backend and matching fields. Option D changes the details backend name, while option C contains incorrect route structure and path content.

Cilium’s official migration example uses the same conversion pattern: the Ingress class becomes the Gateway’s class, paths move into HTTPRoute.rules , and the route identifies its Gateway through parentRefs .

The supplied key incorrectly identifies A. The verified answer is B.

Official references

HTTP Migration Example .

Study Guide topic: Service Mesh.

Technical explanation

The status output shows Envoy DaemonSet: disabled (using embedded mode) . In embedded mode, Cilium starts Envoy as a separate process inside the Cilium agent pod when a feature requiring Layer 7 processing—such as an L7 network policy, protocol visibility, Ingress, or Gateway API—is used. This is precisely the behavior described in option B.

The remaining choices contradict the exhibit. The Cilium DaemonSet has a desired count of three, which ordinarily indicates three schedulable nodes running Cilium, not four. Hubble Relay: OK means the aggregation component is healthy. Hubble Relay connects to the Hubble instances associated with Cilium agents and presents a multi-node API to clients such as Hubble CLI and Hubble UI. Finally, ClusterMesh: disabled rules out the claim that the installation is currently configured for Cilium Cluster Mesh service discovery and cross-cluster load balancing.

Cilium can alternatively run Envoy through the independently life-cycled cilium-envoy DaemonSet. That is not the deployment displayed here because the DaemonSet is explicitly disabled and embedded mode is reported.

Official references

Envoy deployment modes ; Hubble internals .

Study Guide topic: Architecture.

Technical explanation

In cluster-scope IPAM, the Cilium Operator allocates a PodCIDR to each node from the configured cluster-wide address pool. It records those allocations in each node’s CiliumNode custom resource, specifically under spec.ipam.podCIDRs . The Cilium agent waits for this allocation during startup and then performs host-local allocation of individual pod addresses from the CIDR assigned to its node.

This division of responsibility explains why C is correct. The agent consumes its assigned range and allocates endpoint addresses locally, but it does not independently choose the cluster-wide per-node PodCIDR. The Operator coordinates those ranges to prevent nodes from receiving overlapping allocations.

Options A and D describe Kubernetes host-scope IPAM rather than Cilium cluster-scope IPAM. In Kubernetes host-scope mode, the Kubernetes controller manager assigns PodCIDRs and exposes them through spec.podCIDR or spec.podCIDRs in the standard Kubernetes Node resource. Cluster-scope mode is specifically useful when Kubernetes is not configured to perform that allocation or when Cilium should control the cluster address pool.

Therefore, the managing component and resource are the Cilium Operator and CiliumNode , respectively.

Official references

Cluster-Pool IPAM ; Cluster Scope IPAM .

Study Guide topic: Installation and Configuration.

Technical explanation

A is clearly the intended answer because its filters correspond to the displayed source namespace ( endor ), destination port ( 443 ), and verdict ( DROPPED ). However, it contains example.con , whereas the observed flow names example.com . Therefore, none of the options would literally return this exact flow if the FQDN filter is matched as written. The corrected command is:

hubble observe --to-fqdn example.com --from-namespace endor --to-port 443 --verdict DROPPED

Option B is malformed in two additional places and filters port 80 rather than 443. Option C selects the wrong FQDN and source namespace. Option D requests forwarded flows, directly contradicting the Policy denied DROPPED verdict; its wildcard also does not repair the verdict mismatch.

Hubble’s observe filters are cumulative: a returned flow must satisfy the specified destination FQDN, originating namespace, destination port, and verdict. Layer 7 visibility is enabled with a Cilium network policy containing the relevant L7 rules, which redirects selected traffic through the proxy so that application-level details can be reported.

Official references

Inspecting Network Flows with the Hubble CLI , Layer 7 Protocol Visibility

Study Guide topic: Hubble flow filtering, FQDN visibility, namespaces, ports, and verdicts.

Technical explanation

Cilium functions as a Kubernetes Container Network Interface implementation. When Kubernetes creates or removes a pod sandbox, the container runtime invokes the configured CNI plugin. Cilium establishes the pod’s network connectivity, connects the workload to the node’s networking environment, allocates or obtains an address through the configured IPAM mode, and coordinates the endpoint with the Cilium agent. Its eBPF datapath then supplies routing, service load balancing, policy enforcement, and network visibility.

Cilium provides substantially more functionality than the minimum CNI contract, but those additional capabilities do not change its primary Kubernetes networking role. Hubble supplies integrated network observability, yet Cilium is not merely a container-metrics monitor. Resource utilization such as CPU and memory is normally handled through Kubernetes metrics and monitoring systems.

Cilium is also not a Container Storage Interface. CSI drivers manage storage volumes, attachment, mounting, and lifecycle operations, which are unrelated to Cilium’s primary responsibilities. Nor is Cilium simply a pod-operation logging mechanism. It can emit datapath events and diagnostic logs, but those are supporting capabilities.

Accordingly, D provides the correct architectural classification for Cilium in a Kubernetes cluster.

Official references

Introduction to Cilium and Hubble ; Cilium Helm Installation .

Study Guide topic: Architecture.

Technical explanation

Kubernetes kube-proxy conventionally implements Service translation and load balancing through either iptables or IPVS. With Cilium’s kube-proxy replacement enabled, eBPF programs and maps perform Kubernetes Service handling directly in the kernel, including ClusterIP, NodePort, LoadBalancer, ExternalIP, and related service translation functions. C is therefore correct.

The replacement can operate at socket hooks and packet-processing hooks. Service and backend information is stored in eBPF maps, allowing the datapath to select backends and perform address translation without traversing the kube-proxy-generated iptables or IPVS rules normally used for Kubernetes Services.

BGP is not replaced. Cilium’s BGP Control Plane is a separate feature used to advertise routes and service addresses to external routers. Routing itself is also not eliminated; Cilium can implement and accelerate routing decisions with eBPF, but packets still require a valid forwarding model. firewalld is a host firewall-management service and is not the underlying Kubernetes Service implementation replaced by kube-proxy replacement.

Relevant installations must satisfy the kernel and device requirements for Cilium’s eBPF service load-balancer functionality.

Official references

Kubernetes Without kube-proxy

Study Guide topic: kube-proxy replacement, eBPF service maps, iptables, and IPVS.

Technical explanation

The requirement is that traffic remain encrypted all the way from the external client to the backend Service . Therefore, TLS must not terminate at the Cilium Gateway/Envoy proxy .

With TLS Passthrough , Cilium forwards the encrypted TLS stream to the backend without decrypting the application traffic. Envoy can inspect the TLS ClientHello/SNI sufficiently to select the appropriate backend, but the TLS session itself continues to the Service. Cilium specifically supports TLS passthrough with the Gateway API TLSRoute resource .

By contrast, TLS Terminate + HTTPRoute decrypts the connection at the Gateway. Although a separate encrypted connection to the backend can be configured in some architectures, that is not the same as preserving the original end-to-end TLS session requested here. Cilium's HTTPS Gateway examples use TLS termination when the Gateway itself handles the certificate.

Study Guide topic: Service Mesh.

Technical explanation

C accurately describes eBPF host-routing. In a conventional datapath, packets may traverse substantial portions of the host networking stack and its iptables hooks even when Cilium performs routing decisions with eBPF. eBPF host-routing takes a more direct datapath, bypassing iptables and the upper host stack while providing a faster transition between the host and pod network namespaces. This reduces processing and context-switching overhead and can improve throughput and latency.

Option A describes load-balancing behavior rather than host routing. Backend distribution is implemented through Cilium’s service load-balancer maps and algorithms. Host routing can improve the path used by resulting packets, but it does not itself guarantee even backend selection.

Option B is the description of BIG TCP. BIG TCP increases the size of internal GSO and GRO packets to reduce stack traversal. Although BIG TCP requires eBPF host-routing in supported Cilium configurations, the two are distinct features.

Option D is overly specific and does not define the feature. Host routing optimizes compatible pod traffic generally, subject to kernel, kube-proxy-replacement, masquerading, netfilter, encryption, and integration constraints.

Official references

Cilium eBPF Host-Routing

Study Guide topic: eBPF host-routing, host-stack bypass, veth traversal, and performance.

Technical explanation

The host entity represents the local node on which the selected Cilium endpoint resides. It also includes processes and containers using the local host network namespace. Therefore, A reproduces the official entity definition accurately.

The remote-node entity does not represent arbitrary unmanaged endpoints. It represents hosts other than the local node across the local cluster and connected clusters, including host-networked containers on those nodes. Unmanaged endpoints instead have the reserved unmanaged identity.

Option C gives the definition of the separate kube-apiserver entity, not cluster . The cluster entity is the logical collection of endpoints and reserved identities inside the local cluster, including Cilium-managed endpoints, unmanaged local endpoints, hosts, remote nodes, health, ingress, initialization, and kube-apiserver identities. Current documentation separately provides a cluster-mesh entity for endpoints in connected clusters.

Option D confuses all with world . world represents endpoints outside the cluster. all covers all identities and is not simply equivalent to the IPv4 CIDR 0.0.0.0/0 , particularly in identity-aware, node, and IPv6 contexts.

Official references

Cilium Layer 3 Policy Entities , Cilium Reserved Identities

Study Guide topic: Reserved entities and identity-based Layer 3 policies.

Technical explanation

Option D uses the correct structure for permitting egress from selected endpoints to the local host entity. The endpointSelector selects endpoints whose label env equals dev . Because the intended traffic travels from those endpoints toward the host, the policy must contain an egress rule. An egress peer is expressed through toEntities , and host is the reserved entity representing the local host, including host-networked containers on that node.

Option A is invalid because fromEntities is an ingress-oriented field and cannot express an egress destination. Option B uses nodeSelector , which selects nodes rather than workload endpoints and is only valid for node-level rules in a CiliumClusterwideNetworkPolicy ; it is not valid in the displayed namespaced CiliumNetworkPolicy . It also combines ingress with toEntities , reversing the rule direction. Option C has a valid workload selector but again uses toEntities under ingress ; ingress rules describe sources through constructs such as fromEntities .

Applying option D places the selected endpoints into egress default-deny mode and then expressly permits traffic whose destination is the host entity. Other egress traffic must be allowed separately.

Official references

Policy Enforcement and Rule Basics ; Endpoint Lifecycle policy examples .

Study Guide topic: Network Policy.

Technical explanation

If a global Service has no healthy local endpoints matching its selector, every available backend can be remote. Cluster Mesh synchronizes remote service and endpoint information, allowing the local Cilium datapath to load-balance requests to backend pods in connected clusters. The absence of local endpoints therefore provides a direct explanation for the observed behavior.

If the local cluster were not part of the Cluster Mesh, its Cilium agents would not normally receive the remote endpoint state needed to route traffic through the global Service, so B does not explain successful remote-only selection. An affinity value of none is the default behavior and expresses no preference between local and remote endpoints. When both categories exist and are healthy, this permits load balancing across both; it does not require every connection to use remote backends.

Setting service.cilium.io/shared: "false" prevents the local Service’s backends from being shared with remote clusters. It does not instruct the local cluster to direct all requests toward remote endpoints.

A separate possible cause, not presented among the choices, would be service.cilium.io/affinity: "remote" . Among the supplied answers, however, A is the valid explanation.

Official references

Service Affinity ; Cluster Mesh .

Study Guide topic: Cluster Mesh.