Free practice · No sign-up required
15 questions with answer explanations. Choose an answer below to begin.
What does Cilium primarily provide for containerized workloads?
Understand core Cilium capabilities for securing container communication.
0/15 answered · Bookmark questions to review later. Focus the practice area to use keys 1–9 and Enter.
Learn by doing
Use official documentation and hands-on labs to work through topics you missed.
Application examples from the Kubernetes project for practicing manifests and application behavior in a cluster.
Try it: Use a disposable cluster. Read a simple application's manifests, predict which Pods its Service selects, then change a label and use kubectl to diagnose the resulting connectivity problem.
Source is free. A local cluster uses your computer; hosted clusters may incur charges.
Guided tutorials for learning Kubernetes behavior and building practical skills beyond multiple-choice recall.
Try it: Complete a basic application tutorial. Repeat the task without the walkthrough, then explain the difference between declared configuration and observed cluster state.
Documentation is free. Your chosen cluster environment may have costs.
Prefer to read at your own pace? Work through each question below, then open its answer to check your reasoning. You can link directly to a question or print this reference.
What does Cilium primarily provide for containerized workloads?
Identity-aware network security and observability
Persistent storage orchestration
Automated image signing
Node-level resource scheduling
Correct answer
Identity-aware network security and observability
Cilium enforces network policies based on application identity rather than IP addresses. It also offers visibility into network flows for troubleshooting.
Which Cilium component runs as a daemon on each node?
cilium-agent
hubble-relay
kube-proxy
cilium-operator
Correct answer
cilium-agent
The cilium-agent is responsible for enforcing policies and managing connectivity on each node. Hubble-relay is optional for advanced observability.
What is a prerequisite for using Cilium with a Kubernetes cluster?
Container runtime support for CNI
Enabled Windows node groups
Static IP assignment for pods
External load balancer provisioning
Correct answer
Container runtime support for CNI
Cilium requires a CNI-compatible runtime to replace the default bridge and manage pod networking. Other options are not mandatory.
Which resource defines allowed communication between pods in Cilium?
NetworkPolicy
PodSecurityPolicy
IngressClass
ClusterRole
Correct answer
NetworkPolicy
Cilium extends the standard Kubernetes NetworkPolicy to provide L7 visibility and filtering based on application labels.
What protocol does Cilium use to enforce policies at the kernel level?
eBPF
iptables
IPsec
GRE
Correct answer
eBPF
Cilium leverages eBPF programs loaded into the Linux kernel to implement policies with low overhead and deep observability.
Which feature allows visibility into application-layer HTTP requests without sidecar proxies?
L7 policy enforcement
Hubble observability
NodePort services
Cilium health monitoring
Correct answer
L7 policy enforcement
Cilium can parse HTTP metadata directly in the kernel, enabling L7 rules and metrics without requiring proxies in the data path.
What is a valid method to install Cilium in a Kubernetes environment?
Using the cilium CLI install command
Applying a Helm chart from any public repo
Manual kernel module compilation
Editing kube-proxy configuration
Correct answer
Using the cilium CLI install command
The official cilium CLI provides a straightforward way to deploy and manage Cilium. Other methods are either unsupported or not standard.
Which statement describes Cilium's identity model?
Identities are assigned based on workload labels and remain stable
Identities are derived from pod IP addresses
Identities are only used for encryption
Identities are manually configured per namespace
Correct answer
Identities are assigned based on workload labels and remain stable
Cilium assigns identities to workloads dynamically based on labels, enabling policy enforcement that is resilient to IP changes.
What does Hubble primarily enable in a Cilium-powered cluster?
Network flow visibility and troubleshooting
Cluster backup and restore
Ingress controller configuration
Node autoscaling decisions
Correct answer
Network flow visibility and troubleshooting
Hubble is Cilium's observability tool that provides insights into network flows, policy denials, and service dependencies.
Which Cilium feature can enforce security policies at the socket level for non-container processes?
NodePort local mode
Transparent tunneling
Cilium host services
Masquerading
Correct answer
Cilium host services
Cilium host services allow policy enforcement for processes running directly on the host, not just inside containers.
What is a common use case for Cilium's FQDN policies?
Restrict pod access to specific domain names
Optimize DNS resolution latency
Replace external DNS providers
Generate TLS certificates automatically
Correct answer
Restrict pod access to specific domain names
FQDN policies allow defining network rules based on fully qualified domain names, useful for controlling outbound traffic.
Which component is responsible for distributing service IPs and load balancing traffic in Cilium?
cilium-agent
kube-apiserver
Hubble Relay
Linux iptables only
Correct answer
cilium-agent
The cilium-agent handles service IP allocation and load balancing for ClusterIP and external traffic within the Cilium data path.
What does Cilium's policy enforcement mode 'deny' imply?
All traffic is denied unless explicitly allowed
All traffic is allowed unless explicitly denied
Only encrypted traffic is permitted
Only traffic from same namespace is allowed
Correct answer
All traffic is denied unless explicitly allowed
In deny mode, Cilium blocks all traffic by default and only permits traffic matching defined policies.
Which best practice is recommended when defining Cilium network policies?
Start with wide policies and refine based on observability data
Apply deny-all policies to all namespaces immediately
Use only IP-based rules for simplicity
Disable Hubble to reduce cluster overhead
Correct answer
Start with wide policies and refine based on observability data
Observability data from Hubble helps identify allowed traffic patterns before tightening policies, reducing the risk of accidental isolation.
What does the Cilium CLI command 'hubble observe' primarily help with?
Troubleshooting connectivity issues by observing live network flows
Deploying Cilium using Helm
Encrypting etcd data at rest
Configuring kube-proxy in iptables mode
Correct answer
Troubleshooting connectivity issues by observing live network flows
The 'hubble observe' command provides real-time visibility into network flows, helping operators debug connectivity and policy enforcement issues.
Recall the answer before opening each card.
Identity-aware network security and observability. Cilium enforces policies based on application labels and provides visibility into network flows.
cilium-agent. It enforces policies and manages connectivity on each node. Hubble-relay is optional for advanced observability.
Container runtime support for CNI. Cilium requires a CNI-compatible runtime to replace the default bridge and manage pod networking.
NetworkPolicy. Cilium extends Kubernetes NetworkPolicy to provide L7 visibility and filtering based on application labels.
eBPF. Cilium leverages eBPF programs loaded into the Linux kernel to implement policies with low overhead and deep observability.
L7 policy enforcement. Cilium parses HTTP metadata directly in the kernel, enabling L7 rules and metrics without proxies.
Using the cilium CLI install command. The official CLI provides a straightforward way to deploy and manage Cilium.
Identities are assigned based on workload labels and remain stable. This enables policy enforcement resilient to IP changes.
Network flow visibility and troubleshooting. Hubble provides insights into network flows, policy denials, and service dependencies.
Cilium host services. They allow policy enforcement for processes running directly on the host, not just inside containers.
Restrict pod access to specific domain names. FQDN policies define network rules based on fully qualified domain names.
cilium-agent. It handles service IP allocation and load balancing for ClusterIP and external traffic within the Cilium data path.
All traffic is denied unless explicitly allowed. Cilium blocks all traffic by default and only permits traffic matching defined policies.
Start with wide policies and refine based on observability data. This reduces risk of accidental isolation before tightening policies.
Troubleshooting connectivity issues by observing live network flows. It provides real-time visibility into flows and policy enforcement.
Default deny. All traffic is blocked unless a policy explicitly allows it. This is the standard Cilium behavior to enforce security.
Cilium uses eBPF to perform load balancing directly in the kernel, avoiding iptables overhead. The cilium-agent manages service IPs and backend selection.
To decouple policy enforcement from IP addresses. By using labels, identities remain stable across pod restarts and network changes, simplifying policy management.
Yes, via Cilium host services. This extends policy enforcement to host processes and node-to-pod traffic, ensuring consistent security across the cluster.
Network flows at L3/L4 and L7 (HTTP, DNS). Hubble captures flow metadata including source/destination, protocol, and policy verdicts for troubleshooting.
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Connect the concepts
Open a branch to connect a topic with its practice questions and explanations. Use the map to choose your next review topic.
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
Cilium uses eBPF to provide network security and observability directly in the Linux kernel. The primary component is the cilium-agent daemon running on each node, which enforces policies and manages service load balancing. Hubble is an optional component for advanced flow visibility. Understanding how these components interact is fundamental to the CCA exam.
Cilium extends Kubernetes NetworkPolicy to support L7 filtering and identity-based rules. It assigns stable identities to workloads based on labels, allowing policies to remain effective even when IPs change. Cilium also supports FQDN policies for controlling outbound traffic to domain names. By default, Cilium operates in a deny mode, blocking all traffic unless explicitly allowed.
Hubble is Cilium's observability layer, providing real-time visibility into network flows, policy denials, and service dependencies. The 'hubble observe' command allows operators to troubleshoot connectivity issues by viewing live flows. Observability data is also essential for crafting effective policies, as it reveals legitimate traffic patterns before tightening rules.
Cilium can be installed using the 'cilium install' CLI command, which provides a straightforward method. A prerequisite is a CNI-compatible container runtime. Best practices for policy definition include starting with broad policies and refining based on observability data, rather than attempting to create perfect policies upfront. This iterative approach reduces risk of blocking legitimate traffic.
Study workflow
Use the cilium CLI to install Cilium on a Kubernetes cluster. Run 'cilium install' and verify that the cilium-agent pods are running on all nodes. Confirm that Cilium is the default CNI by checking node conditions. This establishes a baseline environment for further practice.
After installation, run 'hubble observe' to see live network flows between pods. Filter by namespace or labels to understand normal communication patterns. Note which flows are allowed and denied. This exercise demonstrates Hubble's observability capabilities and helps you identify traffic for policy creation.
Apply a Kubernetes NetworkPolicy that allows traffic only from specific pod labels (e.g., app: frontend to app: backend). Use 'kubectl apply' and then verify with 'hubble observe' that unmatched traffic is denied. This reinforces Cilium's identity-based policy enforcement and default-deny behavior.
Define a CiliumNetworkPolicy that allows a pod to access only specific external domain names (e.g., api.example.com). Apply the policy and test using curl or wget. Use Hubble to confirm that allowed DNS resolution and traffic are permitted while other domains are blocked.
Simulate a connectivity failure by applying a restrictive policy that blocks expected traffic. Use 'hubble observe --deny' to see dropped packets and policy verdicts. Identify the policy causing the denial and adjust it based on observed flows. This step teaches problem-solving with Hubble's observability data.
FAQ
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
eBPF is a Linux kernel technology that allows Cilium to enforce network policies and collect observability data directly in the kernel. It enables Cilium to process packets at high speed without sidecar proxies, providing low overhead and deep visibility into application-layer traffic.
Cilium assigns identities dynamically based on pod labels. When a pod is created, Cilium extracts its labels and associates them with a unique identifier. This identity remains stable even if the pod's IP changes, allowing policies to be enforced consistently without relying on network addresses.
The cilium-agent runs on each node and handles policy enforcement, networking, and service load balancing. Hubble-relay is an optional component that aggregates flow data from multiple cilium-agents, providing a central point for querying network flows across the cluster.
Yes, Cilium fully supports Kubernetes NetworkPolicy and extends it with L7 filtering, FQDN rules, and identity-based policies. You can use standard YAML manifests to define NetworkPolicy objects, and Cilium will enforce them using eBPF.
In default-deny mode, Cilium blocks all network traffic that is not explicitly allowed by a policy. This is the recommended starting point for security. Operators must define policies to permit specific flows, and Hubble helps observe which traffic needs to be allowed before tightening rules.
Browse another free bank or use the study strategy guide to turn your misses into spaced review.
