Cilium Certified Associate Free Practice Questions
This deck focuses on the core knowledge areas tested in the Cilium Certified Associate practice bank. You will learn about Cilium's identity-aware security model, eBPF-based data path, and how it enforces policies at L3/L4 and L7. The practice questions cover key components like cilium-agent and Hubble, installation prerequisites, policy enforcement modes (default deny), and best practices for policy creation using observability data. Mastering these topics will help you understand Cilium's role in securing and observing containerized workloads in Kubernetes.
What this CCA practice set measures
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
Core Architecture and Components
Cilium uses eBPF to provide network security and observability directly in the Linux kernel. The primary component is the cilium-agent daemon running on each node, which enforces policies and manages service load balancing. Hubble is an optional component for advanced flow visibility. Understanding how these components interact is fundamental to the CCA exam.
- Cilium enforces network policies based on application identity (labels) rather than IP addresses.
- The cilium-agent is responsible for policy enforcement and connectivity on each node.
- Hubble provides network flow visibility and troubleshooting capabilities.
- Cilium requires a CNI-compatible container runtime to replace the default Kubernetes bridge.
Policy Enforcement and Identity Model
Cilium extends Kubernetes NetworkPolicy to support L7 filtering and identity-based rules. It assigns stable identities to workloads based on labels, allowing policies to remain effective even when IPs change. Cilium also supports FQDN policies for controlling outbound traffic to domain names. By default, Cilium operates in a deny mode, blocking all traffic unless explicitly allowed.
- Cilium assigns identities dynamically based on workload labels, not IP addresses.
- Standard Kubernetes NetworkPolicy is used, extended with L7 visibility and FQDN rules.
- FQDN policies restrict pod access to specific domain names.
- Default mode denies all traffic; only traffic matching policies is allowed.
- Cilium can enforce policies at the socket level for host processes via host services.
Observability and Troubleshooting
Hubble is Cilium's observability layer, providing real-time visibility into network flows, policy denials, and service dependencies. The 'hubble observe' command allows operators to troubleshoot connectivity issues by viewing live flows. Observability data is also essential for crafting effective policies, as it reveals legitimate traffic patterns before tightening rules.
- Hubble enables network flow visibility and troubleshooting in Cilium-powered clusters.
- The 'hubble observe' command shows live network flows for debugging.
- Observing traffic patterns helps define policies that avoid accidental isolation.
- Hubble-relay optionally aggregates flows for advanced observability.
Installation and Best Practices
Cilium can be installed using the 'cilium install' CLI command, which provides a straightforward method. A prerequisite is a CNI-compatible container runtime. Best practices for policy definition include starting with broad policies and refining based on observability data, rather than attempting to create perfect policies upfront. This iterative approach reduces risk of blocking legitimate traffic.
- The official cilium CLI (cilium install) is a valid installation method.
- Cilium requires a CNI-compatible container runtime (e.g., containerd, CRI-O).
- Start with permissive policies and tighten using Hubble flow data.
- Use 'hubble observe' to identify expected traffic before enforcing restrictive policies.
- Cilium host services extend policy enforcement to non-container processes on nodes.
Practice Cilium Certified Associate with real flashcards
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Static practice bank
Start the 15-question diagnostic
The complete question bank is embedded in this pre-rendered page. There is no database request or second content download when you begin.
What does Cilium primarily provide for containerized workloads?
Show hint
Understand core Cilium capabilities for securing container communication.
Study workflow
Turn one CCA attempt into a study plan
- 1
Deploy Cilium in a Test Cluster
Use the cilium CLI to install Cilium on a Kubernetes cluster. Run 'cilium install' and verify that the cilium-agent pods are running on all nodes. Confirm that Cilium is the default CNI by checking node conditions. This establishes a baseline environment for further practice.
- 2
Observe Default Network Flows
After installation, run 'hubble observe' to see live network flows between pods. Filter by namespace or labels to understand normal communication patterns. Note which flows are allowed and denied. This exercise demonstrates Hubble's observability capabilities and helps you identify traffic for policy creation.
- 3
Create a Basic NetworkPolicy
Apply a Kubernetes NetworkPolicy that allows traffic only from specific pod labels (e.g., app: frontend to app: backend). Use 'kubectl apply' and then verify with 'hubble observe' that unmatched traffic is denied. This reinforces Cilium's identity-based policy enforcement and default-deny behavior.
- 4
Implement an FQDN Policy
Define a CiliumNetworkPolicy that allows a pod to access only specific external domain names (e.g., api.example.com). Apply the policy and test using curl or wget. Use Hubble to confirm that allowed DNS resolution and traffic are permitted while other domains are blocked.
- 5
Troubleshoot Policy Denials
Simulate a connectivity failure by applying a restrictive policy that blocks expected traffic. Use 'hubble observe --deny' to see dropped packets and policy verdicts. Identify the policy causing the denial and adjust it based on observed flows. This step teaches problem-solving with Hubble's observability data.
FAQ
Questions about this CCA practice page
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
What is the role of eBPF in Cilium?+
eBPF is a Linux kernel technology that allows Cilium to enforce network policies and collect observability data directly in the kernel. It enables Cilium to process packets at high speed without sidecar proxies, providing low overhead and deep visibility into application-layer traffic.
How does Cilium assign identity to pods?+
Cilium assigns identities dynamically based on pod labels. When a pod is created, Cilium extracts its labels and associates them with a unique identifier. This identity remains stable even if the pod's IP changes, allowing policies to be enforced consistently without relying on network addresses.
What is the difference between cilium-agent and hubble-relay?+
The cilium-agent runs on each node and handles policy enforcement, networking, and service load balancing. Hubble-relay is an optional component that aggregates flow data from multiple cilium-agents, providing a central point for querying network flows across the cluster.
Does Cilium support standard Kubernetes NetworkPolicy?+
Yes, Cilium fully supports Kubernetes NetworkPolicy and extends it with L7 filtering, FQDN rules, and identity-based policies. You can use standard YAML manifests to define NetworkPolicy objects, and Cilium will enforce them using eBPF.
What does default-deny mode mean in Cilium?+
In default-deny mode, Cilium blocks all network traffic that is not explicitly allowed by a policy. This is the recommended starting point for security. Operators must define policies to permit specific flows, and Hubble helps observe which traffic needs to be allowed before tightening rules.
Build the next review session
Browse another free bank or use the study strategy guide to turn your misses into spaced review.