I85PREP
⌘ K
Cilium Certified Associate study materials
Cilium Certified Associate study resources

Cilium Certified Associate practice questions

One question at a time. Build your Cilium Certified Associate understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cilium Architecture and Fundamentals

Which component on each node applies Cilium's eBPF programs to the network interfaces and enforces policy at the kernel level?

  1. The clustermesh-apiserver
  2. The Hubble relay
  3. The Cilium agent (cilium-agent) Correct answer.
  4. The Cilium operator

Explanation

The Cilium agent runs as a DaemonSet on every node and is responsible for loading eBPF programs, managing endpoints, and enforcing policy locally. The operator handles cluster-wide tasks, not per-node datapath programming.

Question 2Cilium Architecture and Fundamentals

What is the primary role of the Cilium operator?

  1. Aggregating flow logs from all nodes for the Hubble UI
  2. Loading eBPF programs into the kernel on each node
  3. Handling cluster-wide operations such as IP address management and CRD garbage collection Correct answer.
  4. Terminating service traffic at the node edge

Explanation

The operator is a single logical component (typically one replica with leader election) that handles cluster-scoped duties like IPAM, garbage collection of Cilium CRDs, and syncing Kubernetes resources. It deliberately does not sit in the per-packet datapath.

Question 3Cilium Architecture and Fundamentals

Cilium identifies endpoints internally by a numeric identity. What does a security identity primarily represent in Cilium?

  1. A set of labels used to select which endpoints a policy applies to Correct answer.
  2. The node on which a pod is scheduled
  3. The numeric IP address assigned to a pod
  4. The Kubernetes namespace UID

Explanation

Security identities are numeric IDs derived from an endpoint's label set, allowing policy to be expressed and enforced against labels rather than IP addresses. All endpoints sharing the same relevant labels share an identity.

Question 4Cilium Architecture and Fundamentals

Which statement best describes the relationship between CiliumEndpoint and CiliumEndpointSlice resources?

  1. CiliumEndpointSlice is used only in clustermesh and has no effect in a single cluster
  2. CiliumEndpointSlice groups many CiliumEndpoint objects to reduce the number of objects the operator and agents must watch Correct answer.
  3. CiliumEndpointSlice replaces CiliumEndpoint entirely and is the only supported representation
  4. CiliumEndpointSlice stores policy rules while CiliumEndpoint stores identities

Explanation

CiliumEndpointSlice was introduced to batch CiliumEndpoint data into fewer objects, which improves scalability by reducing watch and API server load in large clusters. CiliumEndpoint objects still exist as the per-endpoint representation.

Question 5Cilium Architecture and Fundamentals

A cluster uses Kubernetes IPAM mode. Where does Cilium obtain pod IP addresses in this mode?

  1. From the PodCIDR that Kubernetes assigns to each node Correct answer.
  2. From a central etcd key-value store managed by Cilium
  3. From the cloud provider's elastic network interface API
  4. From a static pool defined in the CiliumNode resource

Explanation

In Kubernetes IPAM mode the agent allocates pod IPs from the per-node PodCIDR that the Kubernetes control plane assigns. Other modes such as cluster-pool, ENI, and Azure use different sources.

Question 6Cilium Architecture and Fundamentals

Which Cilium IPAM mode allocates pod IPs from a cluster-wide pod CIDR that is subdivided into per-node ranges managed through CiliumNode resources?

  1. kubernetes
  2. cluster-pool Correct answer.
  3. eni
  4. azure

Explanation

Cluster-pool mode takes a cluster-wide pod CIDR, splits it into per-node pod CIDRs, and records allocations in CiliumNode objects, giving the operator control over address distribution. The kubernetes mode instead relies on PodCIDRs assigned by Kubernetes.

Question 7Cilium Architecture and Fundamentals

What does the CiliumNode custom resource represent?

  1. The per-node view of networking state, including allocated pod IPs and node addresses Correct answer.
  2. A Kubernetes Service exported to other clusters
  3. A network policy scoped to a single node
  4. A record of Hubble flow events for a node

Explanation

CiliumNode holds node-scoped networking information such as addresses, health status, and IPAM allocation details, and it is used by the operator and agents to coordinate. It is not a policy or observability object.

Question 8Cilium Architecture and Fundamentals

Which Cilium component is responsible for translating Kubernetes Services into eBPF service maps so that traffic can be load balanced without kube-proxy?

  1. The Hubble relay
  2. The Cilium CLI
  3. The Cilium agent on each node Correct answer.
  4. The clustermesh-apiserver

Explanation

Each agent watches Kubernetes Services and Endpoints and programs the eBPF service and backend maps on its own node, enabling kube-proxy-free load balancing. Central components such as Hubble relay do not program datapath maps.

Question 9Cilium Architecture and Fundamentals

In Cilium's architecture, what is the role of the eBPF datapath compared with iptables-based networking?

  1. It relies on the kube-proxy process to make forwarding decisions
  2. It only handles traffic entering from outside the cluster
  3. It forwards all packets to userspace for policy evaluation
  4. It processes packets in the kernel using attached programs, avoiding long sequential rule chains Correct answer.

Explanation

Cilium attaches eBPF programs at hook points such as tc and socket layers, so forwarding, NAT, and policy decisions are made in-kernel with map lookups rather than by traversing long iptables chains. This improves scalability and allows identity-aware enforcement.

Question 10Cilium Architecture and Fundamentals

Which Cilium feature provides flow-level visibility by collecting and exposing network flow data from the eBPF datapath?

  1. BGP Control Plane
  2. Hubble Correct answer.
  3. Cluster Mesh
  4. Bandwidth Manager

Explanation

Hubble is Cilium's observability layer, gathering flow events generated by the eBPF datapath and exposing them through CLI, API, and UI. The other features address multi-cluster connectivity, rate limiting, and route advertisement.

Question 11Cilium Architecture and Fundamentals

Which Hubble component aggregates flow data from all Cilium agents so that a single query can observe the whole cluster?

  1. cilium-envoy
  2. hubble-relay Correct answer.
  3. clustermesh-apiserver
  4. cilium-operator

Explanation

hubble-relay connects to each agent's Hubble gRPC API and merges the results, providing cluster-wide visibility to the CLI and UI. Individual agents only know their own node's flows.

Question 12Cilium Architecture and Fundamentals

What is the purpose of Cilium Cluster Mesh?

  1. To replicate the Cilium agent DaemonSet across availability zones within one cluster
  2. To connect multiple Kubernetes clusters so that services and identities can be shared across them Correct answer.
  3. To replace the Kubernetes API server with Cilium's own control plane
  4. To store all flow logs in a central database

Explanation

Cluster Mesh links clusters by sharing endpoint and identity information, enabling cross-cluster service discovery and policy enforcement using the same identity model. It does not replace Kubernetes control-plane functions.

Question 13Cilium Architecture and Fundamentals

When Cluster Mesh is enabled, how do identities behave across the participating clusters?

  1. Identities are shared so that the same label set maps to the same numeric identity in every member cluster Correct answer.
  2. Identities are converted to IP addresses before crossing cluster boundaries
  3. Identities only apply within a single namespace of the local cluster
  4. Each cluster generates identities independently and they never match across clusters

Explanation

Cluster Mesh synchronizes identity allocation so that a given label set has a consistent numeric identity cluster-wide, which lets policy written in one cluster apply to matching endpoints in another. Without this, cross-cluster policy would be ambiguous.

Question 14Cilium Architecture and Fundamentals

Which Cilium CRD is used to define Layer 3 and Layer 4 network policy for endpoints selected by labels?

  1. CiliumNetworkPolicy Correct answer.
  2. CiliumBGPPeeringPolicy
  3. CiliumEndpoint
  4. CiliumNode

Explanation

CiliumNetworkPolicy extends Kubernetes NetworkPolicy semantics and expresses ingress and egress rules for selected endpoints, including L3/L4 and optionally L7 rules. The other CRDs describe node state, endpoint state, or BGP configuration.

Question 15Cilium Architecture and Fundamentals

A CiliumNetworkPolicy selects endpoints with the label app=web and specifies an ingress rule allowing traffic from app=api on port 8080. Which traffic is permitted to the selected endpoints?

  1. All traffic from any source because ingress is allowed
  2. Only traffic from endpoints labeled app=api on TCP port 8080 Correct answer.
  3. Traffic from app=api on any port
  4. All traffic on port 8080 regardless of source labels

Explanation

Cilium policies are additive allow rules: the selected endpoints accept traffic only from the specified peer selector and only on the specified port. Once a policy selects an endpoint, other traffic is denied by default.

Question 16Cilium Architecture and Fundamentals

What happens to an endpoint's traffic when it is first selected by any CiliumNetworkPolicy?

  1. All traffic continues to flow until a second policy is added
  2. The endpoint is automatically restarted to apply the policy
  3. The endpoint becomes subject to default-deny for directions covered by policy, allowing only explicitly permitted traffic Correct answer.
  4. Only egress traffic is blocked while ingress remains open

Explanation

Cilium follows a default-deny model for any endpoint selected by policy, so only traffic matched by allow rules proceeds. Endpoints not selected by any policy remain unrestricted.

Question 17Cilium Architecture and Fundamentals

What distinguishes a CiliumClusterwideNetworkPolicy from a CiliumNetworkPolicy?

  1. It is cluster-scoped and can select endpoints across all namespaces Correct answer.
  2. It only supports egress rules
  3. It is used exclusively for L7 HTTP policy
  4. It applies only to the kube-system namespace

Explanation

CiliumClusterwideNetworkPolicy is a cluster-scoped resource, allowing policy to target endpoints in any namespace, which is useful for baseline rules. CiliumNetworkPolicy is namespaced and selects endpoints within its own namespace.

Question 18Cilium Architecture and Fundamentals

Which Cilium capability allows policy to be enforced on HTTP methods and paths rather than only on IP and port?

  1. Layer 2 policy rules enforced directly in the tc hook
  2. Bandwidth Manager rate limiting
  3. Layer 7 policy rules embedded in CiliumNetworkPolicy that are enforced via the embedded Envoy proxy Correct answer.
  4. BGP route filtering

Explanation

Cilium implements L7 policy by redirecting selected traffic to its embedded Envoy proxy, where HTTP-aware rules such as method and path matching are enforced. L3/L4 rules stay in the eBPF datapath.

Question 19Cilium Architecture and Fundamentals

Which Cilium concept allows an operator to define a reusable set of CIDRs that multiple policies can reference by name?

  1. CiliumLocalRedirectPolicy
  2. CiliumCIDRGroup Correct answer.
  3. CiliumIdentity
  4. CiliumNode

Explanation

CiliumCIDRGroup is a cluster-scoped resource holding a list of CIDRs that policies reference by group name, which avoids duplicating long CIDR lists. It is unrelated to node state, identities, or local redirect behavior.

Question 20Cilium Architecture and Fundamentals

Which Cilium component provides the L7 proxy used to enforce HTTP, gRPC, and Kafka policy rules?

  1. The cilium-operator
  2. The Kubernetes API server
  3. The Hubble relay
  4. The embedded Envoy proxy managed by the Cilium agent Correct answer.

Explanation

Cilium embeds Envoy and has the agent configure it dynamically for traffic that requires L7 policy or visibility. The eBPF datapath redirects selected flows to this proxy.

Question 21Cilium Architecture and Fundamentals

What is the function of the CiliumLocalRedirectPolicy resource?

  1. Restricting which nodes may host a given pod
  2. Encrypting traffic between nodes with WireGuard
  3. Converting ClusterIP services into NodePort services
  4. Redirecting traffic addressed to a service to a local pod on the same node for cases such as node-local DNS Correct answer.

Explanation

CiliumLocalRedirectPolicy lets traffic destined for a service be redirected to a pod on the same node, commonly used for node-local DNS caching. It affects traffic steering, not scheduling, service type, or encryption.

Question 22Cilium Architecture and Fundamentals

Cilium can provide transparent encryption of node-to-node traffic. Which statement about its encryption options is accurate?

  1. Encryption is only possible for traffic leaving the cluster
  2. IPsec and WireGuard are both supported, with WireGuard configured per node through Cilium's encryption settings Correct answer.
  3. Encryption requires replacing the Cilium agent with a sidecar proxy
  4. Only IPsec is supported and WireGuard is unavailable in Cilium

Explanation

Cilium supports transparent encryption using either IPsec or WireGuard, selected through configuration, and applies it to traffic between nodes. This happens in the datapath without sidecars.

Question 23Cilium Architecture and Fundamentals

A team wants Cilium to advertise pod and service IPs to an external router using BGP. Which Cilium feature should they configure?

  1. The Bandwidth Manager
  2. Cluster Mesh with global services
  3. The BGP Control Plane with BGP peering policies Correct answer.
  4. Hubble with flow export enabled

Explanation

Cilium's BGP Control Plane advertises routes to external peers and is configured through BGP peering policy resources. Hubble, Bandwidth Manager, and Cluster Mesh address observability, rate limiting, and multi-cluster connectivity respectively.

Question 24Cilium Architecture and Fundamentals

Which statement about the cilium-operator deployment model is correct?

  1. It runs only inside the kube-system namespace of remote clusters
  2. It is optional and the agent performs all cluster-wide tasks when it is absent
  3. It must run as a DaemonSet on every node to program eBPF
  4. It typically runs with leader election so that one active replica performs cluster-wide tasks Correct answer.

Explanation

The operator usually runs as a Deployment with leader election: multiple replicas may exist for availability, but only the leader performs tasks like IPAM and garbage collection. It is not a per-node component.

Question 25Cilium Architecture and Fundamentals

Which Cilium resource records the identity and networking details of an individual endpoint, such as its pod IP and security identity?

  1. CiliumNetworkPolicy
  2. CiliumEndpoint Correct answer.
  3. CiliumCIDRGroup
  4. CiliumBGPPeeringPolicy

Explanation

CiliumEndpoint is the per-endpoint status object that exposes the endpoint's IP, identity, and policy state, which is useful for troubleshooting. The other resources define policy, CIDR sets, or BGP peering.

Question 26Cilium Architecture and Fundamentals

Which statement describes how the Cilium agent on each node learns about Kubernetes Pods and Services so it can program its eBPF datapath?

  1. It polls the kubelet summary API every second for Pod IP assignments.
  2. It runs a local API server that proxies all kube-apiserver requests for the node.
  3. It receives updates only through the CiliumNode resource written by the operator.
  4. It watches the Kubernetes API server directly and reacts to Pod and Service events. Correct answer.

Explanation

The Cilium agent embeds a Kubernetes client and watches the API server for resources such as Pods, Services, Endpoints, and NetworkPolicies, then translates those events into eBPF map updates. The operator handles cluster-wide tasks but is not the sole channel for per-node Pod and Service state. This watch-based design lets policy and load-balancing state converge quickly without polling.

Question 27Cilium Architecture and Fundamentals

A cluster runs Cilium with the default settings and an operator inspects a node's networking. Where does the agent attach the eBPF programs that implement pod-to-pod forwarding and policy enforcement?

  1. To the container runtime's CNI plugin socket.
  2. To the network interfaces and the tc ingress and egress hooks of the node. Correct answer.
  3. To userspace sockets through the Cilium proxy only.
  4. To iptables chains in the nat and filter tables.

Explanation

Cilium attaches eBPF programs to network devices, using tc (traffic control) hooks for ingress and egress on the node's interfaces and veth pairs, plus other hook points for specific features. These programs perform forwarding, load balancing, and policy checks in the kernel datapath. The proxy is used only for L7 policy, not for the base packet path.

Question 28Cilium Architecture and Fundamentals

An operator enables Cilium's kube-proxy replacement and examines how a ClusterIP Service is implemented. Which description matches the resulting behavior?

  1. A central load balancer in the operator process forwards all Service traffic for the cluster.
  2. The kube-proxy DaemonSet keeps programming iptables rules while Cilium only observes them.
  3. Service traffic is resolved by CoreDNS returning backend Pod IPs directly to clients.
  4. The agent programs eBPF service maps on each node, and backend selection happens in the kernel datapath. Correct answer.

Explanation

With kube-proxy replacement, the Cilium agent watches Services and Endpoints and populates eBPF service maps on each node. Service VIP lookups and backend selection then occur inside the kernel datapath, avoiding per-packet iptables traversal. There is no central forwarding element in the operator for normal Service traffic.

Question 29Cilium Architecture and Fundamentals

A platform team wants to understand why Cilium assigns numeric security identities to endpoints instead of embedding full label sets in every packet decision. Which reasoning is most accurate?

  1. Identities let policy be expressed and cached as compact numeric keys, so the datapath can match allowed peers without parsing labels per packet. Correct answer.
  2. Identities replace Kubernetes Service accounts for authentication to the API server.
  3. Identities are required because eBPF maps cannot store IP addresses.
  4. Identities exist only to encrypt traffic between nodes in transit.

Explanation

Cilium computes a numeric identity from an endpoint's relevant labels and distributes that identity cluster-wide. Policy rules and eBPF maps then reference identities, so the fast path performs a compact numeric lookup rather than evaluating label sets on each packet. This also makes policy independent of churning IP addresses.

Question 30Cilium Architecture and Fundamentals

An operator runs Cilium in a mode where the agent must survive loss of the kube-apiserver connection and keep enforcing policy for existing endpoints. Which architectural property makes this possible?

  1. The agent keeps compiled policy and endpoint state in local eBPF maps, so the datapath continues enforcing the last programmed state. Correct answer.
  2. The agent relies on the operator to push policy over a persistent gRPC stream for every packet.
  3. The agent stores policy decisions only in the API server, so enforcement pauses until connectivity returns.
  4. The agent periodically writes its complete eBPF state to a Kubernetes ConfigMap and reloads it on reconnect.

Explanation

Cilium compiles policy into eBPF maps that live in the kernel on each node. Once programmed, the datapath enforces that state independently of the API server, so a control-plane outage does not immediately drop enforcement. When connectivity returns, the agent reconciles and updates the maps.

Question 31Cilium Installation and Configuration

In a Cilium deployment, which component runs on each node, attaches eBPF programs to the network interfaces, and enforces policy for local endpoints?

  1. The Cilium agent Correct answer.
  2. The Cilium operator
  3. The Hubble relay
  4. The clustermesh-apiserver

Explanation

The Cilium agent (cilium-agent) is a per-node DaemonSet component that loads eBPF programs, manages endpoint identities, and enforces network policy on the local node. The operator and relay are cluster-level or auxiliary components rather than per-node dataplane enforcers.

Question 32Cilium Installation and Configuration

Which Cilium installation method is officially recommended for most production Kubernetes clusters because it preserves configuration as declarative, upgradeable resources?

  1. Running the agent binary directly on each node as a systemd unit
  2. Running the cilium CLI install command to generate and apply manifests
  3. Applying a static YAML file downloaded from a blog post
  4. Installing the Helm chart with helm install Correct answer.

Explanation

The Helm chart is the recommended path for production because it exposes values for every supported option and lets you track and upgrade configuration over time. The CLI-generated manifests are derived from the same chart but are less convenient to manage as values evolve.

Question 33Cilium Installation and Configuration

When installing Cilium with Helm, which value must be set so the agent knows how to reach the Kubernetes API server from inside the cluster?

  1. ipam.mode
  2. kubeProxyReplacement
  3. hubble.enabled
  4. k8sServiceHost and k8sServicePort Correct answer.

Explanation

The k8sServiceHost and k8sServicePort values tell the agent the API server endpoint, which is required especially when kube-proxy is replaced and the in-cluster service VIP is not available. The other values control unrelated features.

Question 34Cilium Installation and Configuration

Which Cilium IPAM mode allocates pod IPs from per-node PodCIDR ranges that the Kubernetes control plane assigns to each node?

  1. Kubernetes host-scope IPAM Correct answer.
  2. Cluster-pool IPAM
  3. CRD-backed IPAM
  4. Multi-pool IPAM

Explanation

Kubernetes host-scope IPAM is the default mode and relies on the PodCIDR that the node controller assigns to each node. Cluster-pool and multi-pool modes instead derive allocations from Cilium's own pool configuration.

Question 35Cilium Installation and Configuration

Which command verifies that the Cilium agent is healthy and reports the status of each node's Cilium installation?

  1. cilium status Correct answer.
  2. cilium policy trace
  3. cilium endpoint list
  4. cilium bpf ct list global

Explanation

cilium status reports the overall health of the agent, controller, and cluster components, making it the first check after installation. The other commands inspect specific dataplane or policy details rather than general installation health.

Question 36Cilium Installation and Configuration

Which Cilium setting enables the agent to handle Kubernetes Service load balancing itself so that kube-proxy can be removed from the cluster?

  1. kubeProxyReplacement=true Correct answer.
  2. routingMode=native
  3. enableIPv4Masquerade=false
  4. bpf.masquerade=true

Explanation

Setting kubeProxyReplacement to true makes Cilium implement service handling, including ClusterIP and NodePort, in eBPF so kube-proxy is no longer needed. Masquerade and routing settings control packet rewriting and encapsulation, not service replacement.

Question 37Cilium Installation and Configuration

Which Cilium component must be enabled so that flow data can be queried across all nodes with a single Hubble CLI connection?

  1. The Cilium agent's policy controller
  2. The Cilium operator
  3. The clustermesh-apiserver
  4. The Hubble relay Correct answer.

Explanation

The Hubble relay aggregates flow streams from every agent, allowing a single client connection to query cluster-wide data. Without the relay, you can only observe flows on the node whose agent you contact directly.

Question 38Cilium Installation and Configuration

Which prerequisite must exist on each node before Cilium can attach eBPF programs to network interfaces?

  1. An installed CNI plugin other than Cilium
  2. A configured external load balancer
  3. A running container runtime only
  4. A recent Linux kernel with eBPF support and the required filesystem mounts Correct answer.

Explanation

Cilium requires a sufficiently recent Linux kernel with eBPF enabled and the bpffs filesystem mounted so programs and maps can be pinned. A container runtime alone is not enough, and Cilium replaces rather than depends on another CNI plugin.

Question 39Cilium Installation and Configuration

After installing Cilium, you want to confirm that pods in a test namespace receive IPs managed by Cilium and that the agent has programmed the correct identity. Which command shows the local endpoints along with their identities?

  1. cilium service list
  2. cilium node list
  3. cilium identity list
  4. cilium endpoint list Correct answer.

Explanation

cilium endpoint list shows the local endpoints, their IP addresses, identity labels, and policy state, which is exactly what is needed to confirm allocation and identity programming. The other commands list cluster-wide identities, nodes, or services rather than per-endpoint detail.

Question 40Cilium Installation and Configuration

You install Cilium with Helm and later need to enable Hubble. What is the correct approach to apply the change?

  1. Delete the Cilium DaemonSet and reinstall from scratch
  2. Edit the ConfigMap directly and restart the agent pods
  3. Run helm upgrade with updated values and the same release name Correct answer.
  4. Apply the cilium CLI install output over the existing release

Explanation

Helm manages the release state, so enabling Hubble should be done with helm upgrade using updated values so the rendered resources and release history stay consistent. Manual edits or reapplying generated manifests can drift from the Helm release.

Question 41Cilium Installation and Configuration

A cluster uses Cilium with kubeProxyReplacement enabled. Users report that NodePort services are unreachable from outside the cluster. Which configuration area should you check first?

  1. The device and interface settings used for NodePort handling, such as devices and nodePort settings Correct answer.
  2. The operator replica count
  3. The ipam.mode value
  4. The Hubble flow buffer size

Explanation

When kube-proxy is replaced, Cilium must know which devices to attach its eBPF programs to for NodePort and external traffic, so the devices and nodePort-related values are the first thing to verify. Flow buffer size, IPAM mode, and operator replicas do not affect NodePort reachability.

Question 42Cilium Installation and Configuration

You want pods to receive addresses from a specific per-node CIDR block that you control, rather than the PodCIDR assigned by Kubernetes. Which IPAM mode should you choose?

  1. ENI IPAM
  2. CRD-backed IPAM
  3. Cluster-pool IPAM Correct answer.
  4. Kubernetes host-scope IPAM

Explanation

Cluster-pool IPAM lets you define the pod CIDR and per-node mask so Cilium derives node-specific blocks from your chosen pool. Host-scope mode instead consumes the PodCIDR assigned by the Kubernetes node controller.

Question 43Cilium Installation and Configuration

Which Helm value disables the default masquerading of pod traffic leaving the cluster, which may be desirable when the underlying network already handles NAT?

  1. bpf.masquerade
  2. routingMode
  3. tunnelProtocol
  4. enableIPv4Masquerade Correct answer.

Explanation

enableIPv4Masquerade controls whether Cilium rewrites source addresses for pod traffic leaving the cluster. Setting it to false is appropriate when an upstream network performs NAT, while the other values govern different datapath behaviors.

Question 44Cilium Installation and Configuration

You want Cilium to route pod traffic directly on the underlying network without encapsulation. Which combination of settings should you configure?

  1. ipam.mode=kubernetes and bpf.masquerade=true
  2. routingMode=tunnel and tunnelProtocol=vxlan
  3. kubeProxyReplacement=false and hubble.enabled=true
  4. routingMode=native and a suitable native routing CIDR Correct answer.

Explanation

Native routing requires setting routingMode to native and telling Cilium which address range belongs to the cluster via a native routing CIDR so it knows what to route directly. Tunnel mode instead encapsulates traffic between nodes.

Question 45Cilium Installation and Configuration

Which Cilium CLI command generates a complete set of installation manifests for a given configuration, useful for GitOps pipelines that cannot run Helm at apply time?

  1. cilium install --dry-run Correct answer.
  2. cilium connectivity test
  3. cilium status --verbose
  4. cilium config view

Explanation

cilium install with the dry-run flag prints the manifests that would be applied, which can be committed and applied by a GitOps tool. The other commands report status, run tests, or display configuration rather than emitting manifests.

Question 46Cilium Installation and Configuration

An installation on a managed cloud cluster fails because the node PodCIDR overlaps with the cluster's service CIDR. Which setting should you review to resolve the conflict?

  1. The agent's log level
  2. The operator's identity allocation rate
  3. The cluster-pool pod CIDR and per-node mask values Correct answer.
  4. The Hubble UI replica count

Explanation

Pod address ranges are defined by the IPAM pool configuration, so an overlap with the service CIDR must be fixed by adjusting the pod CIDR and per-node mask. The other settings do not influence address range selection.

Question 47Cilium Installation and Configuration

Which Helm values are required to expose the Hubble UI through an ingress or service so users can view flows in a browser?

  1. bpf.masquerade and routingMode
  2. hubble.metrics.enabled only
  3. k8sServiceHost and k8sServicePort
  4. hubble.ui.enabled and hubble.relay.enabled Correct answer.

Explanation

The Hubble UI depends on both the relay, which aggregates flows, and the UI component itself, so both must be enabled before exposing the UI. Metrics alone do not provide the flow visualization interface.

Question 48Cilium Installation and Configuration

Which command should you run to check that Cilium's eBPF programs are attached and that the agent's controllers are healthy after a fresh install?

  1. cilium endpoint get
  2. cilium policy get
  3. cilium bpf tunnel list
  4. cilium status --verbose Correct answer.

Explanation

cilium status with verbose output reports component health, controller status, and datapath details, which is the standard post-install verification. The other commands inspect specific tables or policies rather than overall health.

Question 49Cilium Installation and Configuration

You must install Cilium in an air-gapped environment where nodes cannot pull images from public registries. Which configuration is necessary?

  1. Use the CLI install command with default images
  2. Set kubeProxyReplacement to false
  3. Enable Hubble metrics
  4. Point the chart's image repository values at a mirrored registry and preload the images Correct answer.

Explanation

Air-gapped installs require the Cilium, operator, and any enabled component images to be mirrored to an accessible registry, with the chart's image repository values updated accordingly. Default public images cannot be pulled in an isolated network.

Question 50Cilium Installation and Configuration

Cilium is installed and kubeProxyReplacement is enabled, but the node's routing table still contains kube-proxy iptables rules. What is the most likely explanation?

  1. Cilium's eBPF programs failed to load
  2. The Hubble relay is not enabled
  3. The IPAM mode is misconfigured
  4. kube-proxy is still running and must be removed or scaled down after enabling replacement Correct answer.

Explanation

Enabling kubeProxyReplacement configures Cilium to handle services, but kube-proxy remains an independent component that must be removed or scaled down so it stops programming iptables rules. Its presence does not indicate a Cilium datapath failure.