Cilium Certified Associate study guide
Cilium Certified Associate · Work through your exam, one topic at a time.
The Cilium Certified Associate (CCA) is an entry-to-intermediate credential for engineers who operate or support Kubernetes clusters where Cilium provides networking, security, and observability. It suits platform engineers, DevOps and SRE staff, cluster administrators, and security engineers who need to reason about eBPF-based dataplanes rather than only write YAML. The Cilium Certified Associate study guide has 7 sections and about 2,885 words.
01Cilium Architecture and Fundamentals
The Architecture and Fundamentals domain tests whether you understand where Cilium's logic runs and what it operates on. Nearly every other domain builds on two answers: eBPF programs in the kernel datapath, and numeric security identities instead of IP addresses.
448 words, about 2 min02Cilium Installation and Configuration
The Installation and Configuration domain tests the Helm values and host prerequisites that decide whether anything else in the cluster works: kernel features, IPAM mode, routing mode, kube-proxy replacement, and Hubble. Expect questions that hand you a partial configuration and ask what breaks.
416 words, about 2 min03Kubernetes Networking with Cilium (CNI, IPAM, Routing)
This domain covers how pods obtain addresses and how packets reach pods on other nodes: IPAM mode selection, tunnel versus native routing, and masquerading. Questions usually contrast two modes or ask why a pod-to-pod path fails.
407 words, about 2 min04Network Policy and Security
Network Policy and Security is the highest-yield domain. It tests the identity model applied to enforcement: per-direction default deny, endpoint selectors, entities, L7 rules, and the host firewall.
382 words, about 2 min05Observability and Troubleshooting
Observability and Troubleshooting tests whether you can determine why a packet vanished: which verdict to look for, which component to query, and where the agent keeps state. Hubble is fed by the agent's eBPF datapath and exports per-flow records with source and destination identities, ports, verdict ( FORWARDED , DROPPED , ERROR , AUDIT ) and drop reason.
403 words, about 2 min06Service Mesh, Load Balancing, and Gateway API
This domain covers traffic handling in both directions: eBPF service load balancing that replaces kube-proxy, north-south ingress through Gateway API, and the L7 features that make Cilium a sidecar-free mesh. With kube-proxy replaced, services live in eBPF maps instead of iptables chains, so backend selection is a map lookup in the datapath.
412 words, about 2 min07Cluster Mesh and Multi-Cluster Networking
Cluster Mesh joins independent Kubernetes clusters into one Cilium-managed network so pods reach each other across clusters and policy can name remote workloads directly. The exam focuses on the prerequisites that make it fail and on global service semantics.
417 words, about 2 min