Cilium-Associate Cilium Certified AssociateCCA Question and Answers

Technical explanation

Hubble does not obtain Layer 7 protocol visibility exclusively through eBPF without a proxy. By default, Cilium’s datapath exposes Layer 3 and Layer 4 flow information. To produce supported application-layer events, traffic is selected through an L7 Cilium policy and redirected to the node-local Envoy proxy. Envoy parses the application protocol and forwards access-log information that Cilium and Hubble expose as Layer 7 flow events.

The other capabilities are supported. Hubble flow records contain the observing node, and the CLI provides node-based filtering. HTTP-aware flows can contain response status codes, enabling inspection or filtering for results such as 200 and 404. Hubble also records forwarding verdicts and drop reasons. Operators can filter for DROPPED traffic and distinguish policy-denied connections from forwarded traffic and other failure conditions.

This separation is fundamental to Cilium’s architecture: eBPF provides efficient kernel-level forwarding, security enforcement, and L3/L4 observability, while Envoy supplies protocol parsing when request-level context is required. The integration remains transparent to applications, but the proxy is still present in the traffic path for Layer 7 visibility.

Therefore, B describes the unsupported mechanism and is the correct answer.

Official references

Layer 7 Protocol Visibility ; Envoy ; Hubble CLI .

Study Guide topic: Network Observability.

Cilium's official documentation confirms that a CiliumEgressGatewayPolicy selects traffic originating from matching pods , routes traffic destined for the configured destinationCIDRs through the selected egress gateway node, and SNATs that traffic using the configured egressIP.

Technical explanation

cilium config view is the Cilium CLI command intended to display the current configuration. It reads the configuration associated with the selected Kubernetes context, Cilium namespace, and Helm release and presents the relevant settings for inspection. This makes D the direct answer.

cilium status performs a different function. It reports the health and readiness of Cilium components such as the agent DaemonSet, operator, Envoy, Hubble Relay, and Cluster Mesh. Although status output may reveal a small amount of deployment information, it is not a complete configuration-viewing command.

cilium sysdump collects a comprehensive troubleshooting archive containing Kubernetes resources, component logs, command output, configuration data, and other diagnostic evidence. It is appropriate when preparing a support bundle, but it is unnecessarily broad for simply consulting the current configuration. cilium context deals with Kubernetes context selection or inspection rather than displaying Cilium’s configured values.

The Cilium CLI organizes configuration operations under the cilium config command group. Related subcommands include set , delete , and view . Because the requested action is read-only inspection of the existing settings, view is the appropriate subcommand.

Official references

Cilium CLI `config view` .

Study Guide topic: Installation and Configuration.

Technical explanation

The intended answer is A because API request limiting corresponds to rate limiting, which Cilium identifies as a core Layer 7 traffic-management capability. Cilium combines its eBPF datapath with Envoy for application-layer processing. The official Service Mesh documentation expressly includes rate limiting among the functions that must understand protocols such as HTTP, REST, gRPC, and WebSocket. It is therefore not merely packet-rate policing at Layer 3 or Layer 4; it can be applied with application-protocol context.

However, this question is no longer valid as a strict single-answer item. Current Cilium documentation also describes proxy-based Layer 7 load balancing as useful for gRPC and provides an Envoy-backed implementation for Kubernetes Services. Consequently, option C is also supportable under the current product documentation, although the feature is identified as beta. API authorization and fault-delay injection are not presented as equivalent first-class Cilium Service Mesh use cases in the cited feature overview.

For certification-bank purposes, retain A as the intended answer, but revise option C or qualify it to restore a unique correct choice.

Official references

Service Mesh ; Proxy Load Balancing for Kubernetes Services .

Study Guide topic: Service Mesh.

Technical explanation

The intended answer is D, but the option contains a source-bank typographical error. The valid command is cilium sysdump , not cilium sysduwp . Read literally, none of the four displayed commands exactly answers the question.

The Cilium CLI’s sysdump operation gathers cluster-wide troubleshooting material, including Cilium configuration and endpoint state, agent and operator logs, Kubernetes workload information, routing and interface details, kernel messages, service state, policies, and selected eBPF-map output. This consolidated archive is the preferred diagnostic package when investigating Kubernetes networking or preparing a support report.

cilium status --verbose provides expanded health and deployment status, but it does not collect the comprehensive diagnostic archive requested. debuginfo is associated with the in-agent debug client—currently documented as cilium-dbg debuginfo —and produces useful local-agent API information; in Kubernetes environments it is already included as part of the system dump. cilium bugtool is not the current cluster-wide Cilium CLI command requested here.

For an exam-ready correction, option D should read cilium sysdump .

Official references

Cilium Troubleshooting and Sysdump

Study Guide topic: Cilium CLI troubleshooting, system dumps, and diagnostic collection.

Technical explanation

B expresses the principal scalability distinction intended by the question. In kube-proxy’s iptables mode, Kubernetes Services and endpoints are represented by chains of netfilter rules. As the number of Services and backends grows, rule creation, synchronization, and packet traversal can involve increasingly large rule sets. Matching through those chains is generally described as having linear scaling characteristics.

Cilium’s kube-proxy replacement stores service and backend state in eBPF maps. Hash-map lookups allow the datapath to locate service entries without sequentially scanning a rule for every Service, providing effectively constant-time lookup behavior for the relevant map operations. This makes the approach better suited to large and frequently changing Kubernetes environments.

Option A is false because iptables and netfilter also operate within the Linux kernel. Option C is false because kube-proxy’s iptables implementation supports IPv6 when the surrounding Kubernetes and host configuration supports it. Option D does not explain kube-proxy’s primary scaling limitation and introduces an unrelated SmartNIC/XDP claim.

The constant-time description is a useful architectural simplification; total performance still depends on map sizing, backend selection, connection tracking, and kernel behavior.

Official references

Cilium eBPF Datapath , Cilium Tuning Guide

Study Guide topic: kube-proxy replacement, eBPF maps, and datapath scalability.

Technical explanation

Cluster Mesh extends Cilium’s identity-aware networking and policy enforcement across connected Kubernetes clusters. A CiliumNetworkPolicy can authorize communication with workloads in a particular remote cluster by selecting their workload labels together with the synthetic io.cilium.k8s.policy.cluster label. Therefore, A accurately describes a direct network-policy function.

The policies themselves are not automatically copied between clusters. Administrators remain responsible for applying the required policy resources in the appropriate clusters, but enforcement can select and govern remote endpoints once Cluster Mesh has propagated their identities.

Option B confuses authorization with transport encryption. WireGuard or IPsec configuration enables transparent encryption; it is not established by a network-policy rule. Option C is also separate from policy enforcement: cross-cluster load balancing is configured through global-service facilities and service annotations, not through CiliumNetworkPolicy . Option D is incorrect under current documentation because Cilium mutual authentication does not provide a single trust domain spanning Cluster Mesh clusters and is not presently compatible with that multi-cluster arrangement.

Official references

Cluster Mesh Network Policy , Cluster Mesh Services , Mutual Authentication Limitations

Study Guide topic: Cross-cluster identity, endpoint selection, and policy enforcement.

Technical explanation

SPIRE supplies workload identities as SPIFFE Verifiable Identity Documents, including X.509 key material used for mutual authentication. SPIFFE’s identity model supports automatic issuance, rotation, and revocation, allowing short-lived certificates to be renewed without manually distributing static credentials. This makes D the correct statement.

Option A reverses the documented default. Cilium’s default SPIRE installation requires persistent-volume support. In-memory storage can be selected for laboratory environments by disabling server data storage, but that setting causes SPIRE data to be recreated if the server pod restarts. Option B also reverses the relationship between the projects: SPIFFE defines the identity standards and APIs, while SPIRE is a production-ready implementation of SPIFFE. Cilium’s mutual-authentication integration has been validated with SPIRE.

Option C overstates the operational requirement. A SPIRE server is involved, but Cilium’s Helm chart can deploy and configure the supported SPIRE server and per-node agents. Administrators may provide their own deployment, yet a completely manual installation is not mandatory.

Current documentation classifies this mutual-authentication implementation as beta and notes limitations, including incompatibility with Cluster Mesh trust domains. Those maturity constraints do not change the certificate-management behavior described in D.

Official references

Cilium Mutual Authentication .

Study Guide topic: Service Mesh.

Technical explanation

Option D uses the correct structure for permitting egress from selected endpoints to the local host entity. The endpointSelector selects endpoints whose label env equals dev . Because the intended traffic travels from those endpoints toward the host, the policy must contain an egress rule. An egress peer is expressed through toEntities , and host is the reserved entity representing the local host, including host-networked containers on that node.

Option A is invalid because fromEntities is an ingress-oriented field and cannot express an egress destination. Option B uses nodeSelector , which selects nodes rather than workload endpoints and is only valid for node-level rules in a CiliumClusterwideNetworkPolicy ; it is not valid in the displayed namespaced CiliumNetworkPolicy . It also combines ingress with toEntities , reversing the rule direction. Option C has a valid workload selector but again uses toEntities under ingress ; ingress rules describe sources through constructs such as fromEntities .

Applying option D places the selected endpoints into egress default-deny mode and then expressly permits traffic whose destination is the host entity. Other egress traffic must be allowed separately.

Official references

Policy Enforcement and Rule Basics ; Endpoint Lifecycle policy examples .

Study Guide topic: Network Policy.

Technical explanation

If a global Service has no healthy local endpoints matching its selector, every available backend can be remote. Cluster Mesh synchronizes remote service and endpoint information, allowing the local Cilium datapath to load-balance requests to backend pods in connected clusters. The absence of local endpoints therefore provides a direct explanation for the observed behavior.

If the local cluster were not part of the Cluster Mesh, its Cilium agents would not normally receive the remote endpoint state needed to route traffic through the global Service, so B does not explain successful remote-only selection. An affinity value of none is the default behavior and expresses no preference between local and remote endpoints. When both categories exist and are healthy, this permits load balancing across both; it does not require every connection to use remote backends.

Setting service.cilium.io/shared: "false" prevents the local Service’s backends from being shared with remote clusters. It does not instruct the local cluster to direct all requests toward remote endpoints.

A separate possible cause, not presented among the choices, would be service.cilium.io/affinity: "remote" . Among the supplied answers, however, A is the valid explanation.

Official references

Service Affinity ; Cluster Mesh .

Study Guide topic: Cluster Mesh.

Technical explanation

Both Kubernetes Ingress and the north-south use of Gateway API provide declarative Layer 7 routing from clients outside the cluster to Kubernetes workloads. They express host- and path-based routing through Kubernetes resources and can be implemented by controllers such as Cilium’s Envoy-based ingress implementation. A therefore captures their shared purpose most accurately.

The remaining choices describe differences rather than universal similarities. Gateway API is explicitly role-oriented: infrastructure administrators manage GatewayClass and often Gateway , while application owners manage route resources such as HTTPRoute . The Ingress API does not provide the same formal separation of administrative and application-facing resources, making C unsuitable as a statement about both.

Implementation-specific annotations are historically common with Ingress because its core API is limited. Gateway API was deliberately designed with more expressive, portable resource fields so that implementations do not need to depend as heavily on vendor-specific annotations; D is consequently not true of both. Namespace behavior also differs because Gateway API provides controlled cross-namespace attachment and reference mechanisms. B is therefore not the defining common capability.

Official references

Cilium Kubernetes Ingress Support , Cilium Gateway API Support , Migrating from Ingress to Gateway API

Study Guide topic: Kubernetes north-south routing, Ingress, and Gateway API.

Technical explanation

Policy Audit Mode allows administrators to evaluate the consequences of network policies before enforcing their deny decisions. Traffic that would ordinarily be rejected remains permitted, while Cilium records an audit verdict. These verdicts can be examined with Cilium monitoring tools and used to identify legitimate communications that are missing from the proposed policies.

This is especially valuable when introducing host policies or default-deny controls into an existing environment. An incomplete policy might otherwise block access to the Kubernetes API, node-management interfaces, DNS, monitoring systems, or other operational dependencies. The recommended workflow is to enable audit mode, observe traffic and policy verdicts, adjust the rules, confirm that all required communications receive allow verdicts, and then disable audit mode to begin enforcement.

DNS enforcement mode and HTTP audit mode are not the general Cilium configuration requested. “Policy enforcement mode” describes whether policies are normally enforced, but it does not provide the non-disruptive learning behavior in the question.

Audit mode should be treated as a temporary validation mechanism because it does not actually block disallowed traffic and does not persist across every agent-restart scenario.

Official references

Cilium Policy Audit Mode

Study Guide topic: Policy validation, audit verdicts, and safe policy rollout.

Technical explanation

Ingress provides a comparatively simple API for exposing HTTP and HTTPS applications through host- and path-based routing. Gateway API is a broader, extensible family of resources that separates infrastructure configuration from application routing. Resources such as GatewayClass , Gateway , HTTPRoute , GRPCRoute , TLSRoute , TCPRoute , and UDPRoute model listeners, routes, protocols, ownership, and attachment relationships explicitly.

Gateway API was designed around operational roles. An infrastructure provider can manage the GatewayClass , a cluster operator can provision a Gateway , and an application team can own a route attached to that Gateway. This offers clearer delegation than the single Ingress resource and supports protocols and traffic-management functions beyond the original Ingress model.

The two APIs are not simply different names for identical functionality, so A is false. Option C is also inaccurate because Cilium’s implementations of both Ingress and Gateway API integrate with its eBPF datapath and Envoy; Ingress is not inherently an iptables-only implementation. Option D incorrectly limits Gateway API to internal routing. It can expose internet-facing applications through generated LoadBalancer or NodePort Services or through host-network listeners.

Official references

Migrating from Ingress to Gateway ; Gateway API Support .

Study Guide topic: Service Mesh.

Technical explanation

The intended policy selects every Cilium-managed endpoint in the namespace where the CiliumNetworkPolicy is created because endpointSelector: {} is empty. The manifest does not specify metadata.namespace ; if it is applied normally in the default namespace, the selected endpoints are therefore all pods in default , not pods across every namespace. The egress destination selector identifies pods in kube-system carrying k8s-app: kube-dns , while matchPattern: "*" allows all DNS query names handled by the DNS rule. This supports the intended answer A.

There is, however, a material defect in the exhibit: toPorts is a list in the Cilium policy schema, but the image shows rules directly beneath toPorts without a preceding list marker. The official form is toPorts: , followed by - ports: and rules: within that list item. Port 53 and its protocol should also be stated explicitly. Exactly as displayed, the manifest should not be treated as a valid deployable policy.

The question should be corrected before examination use. Once the missing list item and port definition are restored, A accurately describes its scope and effect.

Official references

Using Kubernetes Constructs in Policy ; Layer 7 Protocol Visibility .

Study Guide topic: Network Policy.

Technical explanation

BIG TCP permits the Linux networking stack to process packets larger than the traditional approximately 64-KiB limit represented by the IP length field while the packets remain inside the host. IPv6 BIG TCP uses a temporary Hop-by-Hop header carrying the larger internal length, while IPv4 BIG TCP sets tot_len to zero and uses the socket buffer length internally. Before transmission, packets are segmented into sizes suitable for the physical network. C therefore identifies the problem BIG TCP addresses.

Option A is false because Cilium’s documentation explicitly states that BIG TCP does not require network-interface MTU changes. The larger objects exist inside the software networking stack and are segmented before appearing on the wire.

Option B reverses the intended performance effect. Larger internal GSO and GRO packets reduce repeated stack traversal, lowering CPU utilization and generally improving throughput and latency. Option D is also false: Generic Segmentation Offload and Generic Receive Offload are fundamental to BIG TCP’s operation. Cilium increases their maximum sizes when BIG TCP is enabled. The source mentions TSO, but the documented mechanism is principally described through GSO and GRO.

Official references

Cilium Performance Tuning and BIG TCP

Study Guide topic: BIG TCP, GSO/GRO, packet-length limits, and performance.