Free Practice Questions for Linux Foundation Cilium-Associate Exam

Technical explanation

Hubble provides network and security flow observability derived from Cilium’s datapath. Its flow records include source and destination workloads, namespaces, identities, ports, protocols, forwarding verdicts, and drop reasons. Hubble can therefore identify services or workloads whose connections were rejected by network policy. The Hubble CLI supports filtering by verdict, such as --verdict DROPPED , and official examples show events labeled Policy denied DROPPED . These capabilities directly answer the question posed in option D.

Option B, which is marked as correct in the supplied bank, is not supported by the stated functionality. Hubble may expose network-layer or supported application-layer metadata, including DNS and HTTP information when Layer 7 visibility is configured, but it is not a database query profiler and cannot determine which internal SQL statement ran longest merely from ordinary Hubble flows. Similarly, CPU utilization is a workload-resource metric normally obtained through Kubernetes metrics, Prometheus, or another monitoring system. Cilium BGP configuration is examined through Cilium configuration and BGP status commands rather than inferred from Hubble network flows.

The supplied answer key should therefore be corrected from B to D.

Official references

Inspecting Network Flows with the Hubble CLI ; Hubble internals .

Study Guide topic: Network Observability.

Technical explanation

Hubble does not obtain Layer 7 protocol visibility exclusively through eBPF without a proxy. By default, Cilium’s datapath exposes Layer 3 and Layer 4 flow information. To produce supported application-layer events, traffic is selected through an L7 Cilium policy and redirected to the node-local Envoy proxy. Envoy parses the application protocol and forwards access-log information that Cilium and Hubble expose as Layer 7 flow events.

The other capabilities are supported. Hubble flow records contain the observing node, and the CLI provides node-based filtering. HTTP-aware flows can contain response status codes, enabling inspection or filtering for results such as 200 and 404. Hubble also records forwarding verdicts and drop reasons. Operators can filter for DROPPED traffic and distinguish policy-denied connections from forwarded traffic and other failure conditions.

This separation is fundamental to Cilium’s architecture: eBPF provides efficient kernel-level forwarding, security enforcement, and L3/L4 observability, while Envoy supplies protocol parsing when request-level context is required. The integration remains transparent to applications, but the proxy is still present in the traffic path for Layer 7 visibility.

Therefore, B describes the unsupported mechanism and is the correct answer.

Official references

Layer 7 Protocol Visibility ; Envoy ; Hubble CLI .

Study Guide topic: Network Observability.

Technical explanation

In Cilium’s default policy-enforcement mode, an endpoint initially permits ingress and egress traffic. Enforcement changes independently for each direction when a policy selects that endpoint. If a selecting rule contains an ingress section, the endpoint enters default-deny mode for ingress. If a selecting rule contains an egress section, it enters default-deny mode for egress. Only traffic explicitly permitted by the applicable policy rules remains allowed in the restricted direction.

This per-direction behavior is important. An ingress-only policy does not automatically restrict egress, and an egress-only policy does not automatically restrict ingress. Options A and B reverse the relationship between the rule section and the direction being enforced. Option C incorrectly states that selection places the endpoint into default-allow mode; default allow describes the endpoint’s condition before it is selected by an enforcing policy.

Cilium also supports always and never enforcement modes. In always , enforcement applies even to endpoints not selected by policy. In never , policy enforcement is disabled. Policies can additionally use enableDefaultDeny for specialized visibility configurations, but those controls do not change the normal default behavior described in the question.

Official references

Policy Enforcement Modes .

Study Guide topic: Network Policy.

Technical explanation

Kubernetes kube-proxy conventionally implements Service translation and load balancing through either iptables or IPVS. With Cilium’s kube-proxy replacement enabled, eBPF programs and maps perform Kubernetes Service handling directly in the kernel, including ClusterIP, NodePort, LoadBalancer, ExternalIP, and related service translation functions. C is therefore correct.

The replacement can operate at socket hooks and packet-processing hooks. Service and backend information is stored in eBPF maps, allowing the datapath to select backends and perform address translation without traversing the kube-proxy-generated iptables or IPVS rules normally used for Kubernetes Services.

BGP is not replaced. Cilium’s BGP Control Plane is a separate feature used to advertise routes and service addresses to external routers. Routing itself is also not eliminated; Cilium can implement and accelerate routing decisions with eBPF, but packets still require a valid forwarding model. firewalld is a host firewall-management service and is not the underlying Kubernetes Service implementation replaced by kube-proxy replacement.

Relevant installations must satisfy the kernel and device requirements for Cilium’s eBPF service load-balancer functionality.

Official references

Kubernetes Without kube-proxy

Study Guide topic: kube-proxy replacement, eBPF service maps, iptables, and IPVS.

Technical explanation

If a global Service has no healthy local endpoints matching its selector, every available backend can be remote. Cluster Mesh synchronizes remote service and endpoint information, allowing the local Cilium datapath to load-balance requests to backend pods in connected clusters. The absence of local endpoints therefore provides a direct explanation for the observed behavior.

If the local cluster were not part of the Cluster Mesh, its Cilium agents would not normally receive the remote endpoint state needed to route traffic through the global Service, so B does not explain successful remote-only selection. An affinity value of none is the default behavior and expresses no preference between local and remote endpoints. When both categories exist and are healthy, this permits load balancing across both; it does not require every connection to use remote backends.

Setting service.cilium.io/shared: "false" prevents the local Service’s backends from being shared with remote clusters. It does not instruct the local cluster to direct all requests toward remote endpoints.

A separate possible cause, not presented among the choices, would be service.cilium.io/affinity: "remote" . Among the supplied answers, however, A is the valid explanation.

Official references

Service Affinity ; Cluster Mesh .

Study Guide topic: Cluster Mesh.

Technical explanation

Masquerading performs source network address translation for qualifying traffic that leaves the cluster. Because pod addresses are often private and not routable by the external network, Cilium replaces the pod’s source address with an address belonging to the egress node. Return traffic can then reach that node, which reverses the translation and delivers the response to the originating pod. B correctly summarizes this behavior.

Masquerading is a form of SNAT, not DNAT. DNAT modifies the destination address, commonly to direct incoming traffic toward another endpoint, so C is incorrect.

Cilium documents its eBPF-based masquerading implementation as the more efficient implementation. The iptables version is the legacy alternative, making A false. Conversely, eBPF masquerading depends on appropriate kernel eBPF capabilities and Cilium’s BPF NodePort functionality. It cannot be assumed to work on every kernel version, so D is false. The legacy iptables implementation is the mode documented as broadly working across kernel versions.

Cilium can exclude natively routable CIDRs from masquerading, and administrators may configure separate IPv4 and IPv6 masquerading behavior.

Official references

Cilium Masquerading , Cilium System Requirements

Study Guide topic: SNAT, native-routing exclusions, and eBPF versus iptables masquerading.

Technical explanation

The Cilium Operator handles IP address management responsibilities in IPAM modes that require cluster-wide or cloud-integrated allocation. Current documentation identifies the operator as responsible for IPAM in Azure IPAM, AWS ENI, and cluster-scope mode. Cloud-specific operators populate the appropriate allocation information in CiliumNode resources, after which node-local agents allocate addresses to endpoints from the available ranges.

The phrase “when available” is important because responsibilities vary by IPAM mode. Under Kubernetes host-scope IPAM, Kubernetes allocates each node’s PodCIDR, and the Cilium agent consumes that range from the Kubernetes Node object. Nevertheless, among the supplied components, the operator is the component specifically associated with centralized IPAM requests and allocation management.

The Cilium agent implements each node’s datapath and endpoint lifecycle but is not the general cluster-wide IPAM answer intended here. Cilium API Server is not the documented allocation component. The misspelled Cilium CNIPIugin refers to the CNI plugin, which requests networking setup when a pod is created but does not replace the operator’s IPAM responsibilities.

Official references

Cilium Operator , Cilium IP Address Management

Study Guide topic: Cilium Operator responsibilities and IPAM modes.

Technical explanation

The requirement is that traffic remain encrypted all the way from the external client to the backend Service . Therefore, TLS must not terminate at the Cilium Gateway/Envoy proxy .

With TLS Passthrough , Cilium forwards the encrypted TLS stream to the backend without decrypting the application traffic. Envoy can inspect the TLS ClientHello/SNI sufficiently to select the appropriate backend, but the TLS session itself continues to the Service. Cilium specifically supports TLS passthrough with the Gateway API TLSRoute resource .

By contrast, TLS Terminate + HTTPRoute decrypts the connection at the Gateway. Although a separate encrypted connection to the backend can be configured in some architectures, that is not the same as preserving the original end-to-end TLS session requested here. Cilium's HTTPS Gateway examples use TLS termination when the Gateway itself handles the certificate.

Study Guide topic: Service Mesh.