Free Practice Questions for Linux Foundation Cilium-Associate Exam

Technical explanation

Cilium derives an endpoint’s security identity from its security-relevant labels rather than from its current IP address. When multiple endpoints possess the same relevant label set, they receive and share the same numeric security identity. This enables policies to follow an application as pods are recreated, rescheduled, or scaled across nodes.

In Kubernetes, the Cilium agent obtains workload metadata through the Kubernetes API and associates the pod’s labels with the corresponding Cilium endpoint. Identity allocation converts the relevant label set into a cluster-wide identity. Policy enforcement then matches that identity in the eBPF datapath instead of depending exclusively on short-lived pod addresses.

Option A incorrectly makes the IP address the source of identity and says that identities cannot be shared. Option B incorrectly identifies annotations as the identity foundation. Annotations may configure behavior, but Cilium’s security model is label-based. Option D is also incorrect because operators do not ordinarily assign each pod’s numeric security identity manually. Identity allocation and lifecycle management are automatic.

Official references

Cilium Terminology and Identities , Limiting Identity-Relevant Labels

Study Guide topic: Label-derived identities and identity-based policy enforcement.

Technical explanation

The intended answer is D, but the option contains a source-bank typographical error. The valid command is cilium sysdump , not cilium sysduwp . Read literally, none of the four displayed commands exactly answers the question.

The Cilium CLI’s sysdump operation gathers cluster-wide troubleshooting material, including Cilium configuration and endpoint state, agent and operator logs, Kubernetes workload information, routing and interface details, kernel messages, service state, policies, and selected eBPF-map output. This consolidated archive is the preferred diagnostic package when investigating Kubernetes networking or preparing a support report.

cilium status --verbose provides expanded health and deployment status, but it does not collect the comprehensive diagnostic archive requested. debuginfo is associated with the in-agent debug client—currently documented as cilium-dbg debuginfo —and produces useful local-agent API information; in Kubernetes environments it is already included as part of the system dump. cilium bugtool is not the current cluster-wide Cilium CLI command requested here.

For an exam-ready correction, option D should read cilium sysdump .

Official references

Cilium Troubleshooting and Sysdump

Study Guide topic: Cilium CLI troubleshooting, system dumps, and diagnostic collection.

Technical explanation

A Cluster Mesh can be created after assigning each cluster a unique name and numeric cluster ID. Cilium uses the cluster ID when constructing Cluster Mesh security identities, so duplicate values cannot safely identify endpoints from different clusters. The name must likewise be unique. These values can be changed after installation, although all existing workloads must then be restarted so their security identities are regenerated.

The other listed conditions are compatible. Both clusters use the same encapsulation datapath mode, their PodCIDRs are intended to be non-overlapping, and the nodes possess the required inter-cluster connectivity. Different Kubernetes patch or minor versions do not inherently prevent Cluster Mesh. Cilium versions may differ by one minor release, so versions 1.14 and 1.13 satisfy the documented compatibility rule.

Different certificate authorities are not an irreversible blocker under current documentation. Every cluster must trust certificates presented by the others. Operators may use a shared root CA or configure a CA bundle containing all trusted CA certificates. Consequently, B is too absolute. C is also false because changing the cluster identity is possible, subject to workload restarts. D is unnecessary because a one-minor Cilium difference is supported.

The source’s option A is truncated, but its intended corrective action is technically accurate.

Official references

Setting up Cluster Mesh .

Study Guide topic: Cluster Mesh.

Technical explanation

Hubble obtains its visibility from Cilium’s eBPF datapath, and the Hubble Server is embedded in the Cilium agent. Hubble therefore cannot provide its normal flow-observability capabilities as a standalone installation without Cilium, eliminating B.

CNI chaining allows Cilium to coexist with a supported existing CNI. The original plugin continues to supply base connectivity and IP address management, while Cilium attaches eBPF programs to the created network devices. Those programs provide visibility, policy enforcement, and other Cilium functionality. Hubble can then be enabled on top of the chained Cilium deployment. This approach avoids an immediate, disruptive replacement of the production cluster’s networking layer and is consequently the best answer.

Options C and D could be appropriate in broader migration projects, particularly when a current CNI is incompatible with chaining or when full native-Cilium functionality is required. However, both imply substantially more workload movement or cutover activity than the stated objective of minimizing downtime.

Compatibility, chaining mode, current CNI behavior, kernel requirements, and feature limitations must still be validated before production rollout.

Official references

Cilium CNI Chaining , Hubble Internals , Troubleshooting Hubble

Study Guide topic: Hubble prerequisites, CNI chaining, and production adoption.

Technical explanation

The official IPAM documentation expressly states that the safest way to change IPAM mode is to install a fresh Kubernetes cluster using the required new IPAM configuration. A live cluster already contains allocated workload addresses, node routing state, Cilium endpoint state, service state, and potentially cloud-provider resources that depend on the active allocator. Replacing the allocator in place can invalidate these assumptions and cause persistent connectivity disruption rather than merely a short agent restart.

Updating a Kubernetes Node object does not generally convert Cilium’s IPAM mode. The responsible resource and allocation behavior depend on the selected mode: Kubernetes host-scope IPAM, cluster-pool IPAM, multi-pool IPAM, CRD-backed modes, and cloud-specific allocators manage address information differently. Restarting agents after changing a configuration value likewise does not constitute a safe migration plan, because existing endpoints and routes may retain state created under the former allocator.

Cilium advises against changing the IPAM mode of an existing cluster unless a specifically documented migration procedure applies. The currently documented exception is migration from cluster-pool IPAM to multi-pool IPAM. As the question provides no such constrained scenario, D is the unambiguously safest answer.

Official references

IP Address Management .

Study Guide topic: Installation and Configuration.

Technical explanation

Hubble UI and Hubble CLI are Cilium’s integrated interfaces for examining workload network flows. Hubble records source and destination identities, namespaces, workloads, addresses, ports, forwarding verdicts, and drop reasons. When Layer 7 visibility is configured, its flow output can also contain application-level information such as HTTP methods, URLs, response codes, latency, and DNS queries. Filters can narrow the results by source workload, namespace, destination, protocol, port, or verdict, making Hubble appropriate for investigating egress behavior.

Hubble CLI provides detailed event-oriented inspection, while Hubble UI presents flows and service dependencies graphically. Hubble Relay aggregates the per-node Hubble APIs so these clients can obtain cluster-wide visibility.

Load balancing directs traffic but is not an observability interface. Kubernetes NetworkPolicy expresses permitted communications but does not by itself display application-level flow records. Fluentd and Grafana are external logging and visualization components and would violate the requirement to avoid additional tooling.

Layer 7 information requires supported traffic to be redirected through Cilium’s L7 proxy. Hubble then exposes the resulting application-layer flow events through the built-in CLI or UI, making D the complete answer.

Official references

Network Observability with Hubble ; Inspecting Network Flows .

Study Guide topic: Network Observability.

Technical explanation

cilium config set debug true follows the supported Cilium CLI configuration syntax and sets the debug configuration key to true . The cilium config set command accepts a key/value pair and, by default, restarts the Cilium pods so that the changed configuration is applied. The Cilium configuration documentation defines debug as the setting that enables full debug mode. This increases agent logging verbosity and causes eBPF programs to emit additional visibility events for diagnostic use.

Options A, B, and D do not match documented Cilium CLI command structures. There is no cilium log level --set=debug command in the Cilium CLI hierarchy, and neither cilium logging.level=debug nor cilium logging debug is valid configuration syntax. A Helm-managed installation may also enable debugging through the chart value debug.enabled=true , but that does not make any of the alternative commands correct.

Debug mode should be enabled deliberately because it increases log volume and may generate additional datapath visibility information. After troubleshooting, operators should normally restore the previous setting to avoid unnecessary operational overhead.

The supplied answer key incorrectly identifies B. The verified answer is C.

Official references

Cilium configuration ; Cilium CLI `config set` ; Helm values .

Study Guide topic: Installation and Configuration.

Technical explanation

Policy Audit Mode allows administrators to evaluate the consequences of network policies before enforcing their deny decisions. Traffic that would ordinarily be rejected remains permitted, while Cilium records an audit verdict. These verdicts can be examined with Cilium monitoring tools and used to identify legitimate communications that are missing from the proposed policies.

This is especially valuable when introducing host policies or default-deny controls into an existing environment. An incomplete policy might otherwise block access to the Kubernetes API, node-management interfaces, DNS, monitoring systems, or other operational dependencies. The recommended workflow is to enable audit mode, observe traffic and policy verdicts, adjust the rules, confirm that all required communications receive allow verdicts, and then disable audit mode to begin enforcement.

DNS enforcement mode and HTTP audit mode are not the general Cilium configuration requested. “Policy enforcement mode” describes whether policies are normally enforced, but it does not provide the non-disruptive learning behavior in the question.

Audit mode should be treated as a temporary validation mechanism because it does not actually block disallowed traffic and does not persist across every agent-restart scenario.

Official references

Cilium Policy Audit Mode

Study Guide topic: Policy validation, audit verdicts, and safe policy rollout.

Technical explanation

The Hubble Server is embedded in each Cilium agent and consumes the eBPF-derived visibility data produced on that node. It exposes gRPC services through which clients can retrieve flow events, node and namespace information, server status, and related observability data. Embedding the server in the agent enables high-performance collection with comparatively low overhead.

Hubble Relay has a different role. It is a standalone component that discovers and connects to the Hubble Server instances running across the cluster. Relay aggregates their individual APIs to provide multi-node or cluster-wide visibility to clients such as the Hubble CLI and Hubble UI. It is therefore not the component embedded in the agent.

The Cilium CNI plugin is invoked when Kubernetes creates or removes pods and asks the local agent to configure their networking and datapath. The Cilium Operator performs cluster-wide management duties such as selected IPAM and shared-state operations. Neither component is responsible for exposing eBPF flow visibility.

This server–relay distinction is central to understanding Hubble’s distributed architecture: Server provides node-local visibility, while Relay combines multiple servers into a cluster-wide view.

Official references

Hubble Internals , Cilium Component Overview

Study Guide topic: Hubble Server, Hubble Relay, and distributed flow observability.