Free Cilium Certified Associate (CCA) Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Cilium Certified Associate (CCA) practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1What role does Cilium perform when installed as the CNI plugin in a Kubernetes cluster?

   1. A. It schedules workloads onto suitable worker nodes.
   2. B. It provides the networking layer for cluster workloads.
   3. C. It stores the desired state of Kubernetes API objects.
   4. D. It builds container images from application source code.

   Answer: B

   Explanation: The introduction describes a "fast, scalable, and secure networking layer for Kubernetes clusters." This is Cilium’s CNI role; scheduling, API-object storage, and image building are separate responsibilities.

   Reference: Introduction to Cilium & Hubble — Functionality Overview > CNI (Container Network Interface)

2. 2An endpoint is already ingress-isolated. One allow policy permits TCP port 80 and another permits TCP port 443 from the same client. No deny policy applies. Which ports do the allow policies permit from that client?

   1. A. Only port 80, because the first policy takes precedence
   2. B. Only port 443, because the narrower policy takes precedence
   3. C. Neither port, because the policies have no common port
   4. D. Both ports, because matching allow rules are combined

   Answer: D

   Explanation: Rule Basics states, "then traffic matching the union of those rules will be allowed." The two allow rules therefore permit both specified ports; they are not ordered overrides or an intersection requirement.

   Reference: Policy Enforcement Modes — Rule Basics > Whitelist and union of rules

3. 3Which ingressClassName selects Cilium’s controller for a standard Kubernetes Ingress resource?

   1. A. cilium
   2. B. envoy
   3. C. hubble
   4. D. gateway

   Answer: A

   Explanation: The Ingress guide specifies "an ingressClassName of cilium." Envoy is the proxy, Hubble is the observability system, and a Gateway is a different resource; none replaces the documented class value.

   Reference: Kubernetes Ingress Support — Kubernetes Ingress Support > Opening description

4. 4Without Hubble Relay, what is the default observation scope of the Hubble API on a Cilium agent?

   1. A. Only the traffic of the first application namespace
   2. B. Traffic observed by the agent on its own node
   3. C. All traffic across every connected Kubernetes cluster
   4. D. Only packets that have been denied by a network policy

   Answer: B

   Explanation: The guide states, "By default, Hubble API operates within the scope of the individual node on which the". The next line identifies the Cilium agent. The default local API does not by itself aggregate observations from every node.

   Reference: Network Observability with Hubble — Network Observability with Hubble > Default API scope

5. 5Which Cilium CLI command displays the current configuration without changing configuration values?

   1. A. cilium config set
   2. B. cilium config delete
   3. C. cilium config view
   4. D. cilium status

   Answer: C

   Explanation: The command reference describes cilium config view as "View current configuration". Set and delete modify keys, while status summarizes deployment health rather than displaying the configuration.

   Reference: cilium config view — Command Reference — cilium config view > Synopsis

6. 6Which connectivity model does Cilium Cluster Mesh provide for managed pods in different clusters?

   1. A. Only public HTTP connectivity through a mandatory shared ingress
   2. B. Pod connectivity only after merging Kubernetes API servers
   3. C. Connectivity only between Services with no direct pod reachability
   4. D. Pod-to-pod connectivity across clusters in a flat IP address space

   Answer: D

   Explanation: The overview lists "Pod-to-pod connectivity between clusters within a flat IP address space". Cluster Mesh extends pod networking across distinct clusters rather than requiring their Kubernetes control planes to be merged.

   Reference: Multi-Cluster (Cluster Mesh) — Multi-Cluster (Cluster Mesh) > Capabilities

7. 7What causes an eBPF program attached to a hook to run?

   1. A. The program runs continuously even when no relevant hook event occurs.
   2. B. The kernel or application reaches the associated event hook point.
   3. C. The program executes once during compilation before any hook is attached.
   4. D. A user-space controller must explicitly invoke it for every hook event.

   Answer: B

   Explanation: The introduction states, "eBPF programs are event-driven and are run when the kernel or an application passes a certain hook point." Execution follows hook events, rather than continuous execution, compilation-time execution, or a required user-space invocation for every event.

   Reference: What is eBPF? An Introduction and Deep Dive into the eBPF Technology — Introduction to eBPF > Hook Overview

8. 8A legacy external firewall accepts application connections only from a predictable source IP, while pod IPs change. With prerequisites satisfied, which Cilium capability addresses this requirement?

   1. A. BGP advertisement of every pod IP without source translation
   2. B. Ingress path-based routing from external clients to a Service
   3. C. Cluster Mesh service discovery without an egress policy
   4. D. Egress Gateway routing and SNAT through selected gateway nodes

   Answer: D

   Explanation: The official documentation states, "When the egress gateway feature is enabled and egress gateway policies are in place, matching packets that leave the cluster are masqueraded with selected, predictable IPs associated with the gateway nodes." This provides the predictable source IP required by the external firewall. Route advertisement, inbound HTTP routing, and service discovery alone do not perform the requested source translation.

   Reference: Egress Gateway — Egress Gateway > Opening description

9. 9How does Cilium’s socket-level east-west load balancing handle a connection to a Service?

   1. A. It chooses and rewrites the backend independently for each packet.
   2. B. It delays backend choice until an HTTP proxy parses the request.
   3. C. It rewrites the service connection at the connect() socket operation.
   4. D. It leaves the Service address unchanged and relies on kube-proxy for backend choice.

   Answer: C

   Explanation: The documentation states, "East-west load balancing rewrites service connections at the socket level (connect()), avoiding the overhead of per-packet NAT and fully replacing kube-proxy." Backend rewriting occurs at connect(), rather than being deferred to HTTP parsing, repeatedly selected per packet, or delegated to kube-proxy.

   Reference: Introduction to Cilium & Hubble — Functionality Overview > Load Balancing

10. 10A CiliumNetworkPolicy selects database pods and contains an ingress rule whose fromEndpoints selector matches app=api. What traffic does that ingress rule describe?

    1. A. Traffic entering the database pods from matching API endpoints
    2. B. Traffic leaving the database pods toward matching API endpoints
    3. C. Traffic entering the API endpoints from matching database pods
    4. D. Traffic leaving every pod toward any endpoint in the namespace

    Answer: A

    Explanation: The policy introduction says, "network packets which are entering the endpoint." Here the endpoint selector chooses database pods, and fromEndpoints identifies the permitted ingress sources. Reversing source and destination changes the rule’s intent.

    Reference: Policy Enforcement Modes — Rule Basics > ingress