Linux Foundation Cilium-Associate Practice Exam Questions & Answers

A is clearly the intended answer because its filters correspond to the displayed source namespace (endor), destination port (443), and verdict (DROPPED). However, it contains example.con, whereas the observed flow names example.com. Therefore, none of the options would literally return this exact flow if the FQDN filter is matched as written. The corrected command is:

hubble observe --to-fqdn example.com --from-namespace endor --to-port 443 --verdict DROPPED

Option B is malformed in two additional places and filters port 80 rather than 443. Option C selects the wrong FQDN and source namespace. Option D requests forwarded flows, directly contradicting the Policy denied DROPPED verdict; its wildcard also does not repair the verdict mismatch.

Hubble's observe filters are cumulative: a returned flow must satisfy the specified destination FQDN, originating namespace, destination port, and verdict. Layer 7 visibility is enabled with a Cilium network policy containing the relevant L7 rules, which redirects selected traffic through the proxy so that application-level details can be reported.

Official references

Inspecting Network Flows with the Hubble CLI, Layer 7 Protocol Visibility

Study Guide topic: Hubble flow filtering, FQDN visibility, namespaces, ports, and verdicts.

Layer 7 protocol visibility redirects traffic matching the relevant L7 rules to Cilium's node-local proxy, which is Envoy. Envoy parses supported application protocols and supplies the resulting request or response metadata to Cilium's observability pipeline. Therefore, C correctly identifies the architectural consequence of enabling this visibility.

The feature requires L7 proxy support and an appropriate CiliumNetworkPolicy containing Layer 7 rules. A standard Kubernetes NetworkPolicy is limited to Layer 3 and Layer 4 concepts and cannot express Cilium's HTTP, DNS, or generic application-protocol rules, so B is incorrect.

A is also incorrect. DNS policy and visibility are commonly applied to pod egress queries, and Cilium's model is not restricted to ingress-only DNS visibility. D overstates protocol coverage. Cilium supports defined L7 parsers and policy types---most prominently HTTP, DNS, Kafka, and supported generic Envoy-based protocols---but it does not promise arbitrary visibility for every application protocol. SSH, Telnet, and FTP cannot simply be assumed to receive native semantic parsing.

An operational caveat is that L7 visibility rules also affect policy enforcement: they are not merely passive packet logging instructions.

Official references

Layer 7 Protocol Visibility, Cilium Envoy

Study Guide topic: L7 proxy redirection, CiliumNetworkPolicy, protocol parsing, and Hubble visibility.

The host entity represents the local node on which the selected Cilium endpoint resides. It also includes processes and containers using the local host network namespace. Therefore, A reproduces the official entity definition accurately.

The remote-node entity does not represent arbitrary unmanaged endpoints. It represents hosts other than the local node across the local cluster and connected clusters, including host-networked containers on those nodes. Unmanaged endpoints instead have the reserved unmanaged identity.

Option C gives the definition of the separate kube-apiserver entity, not cluster. The cluster entity is the logical collection of endpoints and reserved identities inside the local cluster, including Cilium-managed endpoints, unmanaged local endpoints, hosts, remote nodes, health, ingress, initialization, and kube-apiserver identities. Current documentation separately provides a cluster-mesh entity for endpoints in connected clusters.

Option D confuses all with world. world represents endpoints outside the cluster. all covers all identities and is not simply equivalent to the IPv4 CIDR 0.0.0.0/0, particularly in identity-aware, node, and IPv6 contexts.

Official references

Cilium Layer 3 Policy Entities, Cilium Reserved Identities

Study Guide topic: Reserved entities and identity-based Layer 3 policies.

A is a supported recommendation: Cilium's WireGuard implementation provides transparent encryption between Cilium-managed endpoints, works with Cluster Mesh, and distributes node public keys to remote clusters through clustermesh-apiserver. All participating clusters must enable WireGuard, and inter-cluster firewalls must permit UDP port 51871. IPv6-only pod traffic does not inherently disqualify WireGuard.

However, this question is no longer uniquely answerable from current Cilium documentation. Current IPsec documentation supports IPv6 pod-to-pod connectivity and sets its cluster or Cluster Mesh limit at more than 65,535 nodes. The described mesh contains 10,002 nodes, so option B is also technically supportable under the stated facts. The older distinction apparently assumed by the supplied key is no longer sufficient to exclude IPsec.

Options C and D are definitively false. Ten thousand and two nodes remain below the documented IPsec ceiling, and transparent encryption is not restricted to IPv4. WireGuard may still be selected for its automatic per-node key-pair distribution and simpler Cluster Mesh integration, but workload performance, kernel support, firewall rules, key-management requirements, and operational testing should inform a production recommendation.

Official references

WireGuard Transparent Encryption, IPsec Transparent Encryption

Study Guide topic: Transparent-encryption selection, IPv6, Cluster Mesh, and scaling limits.

The intended answer is A because API request limiting corresponds to rate limiting, which Cilium identifies as a core Layer 7 traffic-management capability. Cilium combines its eBPF datapath with Envoy for application-layer processing. The official Service Mesh documentation expressly includes rate limiting among the functions that must understand protocols such as HTTP, REST, gRPC, and WebSocket. It is therefore not merely packet-rate policing at Layer 3 or Layer 4; it can be applied with application-protocol context.

However, this question is no longer valid as a strict single-answer item. Current Cilium documentation also describes proxy-based Layer 7 load balancing as useful for gRPC and provides an Envoy-backed implementation for Kubernetes Services. Consequently, option C is also supportable under the current product documentation, although the feature is identified as beta. API authorization and fault-delay injection are not presented as equivalent first-class Cilium Service Mesh use cases in the cited feature overview.

For certification-bank purposes, retain A as the intended answer, but revise option C or qualify it to restore a unique correct choice.

Official references

Service Mesh; Proxy Load Balancing for Kubernetes Services.

Study Guide topic: Service Mesh.

If a global Service has no healthy local endpoints matching its selector, every available backend can be remote. Cluster Mesh synchronizes remote service and endpoint information, allowing the local Cilium datapath to load-balance requests to backend pods in connected clusters. The absence of local endpoints therefore provides a direct explanation for the observed behavior.

If the local cluster were not part of the Cluster Mesh, its Cilium agents would not normally receive the remote endpoint state needed to route traffic through the global Service, so B does not explain successful remote-only selection. An affinity value of none is the default behavior and expresses no preference between local and remote endpoints. When both categories exist and are healthy, this permits load balancing across both; it does not require every connection to use remote backends.

Setting service.cilium.io/shared: 'false' prevents the local Service's backends from being shared with remote clusters. It does not instruct the local cluster to direct all requests toward remote endpoints.

A separate possible cause, not presented among the choices, would be service.cilium.io/affinity: 'remote'. Among the supplied answers, however, A is the valid explanation.

Official references

Service Affinity; Cluster Mesh.

Study Guide topic: Cluster Mesh.

B expresses the principal scalability distinction intended by the question. In kube-proxy's iptables mode, Kubernetes Services and endpoints are represented by chains of netfilter rules. As the number of Services and backends grows, rule creation, synchronization, and packet traversal can involve increasingly large rule sets. Matching through those chains is generally described as having linear scaling characteristics.

Cilium's kube-proxy replacement stores service and backend state in eBPF maps. Hash-map lookups allow the datapath to locate service entries without sequentially scanning a rule for every Service, providing effectively constant-time lookup behavior for the relevant map operations. This makes the approach better suited to large and frequently changing Kubernetes environments.

Option A is false because iptables and netfilter also operate within the Linux kernel. Option C is false because kube-proxy's iptables implementation supports IPv6 when the surrounding Kubernetes and host configuration supports it. Option D does not explain kube-proxy's primary scaling limitation and introduces an unrelated SmartNIC/XDP claim.

The constant-time description is a useful architectural simplification; total performance still depends on map sizing, backend selection, connection tracking, and kernel behavior.

Official references

Cilium eBPF Datapath, Cilium Tuning Guide

Study Guide topic: kube-proxy replacement, eBPF maps, and datapath scalability.