Linux Foundation Cilium-Associate - Cilium Certified AssociateCCA

Technical explanation

Hubble does not obtain Layer 7 protocol visibility exclusively through eBPF without a proxy. By default, Cilium’s datapath exposes Layer 3 and Layer 4 flow information. To produce supported application-layer events, traffic is selected through an L7 Cilium policy and redirected to the node-local Envoy proxy. Envoy parses the application protocol and forwards access-log information that Cilium and Hubble expose as Layer 7 flow events.

The other capabilities are supported. Hubble flow records contain the observing node, and the CLI provides node-based filtering. HTTP-aware flows can contain response status codes, enabling inspection or filtering for results such as 200 and 404. Hubble also records forwarding verdicts and drop reasons. Operators can filter for DROPPED traffic and distinguish policy-denied connections from forwarded traffic and other failure conditions.

This separation is fundamental to Cilium’s architecture: eBPF provides efficient kernel-level forwarding, security enforcement, and L3/L4 observability, while Envoy supplies protocol parsing when request-level context is required. The integration remains transparent to applications, but the proxy is still present in the traffic path for Layer 7 visibility.

Therefore, B describes the unsupported mechanism and is the correct answer.

Official references

Layer 7 Protocol Visibility ; Envoy ; Hubble CLI .

Study Guide topic: Network Observability.

Technical explanation

The exhibit records connections originating from default/test and directed to default/test2 , eliminating B and C because those choices reverse the initiating workload. For destination port 80, the flow shows the TCP three-way handshake—SYN, SYN-ACK, and ACK—followed by bidirectional packets with ACK/PSH flags and an orderly FIN exchange. This is the pattern of a successfully established request and response, so the first curl operation succeeded.

The later connection targets port 8080. Hubble records a SYN from test followed by an ACK, RST response from test2 . A reset returned immediately after the connection attempt indicates that the destination rejected or could not accept the connection, commonly because no process was listening on that port. It is not shown as a policy drop; both entries carry the FORWARDED verdict. Thus the network delivered the packets, but the TCP connection itself failed.

Option D is the only choice matching a successful request from test to port 80 and a failed request from test to port 8080. Its displayed IP strings contain source-document transcription defects, but its workload direction, ports, and outcomes match the exhibit.

Official references

Inspecting Network Flows with the CLI ; Troubleshooting with Hubble .

Study Guide topic: Network Observability.

Technical explanation

Cilium tunnel mode supports VXLAN and Geneve encapsulation. In this routing model, Cilium nodes form an overlay mesh, and traffic exchanged between nodes is carried inside UDP-encapsulated packets. VXLAN is the default tunnel protocol and normally uses UDP port 8472. Geneve is the alternative and normally uses UDP port 6081. Operators select the protocol through the tunnel-protocol configuration setting, whose documented values are vxlan and geneve .

Encapsulation reduces the requirements placed on the underlying network. The underlay only needs to provide IP connectivity between the Kubernetes nodes and permit the selected UDP tunnel port. It does not need to learn or route individual PodCIDRs. Cilium also uses the tunnel metadata to carry information such as the source security identity, avoiding an additional identity lookup on the receiving node.

MPLS, OTV, STT, and EVPN are not supported values for Cilium’s tunnel-protocol setting. EVPN may be used in broader data-center network designs, and MPLS is a carrier-routing technology, but neither is a Cilium overlay encapsulation choice. Therefore, B is the only supported pair.

Official references

Cilium Routing ; System Requirements .

Study Guide topic: Architecture.

Technical explanation

In Cilium’s default policy-enforcement mode, an endpoint initially permits ingress and egress traffic. Enforcement changes independently for each direction when a policy selects that endpoint. If a selecting rule contains an ingress section, the endpoint enters default-deny mode for ingress. If a selecting rule contains an egress section, it enters default-deny mode for egress. Only traffic explicitly permitted by the applicable policy rules remains allowed in the restricted direction.

This per-direction behavior is important. An ingress-only policy does not automatically restrict egress, and an egress-only policy does not automatically restrict ingress. Options A and B reverse the relationship between the rule section and the direction being enforced. Option C incorrectly states that selection places the endpoint into default-allow mode; default allow describes the endpoint’s condition before it is selected by an enforcing policy.

Cilium also supports always and never enforcement modes. In always , enforcement applies even to endpoints not selected by policy. In never , policy enforcement is disabled. Policies can additionally use enableDefaultDeny for specialized visibility configurations, but those controls do not change the normal default behavior described in the question.

Official references

Policy Enforcement Modes .

Study Guide topic: Network Policy.

Technical explanation

Cluster Mesh extends Cilium’s identity-aware networking and policy enforcement across connected Kubernetes clusters. A CiliumNetworkPolicy can authorize communication with workloads in a particular remote cluster by selecting their workload labels together with the synthetic io.cilium.k8s.policy.cluster label. Therefore, A accurately describes a direct network-policy function.

The policies themselves are not automatically copied between clusters. Administrators remain responsible for applying the required policy resources in the appropriate clusters, but enforcement can select and govern remote endpoints once Cluster Mesh has propagated their identities.

Option B confuses authorization with transport encryption. WireGuard or IPsec configuration enables transparent encryption; it is not established by a network-policy rule. Option C is also separate from policy enforcement: cross-cluster load balancing is configured through global-service facilities and service annotations, not through CiliumNetworkPolicy . Option D is incorrect under current documentation because Cilium mutual authentication does not provide a single trust domain spanning Cluster Mesh clusters and is not presently compatible with that multi-cluster arrangement.

Official references

Cluster Mesh Network Policy , Cluster Mesh Services , Mutual Authentication Limitations

Study Guide topic: Cross-cluster identity, endpoint selection, and policy enforcement.

Technical explanation

SPIRE supplies workload identities as SPIFFE Verifiable Identity Documents, including X.509 key material used for mutual authentication. SPIFFE’s identity model supports automatic issuance, rotation, and revocation, allowing short-lived certificates to be renewed without manually distributing static credentials. This makes D the correct statement.

Option A reverses the documented default. Cilium’s default SPIRE installation requires persistent-volume support. In-memory storage can be selected for laboratory environments by disabling server data storage, but that setting causes SPIRE data to be recreated if the server pod restarts. Option B also reverses the relationship between the projects: SPIFFE defines the identity standards and APIs, while SPIRE is a production-ready implementation of SPIFFE. Cilium’s mutual-authentication integration has been validated with SPIRE.

Option C overstates the operational requirement. A SPIRE server is involved, but Cilium’s Helm chart can deploy and configure the supported SPIRE server and per-node agents. Administrators may provide their own deployment, yet a completely manual installation is not mandatory.

Current documentation classifies this mutual-authentication implementation as beta and notes limitations, including incompatibility with Cluster Mesh trust domains. Those maturity constraints do not change the certificate-management behavior described in D.

Official references

Cilium Mutual Authentication .

Study Guide topic: Service Mesh.

Technical explanation

Hubble obtains its visibility from Cilium’s eBPF datapath, and the Hubble Server is embedded in the Cilium agent. Hubble therefore cannot provide its normal flow-observability capabilities as a standalone installation without Cilium, eliminating B.

CNI chaining allows Cilium to coexist with a supported existing CNI. The original plugin continues to supply base connectivity and IP address management, while Cilium attaches eBPF programs to the created network devices. Those programs provide visibility, policy enforcement, and other Cilium functionality. Hubble can then be enabled on top of the chained Cilium deployment. This approach avoids an immediate, disruptive replacement of the production cluster’s networking layer and is consequently the best answer.

Options C and D could be appropriate in broader migration projects, particularly when a current CNI is incompatible with chaining or when full native-Cilium functionality is required. However, both imply substantially more workload movement or cutover activity than the stated objective of minimizing downtime.

Compatibility, chaining mode, current CNI behavior, kernel requirements, and feature limitations must still be validated before production rollout.

Official references

Cilium CNI Chaining , Hubble Internals , Troubleshooting Hubble

Study Guide topic: Hubble prerequisites, CNI chaining, and production adoption.

Technical explanation

The intended answer is D, but the option contains a source-bank typographical error. The valid command is cilium sysdump , not cilium sysduwp . Read literally, none of the four displayed commands exactly answers the question.

The Cilium CLI’s sysdump operation gathers cluster-wide troubleshooting material, including Cilium configuration and endpoint state, agent and operator logs, Kubernetes workload information, routing and interface details, kernel messages, service state, policies, and selected eBPF-map output. This consolidated archive is the preferred diagnostic package when investigating Kubernetes networking or preparing a support report.

cilium status --verbose provides expanded health and deployment status, but it does not collect the comprehensive diagnostic archive requested. debuginfo is associated with the in-agent debug client—currently documented as cilium-dbg debuginfo —and produces useful local-agent API information; in Kubernetes environments it is already included as part of the system dump. cilium bugtool is not the current cluster-wide Cilium CLI command requested here.

For an exam-ready correction, option D should read cilium sysdump .

Official references

Cilium Troubleshooting and Sysdump

Study Guide topic: Cilium CLI troubleshooting, system dumps, and diagnostic collection.

Technical explanation

A is clearly the intended answer because its filters correspond to the displayed source namespace ( endor ), destination port ( 443 ), and verdict ( DROPPED ). However, it contains example.con , whereas the observed flow names example.com . Therefore, none of the options would literally return this exact flow if the FQDN filter is matched as written. The corrected command is:

hubble observe --to-fqdn example.com --from-namespace endor --to-port 443 --verdict DROPPED

Option B is malformed in two additional places and filters port 80 rather than 443. Option C selects the wrong FQDN and source namespace. Option D requests forwarded flows, directly contradicting the Policy denied DROPPED verdict; its wildcard also does not repair the verdict mismatch.

Hubble’s observe filters are cumulative: a returned flow must satisfy the specified destination FQDN, originating namespace, destination port, and verdict. Layer 7 visibility is enabled with a Cilium network policy containing the relevant L7 rules, which redirects selected traffic through the proxy so that application-level details can be reported.

Official references

Inspecting Network Flows with the Hubble CLI , Layer 7 Protocol Visibility

Study Guide topic: Hubble flow filtering, FQDN visibility, namespaces, ports, and verdicts.