Pass the Linux Foundation Cloud & Containers Cilium-Associate Questions and answers with CertsForce

Technical explanation

cilium config view is the Cilium CLI command intended to display the current configuration. It reads the configuration associated with the selected Kubernetes context, Cilium namespace, and Helm release and presents the relevant settings for inspection. This makes D the direct answer.

cilium status performs a different function. It reports the health and readiness of Cilium components such as the agent DaemonSet, operator, Envoy, Hubble Relay, and Cluster Mesh. Although status output may reveal a small amount of deployment information, it is not a complete configuration-viewing command.

cilium sysdump collects a comprehensive troubleshooting archive containing Kubernetes resources, component logs, command output, configuration data, and other diagnostic evidence. It is appropriate when preparing a support bundle, but it is unnecessarily broad for simply consulting the current configuration. cilium context deals with Kubernetes context selection or inspection rather than displaying Cilium’s configured values.

The Cilium CLI organizes configuration operations under the cilium config command group. Related subcommands include set , delete , and view . Because the requested action is read-only inspection of the existing settings, view is the appropriate subcommand.

Official references

Cilium CLI `config view` .

Study Guide topic: Installation and Configuration.

Technical explanation

C is not a valid description. A service-mesh sidecar externalizes networking functions into a proxy container running beside the application; it does not force the instrumentation logic into the application’s source code. In fact, a core service-mesh objective is to provide connectivity, security, traffic management, and observability transparently without requiring application-code changes.

The operational concerns in the other choices are characteristic of sidecar implementations. A proxy must be injected into each workload pod, increasing container count and potentially affecting pod initialization, resource consumption, ordering, and readiness. Adding a sidecar to an existing pod template normally requires the pods to be recreated because Kubernetes cannot dynamically add a new container to an already-running pod.

Traffic interception also directs application traffic through the sidecar proxy and its network namespace paths, adding network-stack traversal and proxy-processing overhead. Cilium’s service-mesh design can instead use node-level Envoy proxies together with eBPF traffic redirection, avoiding one proxy container in every application pod. This preserves transparent application behavior while reducing the per-workload operational burden.

Official references

Cilium Service Mesh , Cilium Ingress and Network Policy Example

Study Guide topic: Sidecar-based and sidecar-free service-mesh architectures.

Technical explanation

Option D uses the correct structure for permitting egress from selected endpoints to the local host entity. The endpointSelector selects endpoints whose label env equals dev . Because the intended traffic travels from those endpoints toward the host, the policy must contain an egress rule. An egress peer is expressed through toEntities , and host is the reserved entity representing the local host, including host-networked containers on that node.

Option A is invalid because fromEntities is an ingress-oriented field and cannot express an egress destination. Option B uses nodeSelector , which selects nodes rather than workload endpoints and is only valid for node-level rules in a CiliumClusterwideNetworkPolicy ; it is not valid in the displayed namespaced CiliumNetworkPolicy . It also combines ingress with toEntities , reversing the rule direction. Option C has a valid workload selector but again uses toEntities under ingress ; ingress rules describe sources through constructs such as fromEntities .

Applying option D places the selected endpoints into egress default-deny mode and then expressly permits traffic whose destination is the host entity. Other egress traffic must be allowed separately.

Official references

Policy Enforcement and Rule Basics ; Endpoint Lifecycle policy examples .

Study Guide topic: Network Policy.

Technical explanation

Both Kubernetes Ingress and the north-south use of Gateway API provide declarative Layer 7 routing from clients outside the cluster to Kubernetes workloads. They express host- and path-based routing through Kubernetes resources and can be implemented by controllers such as Cilium’s Envoy-based ingress implementation. A therefore captures their shared purpose most accurately.

The remaining choices describe differences rather than universal similarities. Gateway API is explicitly role-oriented: infrastructure administrators manage GatewayClass and often Gateway , while application owners manage route resources such as HTTPRoute . The Ingress API does not provide the same formal separation of administrative and application-facing resources, making C unsuitable as a statement about both.

Implementation-specific annotations are historically common with Ingress because its core API is limited. Gateway API was deliberately designed with more expressive, portable resource fields so that implementations do not need to depend as heavily on vendor-specific annotations; D is consequently not true of both. Namespace behavior also differs because Gateway API provides controlled cross-namespace attachment and reference mechanisms. B is therefore not the defining common capability.

Official references

Cilium Kubernetes Ingress Support , Cilium Gateway API Support , Migrating from Ingress to Gateway API

Study Guide topic: Kubernetes north-south routing, Ingress, and Gateway API.

Technical explanation

The Hubble Server is embedded in each Cilium agent and consumes the eBPF-derived visibility data produced on that node. It exposes gRPC services through which clients can retrieve flow events, node and namespace information, server status, and related observability data. Embedding the server in the agent enables high-performance collection with comparatively low overhead.

Hubble Relay has a different role. It is a standalone component that discovers and connects to the Hubble Server instances running across the cluster. Relay aggregates their individual APIs to provide multi-node or cluster-wide visibility to clients such as the Hubble CLI and Hubble UI. It is therefore not the component embedded in the agent.

The Cilium CNI plugin is invoked when Kubernetes creates or removes pods and asks the local agent to configure their networking and datapath. The Cilium Operator performs cluster-wide management duties such as selected IPAM and shared-state operations. Neither component is responsible for exposing eBPF flow visibility.

This server–relay distinction is central to understanding Hubble’s distributed architecture: Server provides node-local visibility, while Relay combines multiple servers into a cluster-wide view.

Official references

Hubble Internals , Cilium Component Overview

Study Guide topic: Hubble Server, Hubble Relay, and distributed flow observability.

Technical explanation

Cilium functions as a Kubernetes Container Network Interface implementation. When Kubernetes creates or removes a pod sandbox, the container runtime invokes the configured CNI plugin. Cilium establishes the pod’s network connectivity, connects the workload to the node’s networking environment, allocates or obtains an address through the configured IPAM mode, and coordinates the endpoint with the Cilium agent. Its eBPF datapath then supplies routing, service load balancing, policy enforcement, and network visibility.

Cilium provides substantially more functionality than the minimum CNI contract, but those additional capabilities do not change its primary Kubernetes networking role. Hubble supplies integrated network observability, yet Cilium is not merely a container-metrics monitor. Resource utilization such as CPU and memory is normally handled through Kubernetes metrics and monitoring systems.

Cilium is also not a Container Storage Interface. CSI drivers manage storage volumes, attachment, mounting, and lifecycle operations, which are unrelated to Cilium’s primary responsibilities. Nor is Cilium simply a pod-operation logging mechanism. It can emit datapath events and diagnostic logs, but those are supporting capabilities.

Accordingly, D provides the correct architectural classification for Cilium in a Kubernetes cluster.

Official references

Introduction to Cilium and Hubble ; Cilium Helm Installation .

Study Guide topic: Architecture.

Technical explanation

Layer 7 protocol visibility redirects traffic matching the relevant L7 rules to Cilium’s node-local proxy, which is Envoy. Envoy parses supported application protocols and supplies the resulting request or response metadata to Cilium’s observability pipeline. Therefore, C correctly identifies the architectural consequence of enabling this visibility.

The feature requires L7 proxy support and an appropriate CiliumNetworkPolicy containing Layer 7 rules. A standard Kubernetes NetworkPolicy is limited to Layer 3 and Layer 4 concepts and cannot express Cilium’s HTTP, DNS, or generic application-protocol rules, so B is incorrect.

A is also incorrect. DNS policy and visibility are commonly applied to pod egress queries, and Cilium’s model is not restricted to ingress-only DNS visibility. D overstates protocol coverage. Cilium supports defined L7 parsers and policy types—most prominently HTTP, DNS, Kafka, and supported generic Envoy-based protocols—but it does not promise arbitrary visibility for every application protocol. SSH, Telnet, and FTP cannot simply be assumed to receive native semantic parsing.

An operational caveat is that L7 visibility rules also affect policy enforcement: they are not merely passive packet logging instructions.

Official references

Layer 7 Protocol Visibility , Cilium Envoy

Study Guide topic: L7 proxy redirection, CiliumNetworkPolicy, protocol parsing, and Hubble visibility.

Technical explanation

A cluster-wide requirement is best implemented with CiliumClusterwideNetworkPolicy , whose correct resource spelling is CiliumClusterwideNetworkPolicy . Unlike a namespaced CiliumNetworkPolicy , this Cilium CRD is non-namespaced and can select endpoints across the entire cluster.

To deny external ingress for every Cilium-managed pod, a cluster-wide policy can use an empty endpointSelector and an ingressDeny rule selecting the world entity. Cilium defines world as network endpoints outside the cluster. An alternative allow-list construction can permit only the cluster entity, thereby excluding external sources, but an explicit deny rule usually communicates the requirement more directly.

A standard Kubernetes NetworkPolicy and a CiliumNetworkPolicy are namespaced, requiring repeated resources in every applicable namespace. CiliumGlobalPolicy is not a valid Cilium resource type. Although the option capitalizes “Wide” differently from the actual kind, D unmistakably identifies the intended cluster-scoped policy.

Official references

Cilium Deny Policies , Cilium Network Policy Types

Study Guide topic: Cluster-scoped policies, external traffic, and reserved entities.