A workload must access a legacy external system that allowlists a fixed source IP. The workload can move between nodes.
Cilium Egress Gateway and its prerequisites are enabled. The team is configuring the steady-state path for selected Pods to the legacy system's IPv4 CIDR.
Which TWO actions are required for the intended design?
Define an egress gateway policy selecting the workload and the legacy destination CIDR.
Advertise the intended source IP through BGP and retain ordinary per-node masquerading.
Add a CIDR allow rule and let the workload's current node choose its normal masquerade address.
Configure the gateway's egress IP on its network interface and ensure the network can route return traffic.
A
The egress gateway policy selects traffic for redirection through a gateway, where it is source-NATed to the configured egress address. That address must exist on the gateway's interface and work with the surrounding network. BGP advertisement or a CIDR allow rule alone does not establish this source-NAT path. The question specifies steady state because newly created Pods can experience a delay before egress gateway policy takes effect.
BGP and External Networking
25
Select Two
D
Cilium's BGP control plane has established a session with an external router. The router receives the expected advertised prefix, but traffic to that prefix still fails.
An engineer assumes that the successful advertisement proves Cilium has configured every forwarding step needed to reach the destination.
Which assessment is correct?
Route advertisement does not establish datapath correctness; forwarding and return paths still need investigation.
An established BGP session confirms forwarding, so the failure must originate in application authentication.
Prefix advertisement confirms that the destination Pods have passed all configured readiness checks.
BGP programs the complete Pod datapath, so restarting the peer session should rebuild the missing path.
A
Cilium's BGP control plane advertises routes; it does not program the datapath. A learned prefix therefore does not prove forwarding, return routing, policy, or application health. Restarting BGP cannot be assumed to repair an unrelated datapath problem.
BGP and External Networking
24
Select One
A team asks how Cilium can process networking decisions without sending each packet to a userspace management process.
Which explanation best describes the eBPF approach?
Cilium converts all networking decisions into application-side libraries loaded into each container.
Cilium sends the first packet of every flow to the Kubernetes API server and caches its verdict.
Kernel-attached programs process events and consult maps populated with networking and policy state.
Kernel modules are rebuilt for each policy change and then loaded into the affected application Pods.
C
eBPF programs execute at kernel hooks and use maps to access state. This enables datapath processing without a userspace round trip for every packet. It does not require application libraries, API-server decisions per flow, or rebuilding kernel modules for each policy change.
eBPF
23
Select One
An engineer explains that an eBPF program has passed the kernel verifier and concludes that it must therefore implement the organization's network-access policy correctly.
Which response is accurate?
Verification confirms the program's policy decisions, but its memory safety is checked only during execution.
Verification checks execution safety constraints; it does not prove the intended access policy is correct.
Verification checks the program's signature, while the JIT compiler validates its policy decisions.
Verification confirms that every network flow permitted by the program matches a Kubernetes policy.
B
The verifier checks constraints such as memory access safety and bounded execution. It does not determine whether the program implements the organization's intended authorization rules. JIT compilation and program signatures do not supply that semantic guarantee.
eBPF
22
Select One
Two clusters have a functioning Cluster Mesh. Both contain a Service named catalog in the shop namespace, annotated as a Cilium global service. Network policies permit communication, and all backends are healthy.
Cluster A has service.cilium.io/shared: "false". Cluster B uses the default sharing behavior.
Clients in A can use backends from both clusters, but clients in B use only B's backends. The team wants both clusters to share their backends.
What should it change?
Assign the same ClusterIP to the Service in both clusters.
Configure identical numeric cluster IDs for the two clusters.
Set service.cilium.io/global: "false" on the Service in cluster B.
Enable sharing for the Service in cluster A or remove its shared: "false" annotation.
D
The shared annotation controls whether local backends are made available to other clusters. Disabling sharing in A does not prevent A from consuming B's shared backends. Matching ClusterIPs or cluster IDs is not the solution, and disabling global behavior in B removes the intended feature.
Cluster Mesh
21
Select One
Two existing clusters will be connected through Cilium Cluster Mesh. Their Cilium versions and datapath modes are compatible, and the required inter-cluster network connectivity has been established.
Which TWO addressing and identification conditions must also be satisfied?
Both clusters must use the same numeric cluster ID to share workload identities.
Both clusters must allocate Services from an identical Service CIDR.
Pod address ranges must not overlap across the participating clusters.
Each cluster must have a unique cluster name and numeric cluster ID.
C
Cluster Mesh requires non-conflicting Pod address ranges and unique cluster identification. It does not require identical Service CIDRs, and reusing a numeric cluster ID conflicts with the identification requirement.
Cluster Mesh
20
Select Two
D
A new cluster will use Cilium's kube-proxy replacement. The nodes can reach the Kubernetes API server's real address and port, but Kubernetes Service routing is not yet available.
The installation must avoid depending on the API server's ClusterIP Service during bootstrap.
Which configuration should the team provide?
The directly reachable API server address and port through k8sServiceHost and k8sServicePort.
The Kubernetes API Service's ClusterIP and Service port through k8sServiceHost and k8sServicePort.
The cluster DNS Service's address and the Kubernetes API Service's DNS name.
The PodCIDR range and the API server's ClusterIP as a native-routing destination.
A
A directly reachable API endpoint avoids a bootstrap dependency on Service routing. The API Service's ClusterIP still requires that routing, and DNS configuration or adding a CIDR does not supply the missing Service translation.
Installation and Configuration
19
Select One
After installing Cilium, an engineer runs cilium status --wait. The agents and operator report healthy.
Before accepting the installation, the engineer wants to exercise supported connectivity scenarios using test workloads rather than relying only on component readiness.
Which command is the best next step?
cilium config view
cilium connectivity test
cilium status --verbose
cilium sysdump
B
The connectivity test creates test workloads and exercises networking scenarios. Configuration inspection, verbose component status, and a diagnostic archive are useful, but do not perform the same active validation. Passing these tests does not prove that every application-specific traffic path is correct.
Installation and Configuration
18
Select One
During a connectivity investigation, an engineer wants Hubble to show dropped flows associated with a particular Pod, whether that Pod is the source or destination.
Which command best matches this request?
hubble observe --pod shop/frontend --verdict DROPPED
hubble observe --pod shop/frontend --verdict FORWARDED
hubble observe --pod shop/frontend --protocol http
hubble observe --verdict DROPPED
A
The Pod filter selects flows associated with the named Pod, and --verdict DROPPED restricts results to dropped flows. The forwarded-verdict command selects forwarded traffic, the protocol filter filters by protocol rather than verdict, and omitting the Pod filter does not limit results to the Pod.
Network Observability
17
Select One
Hubble shows TCP flows for a plaintext HTTP application, but not HTTP methods or paths. Traffic currently bypasses Cilium's Layer 7 proxy, and no Layer 7 policy applies.
The team wants HTTP visibility without narrowing the application's currently permitted egress traffic.
Which approach best meets this requirement?
Add an L4 allow rule for the HTTP port and retain the current proxy configuration.
Add an HTTP allow-all L7 rule for that traffic, with egress default-deny disabled for that policy.
Filter Hubble output for the HTTP protocol and retain the current traffic-processing configuration.
Increase Hubble's flow retention and export the existing TCP records as HTTP metrics.
B
An HTTP L7 rule redirects matching traffic for protocol processing. An allow-all HTTP rule avoids narrowing HTTP requests, and disabling egress default-deny for that policy avoids restricting unrelated egress. L4 rules, output filters, and retention settings do not generate missing HTTP-layer observations.
Network Observability
16
Select One
Hubble is enabled on every worker node. An engineer connects the Hubble CLI directly to one node's Hubble server and sees flows from that node, but needs a cluster-wide view.
Which change provides the intended aggregation?
Increase the local Hubble server's flow-buffer capacity.
Connect the CLI to the Cilium operator's Kubernetes endpoint.
Connect the CLI to Hubble Relay, which aggregates the node servers.
Enable additional application labels on the workloads being observed.
C
Hubble Relay connects to node-local Hubble servers and exposes an aggregated view. Increasing one server's buffer changes retention, not scope. The operator is not a flow-aggregation endpoint, and labels improve filtering rather than collecting remote-node flows.
Network Observability
15
Select One
A company exposes one HTTPS hostname through Cilium Gateway API. Requests under /api must reach one Service, while requests under /web must reach another.
The client-to-Gateway connection must be encrypted. The backends accept plaintext HTTP, and the company permits TLS termination at the Gateway.
Which configuration best fits the requirement?
A TLS passthrough listener with routes that distinguish the two backends by URL path.
A TCP listener with backend selection based on the destination Service's labels.
Two TLS passthrough routes using the same hostname and separate backend ports.
An HTTPS listener terminating TLS, with HTTPRoute path matches for the two Services.
D
Terminating TLS makes the HTTP path available for HTTPRoute matching while preserving encryption from the client to the Gateway. TLS passthrough cannot inspect the encrypted URL path. TCP forwarding and backend labels do not provide the requested HTTP-path routing.
Service Mesh
14
Select One
Cilium WireGuard encryption is enabled and functioning between two worker nodes. Ordinary Cilium-managed application Pods communicate both across nodes and within the same node.
No application-level TLS is configured.
Which TWO observations are consistent with this setup?
Pod traffic crossing between the nodes is protected by the configured WireGuard tunnel.
Each Pod must obtain an application certificate before its traffic can use the tunnel.
Same-node Pod traffic can remain unencrypted without indicating a WireGuard failure.
Traffic from a Pod to an arbitrary external website is necessarily protected all the way to that website.
A
Cilium WireGuard protects the configured inter-node path, and same-node packets are not encrypted by that mechanism, so unencrypted same-node traffic does not indicate a failure. It does not require application certificates, convert HTTP to HTTPS, or automatically extend its tunnel to arbitrary external websites.
Service Mesh
13
Select Two
C
An application team adopts Cilium's sidecarless HTTP policy enforcement. It observes that application Pods have no injected proxy container, but selected HTTP traffic is still processed by a proxy.
Which explanation matches Cilium's architecture?
HTTP requests are evaluated by the Cilium operator before being sent to application nodes.
Each application process loads a proxy library supplied through the CNI plugin.
Selected traffic is redirected to a node-local Envoy instance rather than a per-Pod sidecar.
HTTP requests are sent to Hubble Relay, which evaluates them before returning a verdict.
C
Cilium redirects selected Layer 7 traffic to node-local Envoy. Envoy can run in the agent Pod or as a separate DaemonSet, rather than as a sidecar in every application Pod. The operator and Hubble Relay are not HTTP enforcement proxies.
Service Mesh
12
Select One
A platform team operates a shared external entry point using Cilium's Gateway API implementation. Application teams should manage their own HTTP routing rules, but should not control the shared listener configuration.
Which resource arrangement best supports this separation?
Application teams manage GatewayClass resources, while the platform team manages HTTPRoutes.
The platform team manages the Gateway, while application teams attach permitted HTTPRoutes.
Application teams manage the shared Gateway, while the platform team manages backend Deployments.
The platform team manages Services, while application teams configure listeners through Service labels.
B
Gateway API separates shared listener configuration from application routing. The platform can manage the Gateway and permitted route attachment, while application teams manage HTTPRoutes. GatewayClass selects implementation behavior, and Service labels do not configure Gateway listeners.
Service Mesh
11
Select One
A workload must call api.partner.example on HTTPS. The endpoint's IP addresses change over time.
The workload is already under egress default-deny. It uses the cluster DNS service, and the team wants Cilium to learn the endpoint addresses from DNS responses instead of maintaining a manual IP list.
Which TWO policy elements are needed for this design?
Permit the relevant DNS queries to the trusted cluster resolver through Cilium's DNS proxy.
Permit TCP port 443 to the cluster DNS service's endpoint addresses.
Permit TCP port 443 to the world entity and use DNS logs to identify the requested hostname.
Allow the hostname through toFQDNs with a TCP port 443 restriction.
A
DNS proxy processing lets Cilium learn addresses associated with the hostname, and the toFQDNs rule then permits connections to learned addresses on the specified port. HTTPS access to the DNS server does not reach the partner, and the world entity unnecessarily broadens access. This is DNS-derived IP authorization, not HTTP hostname or URL-path verification.
Network Policy
10
Select Two
D
A test cluster uses Cilium's always policy-enforcement mode. An application Pod has no policy allowing ingress, and new inbound connections are blocked.
The team wants Pods with no selecting policies to remain unrestricted, while retaining enforcement for Pods selected by restrictive policies.
Which change meets this requirement?
Retain always mode and enable additional Hubble flow reporting.
Switch to never mode and keep the existing policy objects.
Retain always mode and restart Pods that have no selecting policies.
Switch to default mode and retain the intended workload policies.
D
In default mode, endpoints remain unrestricted until selected by applicable policy, subject to the policy's directional settings. The always mode enables enforcement even without selecting rules, and the never mode disables enforcement, including for selected endpoints. Monitoring or restarts do not change these semantics.
Network Policy
9
Select One
A team wants frontend Pods to call only GET /catalog on an API's plaintext HTTP port 8080.
A CiliumNetworkPolicy contains the intended HTTP rule. However, an existing Kubernetes NetworkPolicy also permits the same frontend Pods to access the API on TCP port 8080 without an HTTP restriction. Requests to other paths still succeed.
Which change most directly establishes the intended restriction?
Remove or narrow the overlapping unrestricted allow rule for the same traffic.
Reapply the HTTP policy after the Kubernetes NetworkPolicy so it is evaluated last.
Place the HTTP policy in a separate object with a more specific resource name.
Add the frontend selector to the HTTP policy a second time to increase its precedence.
A
Allow rules are additive. An overlapping unrestricted L4 allow permits traffic that the narrower HTTP rule was intended to constrain. Applying policies later, changing names, or repeating selectors does not give the HTTP rule precedence.
Network Policy
8
Select One
Two ingress policies select a server:
- An allow policy permits Pods labeled role=frontend or role=monitor to connect on TCP ports 8080 and 8443.
- An explicit deny policy blocks Pods labeled role=frontend from connecting on TCP port 8080.
The client roles are distinct. Client egress is permitted, and there are no other applicable policies.
Which TWO statements are correct for new connections?
Frontend connections to port 8080 are permitted because the allow policy lists that port.
Frontend connections to port 8443 remain permitted.
Monitor connections to port 8080 remain permitted.
A more narrowly scoped frontend allow rule can override the deny on port 8080.
B
The explicit deny overrides the matching allow for frontend traffic to port 8080, but it does not block frontend traffic to port 8443 or any monitor traffic. A narrower allow cannot override a matching Cilium deny rule.
Network Policy
7
Select Two
C
Cilium uses its default policy-enforcement mode. The following is the only policy selecting the app=api Pods in the shop namespace. There are no other policies affecting the clients, and network connectivity is otherwise working.
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
name: api-access
namespace: shop
spec:
endpointSelector:
matchLabels:
app: api
ingress:
- fromEndpoints:
- matchLabels:
app: frontend
toPorts:
- ports:
- port: "8080"
protocol: TCP
Which statement correctly describes its effect?
Any Pod in shop can initiate connections to the API on TCP port 8080.
Frontend Pods can initiate connections to every TCP port exposed by the API.
Matching frontend Pods can reach API port 8080; this policy does not restrict API-initiated egress.
Matching frontend Pods can reach API port 8080; the API also enters default-deny for egress.
C
The policy selects API endpoints and restricts their ingress to matching frontend endpoints on TCP port 8080. Default-deny is directional: this ingress-only policy does not restrict API-initiated egress. It neither permits all sources nor opens every destination port.
Network Policy
6
Select One
A Cilium policy allows workloads labeled role=frontend to connect to workloads labeled role=backend. A frontend Pod is replaced and receives a different IP address.
Its security-relevant labels remain unchanged, and Cilium has completed endpoint initialization.
Why can the existing policy continue to authorize the replacement Pod?
Cilium derives workload security identities from labels rather than binding the policy to the old Pod IP.
Kubernetes retains the old Pod IP as a temporary alias until all existing network policies expire.
The frontend Service transfers the previous Pod's connection permissions to each replacement endpoint.
Cilium grants new Pods temporary access while it rewrites the policy with their assigned addresses.
A
Cilium separates security identity from network addressing. Relevant labels determine policy identity, allowing a replacement workload to retain the intended authorization despite an IP change. Services do not transfer permissions, and initialization does not grant temporary unrestricted access.
Architecture
5
Select One
A team plans to use Cilium native routing for cross-node Pod traffic. It has assigned non-overlapping PodCIDRs and confirmed that network policy permits the intended traffic.
Which TWO routing conditions must also be satisfied?
The network between nodes must be able to forward traffic addressed to the PodCIDRs.
Every node must establish a BGP session directly with every other worker node.
The nodes must establish VXLAN tunnels before native Pod routes can be used.
Each node's routing configuration must provide a path toward remote Pod addresses.
A
Native routing requires the underlying network to forward Pod-addressed traffic and each node to have a usable route toward remote Pods. BGP is one possible routing mechanism, not a mandatory full mesh, and VXLAN tunnels are not an inherent native-routing requirement.
Architecture
4
Select Two
D
A cluster uses Cilium cluster-pool IPAM. Existing nodes have assigned PodCIDRs and can create Pods. A newly added node cannot allocate Pod addresses, and its CiliumNode resource has no assigned PodCIDR.
Which investigation most directly addresses the missing allocation?
Inspect the new node's Kubernetes Service range and kube-proxy service rules.
Inspect the Cilium operator's IPAM status and the available cluster-pool ranges.
Inspect CoreDNS address records and the new node's resolver configuration.
Inspect Hubble Relay's node discovery and the new node's flow-reporting status.
B
In cluster-pool IPAM, the Cilium operator assigns per-node PodCIDRs through CiliumNode resources, and the agent then allocates addresses locally. Service ranges, DNS records, and flow aggregation do not provide this missing allocation.
Architecture
3
Select One
A company is installing Cilium across worker nodes in several routed subnets. The nodes can reach one another, and the network permits the required tunnel traffic. However, the underlying routers do not have routes for Pod address ranges.
The team wants cross-node Pod connectivity without adding Pod routes to those routers.
Which datapath choice best fits these constraints?
Native routing with a larger Pod allocation pool for each worker node.
Native routing with direct node routes limited to each local Layer 2 segment.
Native routing with service-address translation enabled for cross-node traffic.
Encapsulation using VXLAN or Geneve between the participating worker nodes.
D
Encapsulation carries cross-node traffic over the existing node network without requiring the underlay to route PodCIDRs. Native routing requires a valid path for Pod addresses. A larger allocation pool, local-segment routes, or Service translation does not supply the missing cross-subnet Pod routing.
Architecture
2
Select One
A new network policy appears in the Kubernetes API, but endpoints on one worker node continue using their previous policy configuration. Endpoints on other nodes have updated successfully.
Which component is primarily responsible for processing the policy and managing its enforcement on the affected node?
The Cilium operator, which makes each endpoint's packet-forwarding decisions centrally.
Hubble Relay, which distributes policy changes to the nodes supplying flow records.
The Cilium agent, which manages the node's endpoint configuration and eBPF datapath.
The CNI plugin, which continuously watches policies after completing Pod network setup.
C
The node-local Cilium agent processes configuration and manages the eBPF datapath. The operator handles cluster-wide responsibilities, not individual forwarding decisions. Hubble Relay aggregates observations. The CNI plugin participates in Pod network setup and teardown rather than continuously reconciling policy.
Architecture
1
Select One
.png)
.svg)
