PracticeVideosBlogFlashcardsEspañol
All Practice Exams

100+ Free Cilium Certified Associate Practice Questions

Prepare for the Cilium Certified Associate (CCA) exam with instant access — no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately
100+ Questions
100% Free

Loading practice questions...

Same family resources

Explore More Linux Foundation Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

Linux Foundation Certified System Administrator (LFCS)

Practice Questions

Besu Certified Professional (BCP)

Practice Questions

Certified Backstage Associate (CBA)

Practice Questions

Certified Open Source Developer for Enterprise (CODE)

Practice Questions

FCFP FINOS Certified FDC3 Practitioner

Practice Questions

FinOps Certified Engineer (FOCE)

Practice Questions
2026 Statistics

Key Facts: Cilium Certified Associate Exam

$250

Exam Fee (USD, includes one free retake)

CNCF / The Linux Foundation

90 min

Exam Duration

The Linux Foundation

8 domains

Blueprint Domains

The Linux Foundation

20%

Largest Domain (Architecture)

The Linux Foundation

2 years

Certification Validity

The Linux Foundation

Multiple-choice

Exam Format (online proctored)

CNCF / The Linux Foundation

The Cilium Certified Associate (CCA) is an online, proctored, multiple-choice exam from CNCF and The Linux Foundation. It costs $250 USD (including one free retake), runs 90 minutes, and the credential is valid for 2 years; the passing score is not officially published. The eight domains are Architecture (20%), Network Policy (18%), Service Mesh (16%), Network Observability (10%), Installation and Configuration (10%), Cluster Mesh (10%), eBPF (10%), and BGP and External Networking (6%).

Sample Cilium Certified Associate Practice Questions

Try these sample questions to test your Cilium Certified Associate exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1What in-kernel technology does Cilium use as the foundation of its datapath for networking, load balancing, and security enforcement?
A.eBPF (extended Berkeley Packet Filter)
B.iptables chains managed by kube-proxy
C.Open vSwitch with OpenFlow rules
D.A userspace proxy that intercepts every packet
Explanation: Cilium is built on eBPF, which lets it run sandboxed programs inside the Linux kernel at hook points such as the network device, socket, and traffic control layers. This in-kernel datapath provides high-performance L3-L7 networking, load balancing, and policy enforcement without the per-packet overhead of long iptables chains.
2Which Cilium component runs as a DaemonSet on every node and is responsible for loading eBPF programs and enforcing network policy locally?
A.cilium-operator
B.cilium-agent
C.clustermesh-apiserver
D.Hubble Relay
Explanation: The cilium-agent runs as a DaemonSet pod on each node, where it manages endpoints, compiles and loads eBPF programs into the kernel, and enforces network policy for pods on that node. It also handles per-node IP allocation tasks and reports endpoint state.
3What is the primary responsibility of the cilium-operator in a Cilium deployment?
A.Loading eBPF bytecode into the kernel on each worker node
B.Terminating TLS for every pod-to-pod connection
C.Cluster-wide tasks such as IPAM coordination, CRD registration, and garbage collection of stale resources
D.Replacing the Kubernetes API server
Explanation: The cilium-operator handles cluster-scoped duties that should not be duplicated on every node: coordinating IP address management (especially in cloud IPAM modes), registering Cilium CRDs, garbage-collecting orphaned CiliumEndpoint and identity objects, and translating Ingress/Gateway API resources. It is not on the per-packet datapath, so a brief operator outage does not stop existing traffic.
4In Cilium, what does a CiliumEndpoint represent?
A.A physical network interface on a node
B.A BGP peering session with an external router
C.A cluster-wide load balancer virtual IP
D.The networking identity and state of a single workload such as a pod
Explanation: A CiliumEndpoint is a custom resource created by the cilium-agent for each managed workload (typically a pod), capturing its IP addresses, security identity, and policy enforcement state. Cilium attaches eBPF programs to the endpoint's network interface to provide connectivity and enforce policy.
5Cilium's security model is described as identity-based rather than IP-based. What does the security identity primarily derive from?
A.The set of labels assigned to the workload
B.The pod's IP address and subnet
C.The node's hostname where the pod runs
D.The container image digest
Explanation: Cilium assigns each workload a numeric security identity derived from its set of labels (for example, the Kubernetes labels on a pod). Policy is enforced against these identities rather than ephemeral pod IPs, so security rules remain stable even as pods are rescheduled and IPs change.
6Which two routing modes does Cilium support for moving traffic between pods on different nodes?
A.Source NAT only and destination NAT only
B.Overlay (tunneling) and native (direct) routing
C.Layer 2 bridging and ARP proxying exclusively
D.DNS round-robin and IPVS hashing
Explanation: Cilium offers overlay (encapsulation) routing using VXLAN or Geneve tunnels, and native (direct) routing where packets are placed on the network without encapsulation. Overlay maximizes portability across environments, while native routing minimizes latency and overhead by relying on the underlying network's routing.
7In Cilium's overlay routing mode, which encapsulation protocols are supported by default for tunneling pod traffic between nodes?
A.GRE and IP-in-IP
B.MPLS and L2TP
C.VXLAN and Geneve
D.PPTP and SSTP
Explanation: Cilium's tunnel (overlay) routing mode encapsulates pod traffic using VXLAN by default, with Geneve available as an alternative tunnel protocol. Encapsulation hides the pod network from the underlying infrastructure, simplifying deployment across heterogeneous networks at the cost of some per-packet overhead.
8Which statement best describes IP Address Management (IPAM) in Cilium?
A.Cilium can only use the Kubernetes host-scope podCIDR and nothing else
B.IPAM is handled entirely by kube-proxy
C.Cilium assigns the same IP to every pod on a node
D.Cilium supports multiple IPAM modes including Cluster Pool (default), Kubernetes host-scope, and cloud-provider modes like AWS ENI and Azure
Explanation: Cilium provides several IPAM backends. Cluster Pool is the default, where the operator carves per-node CIDRs from a cluster-wide pool; Kubernetes host-scope uses the node's podCIDR; and cloud modes such as AWS ENI and Azure allocate provider-native IPs directly to pods. Choosing the right mode affects routing, scale, and IP exhaustion behavior.
9What is the default Cluster Pool IPAM behavior in Cilium?
A.The cilium-operator allocates a per-node PodCIDR from a cluster-wide pool and the agent assigns pod IPs from it
B.Each pod requests an IP directly from the cloud provider's API
C.Pods use the host node's IP address with port mapping
D.IP addresses are statically assigned by an administrator per pod
Explanation: In Cluster Pool IPAM (the default), the cilium-operator partitions a configured cluster-wide CIDR into smaller per-node PodCIDRs, recorded on each CiliumNode resource. The local cilium-agent then hands out individual pod IPs from its node's allocated block, decoupling Cilium from the Kubernetes controller-manager's IPAM.
10Cilium provides what kind of network topology to Kubernetes workloads?
A.A strictly Layer 2 broadcast domain per namespace
B.A flat Layer 3 network that can span multiple clusters
C.A NAT-only network with no direct pod-to-pod routing
D.A separate VLAN for every individual pod
Explanation: Cilium delivers a simple flat Layer 3 network in which every pod is directly addressable and can communicate across nodes, and with Cluster Mesh this flat network can span multiple clusters. This L3 model underpins identity-based policy and efficient eBPF load balancing.

About the Cilium Certified Associate Exam

The Cilium Certified Associate (CCA) confirms a candidate's knowledge of connecting, securing, and observing Kubernetes clusters using Cilium. It is an entry-level CNCF certification administered by The Linux Foundation, designed for platform and cloud engineers interested in cloud-native networking, security, and observability. The blueprint spans Cilium's eBPF-based architecture, identity-based CiliumNetworkPolicy, the sidecarless service mesh with Ingress and Gateway API, Hubble observability, installation and configuration via the Cilium CLI, multi-cluster Cluster Mesh, eBPF fundamentals, and BGP and external networking. The exam is multiple-choice and conceptual, so candidates need a clear understanding of how Cilium works and why it is used rather than deep kernel programming.

Assessment

Question count not published by the exam provider

Time Limit

90 minutes

Passing Score

Not officially published

Exam Fee

$250 (CNCF / The Linux Foundation)

Cilium Certified Associate Exam Content Outline

20%

Architecture

Understand Cilium's role in Kubernetes, the responsibilities of the cilium-agent, cilium-operator, Envoy, Hubble, and the CNI plugin, the eBPF datapath, IPAM modes (Cluster Pool, Kubernetes host-scope, AWS ENI, Azure), overlay vs native routing, and the identity-based security model.

18%

Network Policy

Interpret CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy, apply identity-based security, configure default-deny enforcement, use endpointSelector and from/to selectors (fromEndpoints, toFQDNs, entities), enforce L7 HTTP and DNS rules, and compare Cilium policy with native Kubernetes NetworkPolicy.

16%

Service Mesh

Use Ingress and the Gateway API for L7 routing, understand the benefits of Gateway API over Ingress, implement traffic splitting and mutual authentication, encrypt traffic in transit with WireGuard or IPsec, and contrast sidecar-based with Cilium's sidecarless mesh backed by per-node Envoy.

10%

Network Observability

Use Hubble to observe network flows and security events, enable Layer 7 protocol visibility, run the Hubble CLI (hubble observe with verdict and pod filters) and the Hubble UI service map, and export Hubble metrics for dashboards and alerting.

10%

Installation and Configuration

Install Cilium with the Cilium CLI or Helm, query and modify configuration through the cilium-config ConfigMap, validate the deployment with cilium connectivity test, and monitor health with cilium status.

10%

Cluster Mesh

Explain the benefits of Cluster Mesh for multi-cluster connectivity, the role of the clustermesh-apiserver and KVStoreMesh, global services and service affinity for cross-cluster load balancing, non-overlapping addressing requirements, and cross-cluster network policy.

10%

eBPF

Describe the role and benefits of eBPF in Cilium, in-kernel execution at hooks such as tc and XDP, the eBPF verifier and eBPF maps, and why hash-table-based eBPF load balancing and policy scale better than linear iptables rule chains.

6%

BGP and External Networking

Understand egress connectivity and masquerading, the Cilium BGP control plane and route advertisement, LB IPAM and L2 announcements for bare-metal services, and the Egress Gateway for predictable egress source IPs.

How to Pass the Cilium Certified Associate Exam

What You Need to Know

  • Passing score: Not officially published
  • Assessment: Question count not published by the exam provider
  • Time limit: 90 minutes
  • Exam fee: $250

Keys to Passing

  • Work through all 100 available questions
  • Review every answer and explanation
  • Track weak areas and revisit them
  • Use our AI tutor for tough concepts

Cilium Certified Associate Study Tips from Top Performers

1Master the component roles first: cilium-agent (per-node eBPF and policy), cilium-operator (cluster-wide IPAM and CRDs), Envoy (L7), Hubble (observability), and the CNI plugin (pod lifecycle).
2Understand identity-based security deeply, since it underpins both Architecture and Network Policy: identities derive from labels, so policy survives pod IP churn.
3Practice reading CiliumNetworkPolicy YAML, especially endpointSelector, fromEndpoints, toFQDNs, entities (world/host/remote-node/cluster), and L7 HTTP rules, plus default-deny behavior.
4Know the two routing modes (overlay VXLAN/Geneve vs native) and the IPAM modes (Cluster Pool default, Kubernetes host-scope, AWS ENI, Azure) and their trade-offs.
5Be fluent in the Cilium CLI workflow: cilium install, cilium status, cilium connectivity test, cilium hubble enable, and hubble observe with --verdict and --pod filters.
6Review eBPF fundamentals (in-kernel execution, the verifier, eBPF maps, XDP) and why eBPF scales better than iptables, plus Cluster Mesh global services and BGP/Egress Gateway basics for the smaller domains.

Frequently Asked Questions

What are the key facts about the CCA exam?

The Cilium Certified Associate (CCA) is an online, proctored, multiple-choice exam from CNCF and The Linux Foundation. It costs $250 USD including one free retake, lasts 90 minutes, and the certification is valid for 2 years. The passing score is not officially published.

What does the CCA exam cover?

The CCA covers eight domains: Architecture (20%), Network Policy (18%), Service Mesh (16%), Network Observability (10%), Installation and Configuration (10%), Cluster Mesh (10%), eBPF (10%), and BGP and External Networking (6%).

Is the CCA a hands-on exam?

No. Unlike performance-based exams such as the CKA, the CCA is a multiple-choice, conceptual, and scenario-based exam. It tests your understanding of how Cilium works and why it is used rather than requiring you to run commands in a live cluster.

Are there prerequisites for the CCA?

There are no formal prerequisites, but The Linux Foundation recommends basic Kubernetes and networking knowledge, including the OSI model and protocols such as TCP, UDP, DNS, and HTTP. Candidates with KCNA, CKA, or CKAD are ideal.

How much does the CCA cost and can I retake it?

The CCA costs $250 USD and includes two attempts, so one free retake is available. Candidates have 12 months from registration to schedule and take the exam.

What technology underpins Cilium and the CCA?

Cilium is built on eBPF, which runs sandboxed programs in the Linux kernel to provide high-performance networking, identity-based security, kube-proxy replacement, and Hubble observability without long iptables rule chains.