Cilium eBPF Quiz
Supported Version: Cilium 1.17, Linux Kernel 4.19+ Last Updated: February 22, 2026
eBPF Basic Concepts
What does eBPF stand for?
- A) Extended Berkeley Packet Filter
- B) Enhanced Berkeley Process Filter
- C) Extended Binary Processing Framework
- D) Enhanced Backend Processing Function
Show Answer
Answer: A) Extended Berkeley Packet Filter
Explanation: eBPF stands for Extended Berkeley Packet Filter, which is an extension of the original BPF technology.
Where do eBPF programs execute?
- A) User Space
- B) Kernel Space
- C) Hypervisor
- D) Container Runtime
Show Answer
Answer: B) Kernel Space
Explanation: eBPF programs run safely inside the Linux kernel.
What mechanism ensures the safety of eBPF programs?
- A) Sandbox
- B) Virtual Machine
- C) Static Verifier
- D) Containerization
Show Answer
Answer: C) Static Verifier
Explanation: The eBPF verifier checks program safety before it is loaded to prevent infinite loops or kernel crashes.
What are the kernel events that eBPF programs can attach to called?
- A) Triggers
- B) Hooks
- C) Event Listeners
- D) Callbacks
Show Answer
Answer: B) Hooks
Explanation: eBPF programs are attached to various hook points in the kernel and execute when events occur.
What is used for data sharing between eBPF programs and user space applications?
- A) Shared Memory
- B) Pipes
- C) BPF Maps
- D) Sockets
Show Answer
Answer: C) BPF Maps
Explanation: BPF Maps are key-value stores used to share data between eBPF programs and user space applications.
eBPF and Cilium
What is the main reason Cilium uses eBPF?
- A) Implementing networking features without kernel modules
- B) Providing a better user interface
- C) Using less memory
- D) Easier installation process
Show Answer
Answer: A) Implementing networking features without kernel modules
Explanation: Cilium uses eBPF to implement high-performance networking, load balancing, security policies, and other features without kernel modules.
Which is NOT a feature implemented using eBPF in Cilium?
- A) Network policy enforcement
- B) Service load balancing
- C) Network packet encryption
- D) User authentication
Show Answer
Answer: D) User authentication
Explanation: Cilium uses eBPF to implement network policy enforcement, service load balancing, and network packet processing, but user authentication is typically handled by other systems.
Which eBPF feature does Cilium use to replace kube-proxy?
- A) XDP (eXpress Data Path)
- B) TC (Traffic Control) BPF
- C) Socket BPF
- D) Tracing BPF
Show Answer
Answer: B) TC (Traffic Control) BPF
Explanation: Cilium primarily uses TC (Traffic Control) BPF programs to replace kube-proxy's service load balancing functionality.
Why is Cilium's eBPF-based load balancing superior to kube-proxy?
- A) Supports more service types
- B) Better user interface
- C) Lower latency and higher throughput
- D) Easier configuration
Show Answer
Answer: C) Lower latency and higher throughput
Explanation: Cilium's eBPF-based load balancing processes packets directly in kernel space, providing lower latency and higher throughput.
Which is NOT a metric collected using eBPF in Cilium?
- A) Network connection status
- B) Packet drop reasons
- C) Service response time
- D) User login time
Show Answer
Answer: D) User login time
Explanation: Cilium uses eBPF to collect network-related metrics such as network connection status, packet drop reasons, and service response time, but does not collect application-level metrics like user login time.
eBPF Programming
What language is primarily used to write eBPF programs?
- A) Python
- B) Go
- C) C
- D) Rust
Show Answer
Answer: C) C
Explanation: eBPF programs are primarily written in C and compiled to eBPF bytecode using the LLVM compiler.
Which is NOT a framework for developing eBPF programs?
- A) BCC (BPF Compiler Collection)
- B) libbpf
- C) bpftrace
- D) libpcap
Show Answer
Answer: D) libpcap
Explanation: libpcap is a packet capture library and is not a framework for eBPF program development. BCC, libbpf, and bpftrace are all frameworks for developing eBPF programs.
Which is NOT a type of eBPF map?
- A) Hash Map
- B) Array Map
- C) LRU Map
- D) Graph Map
Show Answer
Answer: D) Graph Map
Explanation: eBPF supports various types of maps including hash maps, array maps, and LRU maps, but does not support graph maps.
What is the maximum number of instructions in an eBPF program?
- A) 1,000
- B) 4,096
- C) 10,000
- D) Unlimited
Show Answer
Answer: B) 4,096
Explanation: eBPF programs are limited to a maximum of 4,096 instructions. This is a limit to ensure safety.
What system call is used to load eBPF programs into the kernel?
- A) bpf()
- B) ebpf()
- C) sysfs()
- D) ioctl()
Show Answer
Answer: A) bpf()
Explanation: The bpf() system call is used to load eBPF programs into the kernel and to create and access eBPF maps.
eBPF Performance and Monitoring
What is the main benefit provided by XDP (eXpress Data Path)?
- A) Better security
- B) Easier programming
- C) Lower latency
- D) Higher compatibility
Show Answer
Answer: C) Lower latency
Explanation: XDP processes packets at the network driver level, bypassing the kernel networking stack to provide very low latency.
What tool is used to monitor the performance of eBPF programs in Cilium?
- A) top
- B) bpftool
- C) htop
- D) iotop
Show Answer
Answer: B) bpftool
Explanation: bpftool is a tool used to inspect and manage eBPF programs and maps, and is also used for performance monitoring.
What is Cilium's eBPF-based network monitoring tool?
- A) Prometheus
- B) Hubble
- C) Grafana
- D) Jaeger
Show Answer
Answer: B) Hubble
Explanation: Hubble is Cilium's eBPF-based network monitoring tool that can observe and analyze network flows in real-time.
What tool is used to find performance bottlenecks in eBPF programs?
- A) strace
- B) ltrace
- C) perf
- D) gdb
Show Answer
Answer: C) perf
Explanation: perf is a Linux performance analysis tool used to find performance bottlenecks in eBPF programs.
What command is used for debugging eBPF programs in Cilium?
- A)
cilium bpf - B)
cilium debug - C)
cilium monitor - D)
cilium trace
Show Answer
Answer: A) `cilium bpf`
Explanation: The `cilium bpf` command is used to inspect and debug Cilium's eBPF programs and maps.
- A)