Cilium IPAM and Network Policy Quiz
Supported Version: Cilium 1.17 Last Updated: February 22, 2026
IPAM (IP Address Management)
What is Cilium's default IPAM mode?
- A) Kubernetes Host Scope
- B) Cluster Scope
- C) CRD-based
- D) AWS ENI
Show Answer
Answer: B) Cluster Scope
Explanation: Cilium's default IPAM mode is Cluster Scope, which allocates IP addresses centrally across the entire cluster.
Which Cilium IPAM mode has each node allocate IPs from its own CIDR range?
- A) Cluster Scope
- B) Kubernetes Host Scope
- C) CRD-based
- D) AWS ENI
Show Answer
Answer: B) Kubernetes Host Scope
Explanation: In Kubernetes Host Scope IPAM mode, each node allocates IP addresses from its own CIDR range.
What is the recommended IPAM mode when using Cilium on AWS EKS?
- A) Kubernetes Host Scope
- B) Cluster Scope
- C) AWS ENI
- D) CRD-based
Show Answer
Answer: C) AWS ENI
Explanation: On AWS EKS, it is recommended to use AWS ENI IPAM mode to directly allocate VPC IP addresses to Pods.
What Kubernetes feature does Cilium's 'PodCIDR' IPAM mode utilize?
- A) NodeSpec.PodCIDR
- B) NodeSpec.CIDR
- C) NodeSpec.Subnet
- D) NodeSpec.IPRange
Show Answer
Answer: A) NodeSpec.PodCIDR
Explanation: Cilium's PodCIDR IPAM mode utilizes the NodeSpec.PodCIDR field that Kubernetes assigns to each node.
What command is used to check Cilium's IPAM configuration?
- A)
cilium status --ipam - B)
cilium ipam - C)
cilium config get ipam - D)
kubectl -n kube-system get configmap cilium-config -o yaml | grep -E 'ipam|allocator'
Show Answer
Answer: D) `kubectl -n kube-system get configmap cilium-config -o yaml | grep -E 'ipam|allocator'`
Explanation: Cilium's IPAM configuration is stored in the cilium-config ConfigMap and can be verified with this command.
- A)
Network Policy Basics
What is the API version of Cilium NetworkPolicy?
- A) networking.k8s.io/v1
- B) cilium.io/v1
- C) cilium.io/v2
- D) policy.cilium.io/v1
Show Answer
Answer: C) cilium.io/v2
Explanation: Cilium NetworkPolicy uses the cilium.io/v2 API version.
What is the role of 'endpointSelector' in Cilium NetworkPolicy?
- A) Select target Pods for policy application
- B) Select target nodes for policy application
- C) Select target namespaces for policy application
- D) Select target services for policy application
Show Answer
Answer: A) Select target Pods for policy application
Explanation: endpointSelector is used to select the target Pods (endpoints) to which the policy applies.
What does the 'ingress' rule control in Cilium NetworkPolicy?
- A) Traffic coming into the selected Pods
- B) Traffic going out from the selected Pods
- C) Traffic within the selected Pods
- D) Traffic to outside the cluster
Show Answer
Answer: A) Traffic coming into the selected Pods
Explanation: Ingress rules control traffic coming into the selected Pods.
What does the 'egress' rule control in Cilium NetworkPolicy?
- A) Traffic coming into the selected Pods
- B) Traffic going out from the selected Pods
- C) Traffic within the selected Pods
- D) Traffic from outside the cluster
Show Answer
Answer: B) Traffic going out from the selected Pods
Explanation: Egress rules control traffic going out from the selected Pods.
What is the role of the 'labels' field in Cilium NetworkPolicy?
- A) Select Pods for policy application
- B) Identifier for the policy itself
- C) Select namespaces for policy application
- D) Select nodes for policy application
Show Answer
Answer: B) Identifier for the policy itself
Explanation: The labels field is used as an identifier for the policy itself and is used when other policies reference this policy.
Advanced Network Policy
What does the 'toCIDR' rule in Cilium NetworkPolicy allow?
- A) Traffic to specific IP address ranges
- B) Traffic to specific domain names
- C) Traffic to specific services
- D) Traffic to specific ports
Show Answer
Answer: A) Traffic to specific IP address ranges
Explanation: The toCIDR rule is used to allow traffic to specific IP address ranges (CIDR notation).
What does the 'toFQDNs' rule in Cilium NetworkPolicy allow?
- A) Traffic to specific IP addresses
- B) Traffic to specific ports
- C) Traffic to specific domain names
- D) Traffic of specific protocols
Show Answer
Answer: C) Traffic to specific domain names
Explanation: The toFQDNs rule allows traffic to specific domain names (FQDNs), with Cilium monitoring DNS lookups to dynamically allow IP addresses for those domains.
What does the 'world' entity mean in the 'toEntities' rule of Cilium NetworkPolicy?
- A) All internal cluster endpoints
- B) All external networks
- C) All nodes
- D) All namespaces
Show Answer
Answer: B) All external networks
Explanation: The 'world' entity refers to all networks outside the cluster.
What does the 'toServices' rule in Cilium NetworkPolicy allow?
- A) Traffic to specific Kubernetes services
- B) Traffic to specific external services
- C) Traffic to specific ports
- D) Traffic of specific protocols
Show Answer
Answer: A) Traffic to specific Kubernetes services
Explanation: The toServices rule is used to allow traffic to specific Kubernetes services.
What is the role of 'nodeSelector' in Cilium NetworkPolicy?
- A) Select target Pods for policy application
- B) Select target nodes for policy application
- C) Select target namespaces for policy application
- D) Select target services for policy application
Show Answer
Answer: B) Select target nodes for policy application
Explanation: nodeSelector is used to select the target nodes to which the policy applies.
L7 Policy
What attributes can be filtered in Cilium's L7 HTTP policy?
- A) Path
- B) Method
- C) Headers
- D) All of the above
Show Answer
Answer: D) All of the above
Explanation: Cilium's L7 HTTP policy can filter various HTTP request attributes including path, method, and headers.
What attributes can be filtered in Cilium's L7 Kafka policy?
- A) Topic
- B) API Key
- C) Client ID
- D) All of the above
Show Answer
Answer: D) All of the above
Explanation: Cilium's L7 Kafka policy can filter various Kafka request attributes including topic, API key, and client ID.
What does the 'matchPattern' rule in Cilium's L7 DNS policy allow?
- A) Exact domain name matching
- B) Domain name pattern matching with wildcards
- C) IP address matching
- D) Port number matching
Show Answer
Answer: B) Domain name pattern matching with wildcards
Explanation: The matchPattern rule can match domain name patterns including wildcards (*). Example: *.example.com
What attributes can be filtered in Cilium's L7 gRPC policy?
- A) Method name
- B) Service name
- C) Metadata
- D) All of the above
Show Answer
Answer: D) All of the above
Explanation: Cilium's L7 gRPC policy can filter various gRPC request attributes including method name, service name, and metadata.
What component is required to apply Cilium's L7 policy?
- A) kube-proxy
- B) Envoy Proxy
- C) NGINX Ingress Controller
- D) HAProxy
Show Answer
Answer: B) Envoy Proxy
Explanation: Cilium uses Envoy Proxy to apply L7 policies.