Cilium Security and Visibility Quiz
Review baseline: Cilium 1.20.1; Hubble CLI 1.19.4. Last reviewed: September 12, 2026.
Network Policy Basics
How does CiliumNetworkPolicy extend standard Kubernetes NetworkPolicy?
- A) It cannot select Pods
- B) It can add supported L7 protocol rules
- C) It only protects nodes
- D) It guarantees lower latency
Show Answer
Answer: B) It can add supported L7 protocol rules
Standard NetworkPolicy controls L3/L4 connectivity. Cilium adds capabilities such as HTTP and DNS policy; performance is not guaranteed by the API choice.
Which API version is used for CiliumNetworkPolicy?
- A) networking.k8s.io/v1
- B) cilium.io/v2
- C) policy.cilium.io/v1
- D) network.cilium.io/v1
Show Answer
Answer: B) cilium.io/v2
The group is cilium.io and the served policy version used in this chapter is v2.
What does endpointSelector select in a namespaced CiliumNetworkPolicy?
- A) Matching endpoints in the policy namespace
- B) All Kubernetes nodes
- C) The Prometheus server
- D) Only LoadBalancer Services
Show Answer
Answer: A) Matching endpoints in the policy namespace
It identifies the endpoints governed by the policy. Node policies use the separate clusterwide nodeSelector mechanism.
For a standard NetworkPolicy with policyTypes: [Ingress], which value contains no ingress allow rules?
- A) ingress: [{}]
- B) ingress: []
- C) ingress: [{from: [{}]}]
- D) An allow rule for all source addresses
Show Answer
Answer: B) ingress: []
An empty list supplies no allow rule; an empty rule object allows all ingress. Other applicable allow policies remain additive.
Which direction does egress policy control for selected Pods?
- A) Incoming connections only
- B) Outgoing connections
- C) Only traffic inside a process
- D) Only the API server's responses
Show Answer
Answer: B) Outgoing connections
Egress controls outbound connectivity. An isolated Pod needs explicit allowances for dependencies such as its real DNS resolver.
L7 Policies
Which is not a request match field in Cilium HTTP policy?
- A) Path
- B) Method
- C) Headers
- D) Response latency
Show Answer
Answer: D) Response latency
HTTP policy matches supported request attributes. Observing response duration does not make latency an HTTP allow-rule field.
What is needed for the illustrated toFQDNs policy to learn DNS answers?
- A) Only a TCP 443 rule
- B) Only an arbitrary external IP
- C) A reachable resolver and matching DNS proxy rules
- D) A Kafka topic rule
Show Answer
Answer: C) A reachable resolver and matching DNS proxy rules
DNS allowance/proxy observation and subsequent destination-IP allowance are distinct. The example covers UDP and TCP DNS to verified resolver endpoints.
What does DNS matchPattern provide?
- A) Port allocation
- B) Domain-name wildcard matching
- C) JWT signature validation
- D) Automatic malicious-domain reputation
Show Answer
Answer: B) Domain-name wildcard matching
It matches query/domain names with supported wildcard syntax. It does not fetch a threat-intelligence feed.
Which proxy implements the HTTP rules discussed here?
- A) kube-proxy
- B) Envoy
- C) Prometheus
- D) Hubble Relay
Show Answer
Answer: B) Envoy
Cilium integrates Envoy for HTTP policy. DNS policy uses the DNS proxy, so not every L7 rule should be described as an Envoy rule.
Which former Cilium L7 policy capability is absent from the current API?
- A) HTTP method matching
- B) HTTP path matching
- C) Kafka topic rules
- D) DNS name rules
Show Answer
Answer: C) Kafka topic rules
Kafka L7 policy was removed. Do not copy the old kafka rules into current CiliumNetworkPolicy resources.
Encryption and Security
- Which pair names alternative Cilium node transport encryption modes?
- A) IPsec and WireGuard
- B) HTTP and DNS
- C) Relay and Grafana
- D) SYN and ACK
Show Answer
Answer: A) IPsec and WireGuard
Select the required mode and its prerequisites. SPIRE mutual authentication and Beta ztunnel workload mTLS are separate features with different scope.
- What is covered by the chapter's default WireGuard node-tunnel profile?
- A) Every packet, including arbitrary external traffic
- B) Supported Cilium-managed Pod traffic crossing nodes
- C) All same-node Pod traffic through the tunnel
- D) All host traffic without exceptions
Show Answer
Answer: B) Supported Cilium-managed Pod traffic crossing nodes
Same-node traffic does not use these node tunnels. Node-to-node encryption is a separate Beta option with control-plane exclusions; application TLS may still be required.
- What is Cilium Host Firewall intended to protect?
- A) Only browser JavaScript
- B) The host's network traffic
- C) All container syscalls automatically
- D) A Grafana password database
Show Answer
Answer: B) The host's network traffic
Host policy is a network control. Runtime process/syscall enforcement belongs to separate mechanisms such as configured Tetragon policies; encryption compatibility must be checked.
- Does matching an Authorization header authenticate its bearer?
- A) Yes, any present header is a verified JWT
- B) Yes, a regex-looking value verifies signatures
- C) No; header matching does not validate the token
- D) Yes, if HTTP uses port 8443
Show Answer
Answer: C) No; header matching does not validate the token
Use actual authentication/authorization logic. A valued headers string is literal matching, and a TLS port number does not decrypt the payload.
- What primarily determines a Cilium security identity?
- A) A guaranteed unique Pod IP forever
- B) The security-relevant label set
- C) The user's browser cookie
- D) The last observed HTTP response
Show Answer
Answer: B) The security-relevant label set
Endpoints sharing security-relevant labels can share an identity. Identity-based policy alone does not provide end-user authentication or traffic encryption.
Visibility and Monitoring
- What is Hubble's main role?
- A) Network-flow observability
- B) Container image deployment
- C) A complete WAF without rules
- D) Automatic isolation of every suspicious Pod
Show Answer
Answer: A) Network-flow observability
Hubble exposes flow metadata, verdicts and supported protocol observations. Detection rules and response integrations require separate configuration.
- Which is a Hubble UI capability?
- A) Rotating application credentials
- B) Service dependency maps and flow exploration
- C) Automatically sending Slack incidents
- D) Installing runtime syscall policies
Show Answer
Answer: B) Service dependency maps and flow exploration
The UI visualizes network observations through Relay. It is not a notification, deployment or runtime-policy controller.
- Which command follows flow events for either endpoint matching the frontend Pod?
- A)
hubble observe --pod cilium-security-demo/frontend --follow - B)
hubble watch --pod frontend - C)
cilium hubble status - D)
hubble observe --pod app=frontend
Show Answer
Answer: A) hubble observe --pod cilium-security-demo/frontend --follow
Use a namespace-qualified Pod name and --follow for a stream. Pod names are not label selectors; directional and label filters are separate flags.
- Which is not supplied by the illustrated Hubble metric plugins?
- A) HTTP response status counts
- B) TCP flag counts
- C) Observed drop counts
- D) Container CPU usage
Show Answer
Answer: D) Container CPU usage
Those plugins observe network/proxy events. The TCP plugin does not provide a general concurrent-connection or RTT metric, and missing/lost observations must be considered.
- With Prometheus Operator installed, what is needed to scrape Hubble through ServiceMonitor?
- A) Only importing a Grafana dashboard
- B) A static public hubble-metrics.cilium.io:9091 target
- C) Enabled metrics and a ServiceMonitor selected by Prometheus
- D) Only creating an unrelated ConfigMap
Show Answer
Answer: C) Enabled metrics and a ServiceMonitor selected by Prometheus
The chart's headless Service exposes the named hubble-metrics port, normally 9965. Prometheus namespace/label selectors and endpoint reachability must match.