Cilium Security and Visibility Quiz
Supported Version: Cilium 1.17 Last Updated: February 22, 2026
Network Policy Basics
What is the main difference between Kubernetes NetworkPolicy and Cilium NetworkPolicy?
- A) Cilium NetworkPolicy does not support L7 policies
- B) Kubernetes NetworkPolicy does not support L7 policies
- C) Cilium NetworkPolicy can only be applied to specific nodes
- D) Kubernetes NetworkPolicy provides higher performance
Show Answer
Answer: B) Kubernetes NetworkPolicy does not support L7 policies
Explanation: Kubernetes NetworkPolicy only supports L3/L4 level policies, while Cilium NetworkPolicy supports a broader range of policies from L3 to L7.
What is the API group for Cilium NetworkPolicy?
- A) networking.k8s.io
- B) cilium.io
- C) policy.cilium.io
- D) network.cilium.io
Show Answer
Answer: B) cilium.io
Explanation: Cilium NetworkPolicy uses the cilium.io API group.
What is the role of 'endpointSelector' in Cilium NetworkPolicy?
- A) Selects target Pods to which the policy applies
- B) Selects target nodes to which the policy applies
- C) Selects target namespaces to which the policy applies
- D) Selects target services to which the policy applies
Show Answer
Answer: A) Selects target Pods to which the policy applies
Explanation: endpointSelector is used to select the target Pods (endpoints) to which the policy applies.
What does the 'ingress' rule control in Cilium NetworkPolicy?
- A) Incoming traffic to selected Pods
- B) Outgoing traffic from selected Pods
- C) Internal traffic within selected Pods
- D) Traffic to outside the cluster
Show Answer
Answer: A) Incoming traffic to selected Pods
Explanation: Ingress rules control incoming traffic to the selected Pods.
What does the 'egress' rule control in Cilium NetworkPolicy?
- A) Incoming traffic to selected Pods
- B) Outgoing traffic from selected Pods
- C) Internal traffic within selected Pods
- D) Traffic from outside the cluster
Show Answer
Answer: B) Outgoing traffic from selected Pods
Explanation: Egress rules control outgoing traffic from the selected Pods.
L7 Policies
Which attribute cannot be filtered in Cilium's L7 HTTP policies?
- A) Path
- B) Method
- C) Headers
- D) Response Time
Show Answer
Answer: D) Response Time
Explanation: Cilium's L7 HTTP policies can filter HTTP request attributes such as path, method, and headers, but response time is not a filtering target.
Which attribute can be filtered in Cilium's L7 Kafka policies?
- A) Topic
- B) Partition
- C) Offset
- D) All of the above
Show Answer
Answer: A) Topic
Explanation: Cilium's L7 Kafka policies can filter primarily based on topic, API key, and similar attributes.
What does the 'matchPattern' rule allow in Cilium's L7 DNS policies?
- A) Exact domain name matching
- B) Domain name pattern matching with wildcards
- C) IP address matching
- D) Port number matching
Show Answer
Answer: B) Domain name pattern matching with wildcards
Explanation: The matchPattern rule can match domain name patterns including wildcards (*). Example: *.example.com
What component is required to apply Cilium's L7 policies?
- A) kube-proxy
- B) Envoy proxy
- C) NGINX ingress controller
- D) HAProxy
Show Answer
Answer: B) Envoy proxy
Explanation: Cilium uses the Envoy proxy to apply L7 policies.
Which protocol is NOT supported by Cilium's L7 policies?
- A) HTTP
- B) gRPC
- C) Kafka
- D) SMTP
Show Answer
Answer: D) SMTP
Explanation: Cilium supports L7 protocols such as HTTP, gRPC, and Kafka, but SMTP is not supported by default.
Encryption and Security
Which protocols can be used for network traffic encryption in Cilium?
- A) IPsec
- B) WireGuard
- C) Both A and B
- D) TLS
Show Answer
Answer: C) Both A and B
Explanation: Cilium can encrypt inter-node traffic using both IPsec and WireGuard.
What traffic does Cilium's encryption feature protect?
- A) Inter-node traffic only
- B) Inter-pod traffic only
- C) Node-to-pod traffic only
- D) All cluster traffic
Show Answer
Answer: B) Inter-pod traffic only
Explanation: Cilium's encryption feature primarily protects inter-pod traffic.
What does Cilium's Host Firewall feature protect?
- A) Pod network interfaces
- B) Host network interfaces
- C) Service endpoints
- D) Container runtime
Show Answer
Answer: B) Host network interfaces
Explanation: Cilium's Host Firewall protects the host's own network interfaces, enhancing host-level security.
Which Cilium security feature matches this description? "Filters traffic based on specific fields or patterns of specific application layer protocols"
- A) Network policies
- B) L7 policies
- C) Encryption
- D) Intrusion detection
Show Answer
Answer: B) L7 policies
Explanation: L7 (application layer) policies can filter traffic based on specific fields or patterns in protocols such as HTTP, gRPC, and Kafka.
What is Cilium's Identity-based security model based on?
- A) Pod name
- B) Node name
- C) Labels
- D) IP address
Show Answer
Answer: C) Labels
Explanation: Cilium's Identity is based on Pod labels, which allows consistent security policies to be applied even when IP addresses change.
Visibility and Monitoring
What is Hubble?
- A) Cilium's network visibility tool
- B) Cilium's load balancer
- C) Cilium's encryption protocol
- D) Cilium's DNS server
Show Answer
Answer: A) Cilium's network visibility tool
Explanation: Hubble is Cilium's network visibility tool that can observe and analyze network flows based on eBPF.
Which feature is NOT provided by Hubble UI?
- A) Service dependency map
- B) Network flow visualization
- C) Policy violation alerts
- D) Code deployment management
Show Answer
Answer: D) Code deployment management
Explanation: Hubble UI provides service dependency maps, network flow visualization, and policy violation alerts, but does not provide code deployment management.
What is the command to observe network flows for a specific Pod using Hubble CLI?
- A)
hubble observe --pod <pod-name> - B)
hubble watch --pod <pod-name> - C)
hubble monitor --pod <pod-name> - D)
hubble inspect --pod <pod-name>
Show Answer
Answer: A)
hubble observe --pod <pod-name>Explanation: The
hubble observe --pod <pod-name>command can observe network flows for a specific Pod in real-time.- A)
Which metric is NOT collected by Hubble?
- A) HTTP status codes
- B) TCP connection status
- C) Dropped packet count
- D) Container CPU usage
Show Answer
Answer: D) Container CPU usage
Explanation: Hubble collects network-related metrics (HTTP status codes, TCP connection status, dropped packet count, etc.) but does not collect system metrics such as container CPU usage.
How do you integrate Cilium with Prometheus?
- A) Add Prometheus annotations to Cilium Operator
- B) Install Cilium plugin on Prometheus server
- C) Create ServiceMonitor resource for Cilium
- D) Import Cilium dashboard to Prometheus
Show Answer
Answer: C) Create ServiceMonitor resource for Cilium
Explanation: When using Prometheus Operator, you can collect Cilium metrics by creating a ServiceMonitor resource for Cilium.