Cilium Advanced Quiz
Supported Version: Cilium 1.17 Last Updated: February 22, 2026
eBPF Technology
Where do eBPF programs run?
- A) User Space
- B) Kernel Space
- C) Inside containers
- D) Inside virtual machines
Show Answer
Answer: B) Kernel Space
Explanation: eBPF programs run safely inside the Linux kernel and can extend and modify kernel functionality.
What mechanism ensures the safety of eBPF programs?
- A) Virtualization
- B) Containerization
- C) Static Verifier
- D) Encryption
Show Answer
Answer: C) Static Verifier
Explanation: The eBPF verifier checks the safety of programs before they are loaded to prevent infinite loops or kernel crashes.
Which is NOT a main benefit of using eBPF in Cilium?
- A) Implementing networking features without kernel modules
- B) High performance and low overhead
- C) Fine-grained network policy enforcement
- D) Hardware acceleration required
Show Answer
Answer: D) Hardware acceleration required
Explanation: eBPF can provide high performance on a software basis without requiring hardware acceleration.
Networking Models
Which data path mode is NOT supported by Cilium?
- A) VXLAN
- B) Geneve
- C) Direct Routing
- D) MPLS
Show Answer
Answer: D) MPLS
Explanation: Cilium supports VXLAN, Geneve, and Direct Routing, but does not support MPLS.
What technology does Cilium use in kube-proxy replacement mode?
- A) iptables
- B) IPVS
- C) eBPF-based XDP
- D) netfilter
Show Answer
Answer: C) eBPF-based XDP
Explanation: Cilium uses eBPF and XDP (eXpress Data Path) to replace kube-proxy and provide higher performance.
What feature in Cilium's network model tracks packet paths during Pod-to-Pod communication?
- A) tcpdump
- B) Hubble Flow Monitoring
- C) Wireshark
- D) Prometheus
Show Answer
Answer: B) Hubble Flow Monitoring
Explanation: Hubble is Cilium's network flow monitoring tool that can track and visualize Pod-to-Pod communication in real-time.
IPAM and Network Policies
Which IPAM (IP Address Management) mode in Cilium integrates with AWS EKS?
- A) Cluster Pool
- B) Kubernetes Host Scope
- C) AWS ENI
- D) CRD-based
Show Answer
Answer: C) AWS ENI
Explanation: Cilium integrates with EKS through AWS ENI (Elastic Network Interface) mode to directly assign VPC IP addresses to Pods.
What does the 'toFQDNs' rule allow in Cilium network policies?
- A) Traffic to specific IP addresses
- B) Traffic to specific ports
- C) Traffic to specific domain names
- D) Traffic of specific protocols
Show Answer
Answer: C) Traffic to specific domain names
Explanation: The toFQDNs rule allows traffic to specific domain names (FQDNs), and Cilium monitors DNS lookups to dynamically allow IP addresses for those domains.
Which selector is NOT supported in Cilium CiliumNetworkPolicy?
- A) endpointSelector
- B) nodeSelector
- C) namespaceSelector
- D) serviceSelector
Show Answer
Answer: D) serviceSelector
Explanation: Cilium supports endpointSelector, nodeSelector, and namespaceSelector, but does not directly support serviceSelector.
L2-L7 Networking
Which attribute cannot be filtered by Cilium's L7 policies for HTTP requests?
- A) Path
- B) Method
- C) Headers
- D) Response Time
Show Answer
Answer: D) Response Time
Explanation: Cilium's L7 policies can filter HTTP request attributes such as path, method, and headers, but response time is not a filtering target.
What is NOT provided by Cilium's Service Mesh features?
- A) Mutual TLS (mTLS)
- B) Traffic Splitting
- C) Service Discovery
- D) User Authentication
Show Answer
Answer: D) User Authentication
Explanation: Cilium Service Mesh provides mutual TLS, traffic splitting, and service discovery, but user authentication is typically handled by a separate authentication system.
What functionality does Cilium's Envoy integration provide?
- A) L7 load balancing
- B) L7 visibility
- C) L7 policy enforcement
- D) All of the above
Show Answer
Answer: D) All of the above
Explanation: Cilium integrates with the Envoy proxy to provide L7 load balancing, visibility, and policy enforcement.
Security and Visibility
Which feature is NOT provided by Hubble UI?
- A) Service dependency map
- B) Network flow visualization
- C) Policy violation alerts
- D) Code deployment management
Show Answer
Answer: D) Code deployment management
Explanation: Hubble UI provides service dependency maps, network flow visualization, and policy violation alerts, but does not provide code deployment management.
Which protocols can be used for network traffic encryption in Cilium?
- A) IPsec and WireGuard
- B) TLS and SSH
- C) SSL and HTTPS
- D) DTLS and QUIC
Show Answer
Answer: A) IPsec and WireGuard
Explanation: Cilium can encrypt inter-node network traffic using IPsec and WireGuard protocols.
Which Cilium security feature matches this description? "Filters traffic based on specific fields or patterns of specific application layer protocols"
- A) Network policies
- B) L7 policies
- C) Encryption
- D) Intrusion detection
Show Answer
Answer: B) L7 policies
Explanation: L7 (application layer) policies can filter traffic based on specific fields or patterns in protocols such as HTTP, gRPC, and Kafka.
Advanced Topics and Real-World Use Cases
Which is NOT a main feature of Cilium Cluster Mesh?
- A) Cross-cluster service discovery
- B) Cross-cluster network policies
- C) Cross-cluster load balancing
- D) Cross-cluster storage sharing
Show Answer
Answer: D) Cross-cluster storage sharing
Explanation: Cilium Cluster Mesh provides cross-cluster service discovery, network policies, and load balancing, but does not provide storage sharing.
What does Cilium's Bandwidth Manager feature provide?
- A) Network bandwidth monitoring
- B) Network bandwidth limiting and QoS
- C) Network bandwidth optimization
- D) Network bandwidth prediction
Show Answer
Answer: B) Network bandwidth limiting and QoS
Explanation: Cilium's Bandwidth Manager uses eBPF to provide per-Pod network bandwidth limiting and QoS (Quality of Service).
What does Cilium's Host Firewall feature protect?
- A) Container-to-container communication only
- B) Node-to-node communication only
- C) The host's own network interfaces
- D) External cloud services
Show Answer
Answer: C) The host's own network interfaces
Explanation: Cilium's Host Firewall protects the host's own network interfaces, enhancing host-level security.
What is the main purpose of Cilium's Egress Gateway feature?
- A) Preserving the source IP address of external traffic
- B) Changing the destination IP address of external traffic
- C) Encrypting external traffic
- D) Blocking external traffic
Show Answer
Answer: A) Preserving the source IP address of external traffic
Explanation: Cilium's Egress Gateway SNATs outbound traffic from Pods to outside the cluster to a specific IP, providing a consistent source IP.
What is NOT possible through Cilium's BGP support?
- A) Route exchange with external routers
- B) Advertising external IPs for LoadBalancer services
- C) Direct routing between clusters
- D) Automatic DNS record creation
Show Answer
Answer: D) Automatic DNS record creation
Explanation: Cilium's BGP support provides route exchange with external routers, advertising external IPs for LoadBalancer services, and direct routing between clusters, but does not provide automatic DNS record creation.
Performance and Troubleshooting
Which Cilium performance optimization technology significantly reduces packet processing latency?
- A) TCP BBR
- B) XDP (eXpress Data Path)
- C) DPDK
- D) TSO (TCP Segmentation Offload)
Show Answer
Answer: B) XDP (eXpress Data Path)
Explanation: XDP processes packets at the network driver level, bypassing the kernel networking stack to significantly reduce latency.
What is the command to diagnose network connectivity issues in Cilium?
- A)
cilium status - B)
cilium connectivity test - C)
cilium monitor - D)
cilium endpoint list
Show Answer
Answer: B) `cilium connectivity test`
Explanation: The `cilium connectivity test` command tests various network connectivity scenarios within the cluster to diagnose issues.
- A)
What is the command to check the network policy status of a specific Pod in Cilium?
- A)
cilium endpoint list - B)
cilium policy get - C)
cilium endpoint get <endpoint-id> - D)
cilium status --all-endpoints
Show Answer
Answer: C)
cilium endpoint get <endpoint-id>Explanation: The
cilium endpoint get <endpoint-id>command shows detailed information and applied network policy status for a specific endpoint (Pod).- A)
What is the command to check BPF map status in Cilium?
- A)
cilium map list - B)
cilium bpf maps - C)
cilium status --maps - D)
cilium bpf map list
Show Answer
Answer: B) `cilium bpf maps`
Explanation: The `cilium bpf maps` command shows a list and status of all BPF maps used by Cilium.
- A)
What is the command for network packet capture and analysis in Cilium?
- A)
cilium tcpdump - B)
cilium capture - C)
cilium monitor - D)
cilium packet-capture
Show Answer
Answer: C) `cilium monitor`
Explanation: The `cilium monitor` command can capture and analyze packets passing through Cilium's eBPF data path in real-time.
- A)