Linux Foundation / CNCF CCA: Cilium Certified Associate (CCA)

Last checked November 10, 2026 against the official Linux Foundation / CNCF exam page.

1. Question 1Architecture

   While reviewing the kube-system namespace, an engineer finds one Cilium pod on every worker node. Each pod compiles and loads eBPF programs into the kernel and enforces policy for the endpoints on its own node. Which component is this?

   1. AThe cilium-operator Deployment that handles cluster-wide tasks
   2. BThe Hubble Relay Deployment that aggregates flow data from several nodes
   3. CThe cilium-agent DaemonSet pod running on each node
   4. DThe cilium command-line client installed on an administrator workstation
   Show answer and explanationHide answer

   Correct answer: C

   The cilium-agent runs on every node, compiles and loads eBPF programs, and enforces policy for local endpoints. The operator runs cluster-wide tasks from a Deployment, Hubble Relay aggregates flows, and the CLI is only a client on a workstation.

2. Question 2Network Policy

   A namespace contains a frontend deployment and a backend deployment. An engineer applies a policy that selects only the backend pods and allows ingress from the frontend pods. A separate monitoring pod in the same namespace is not selected by any policy. Under default enforcement, what happens to ingress traffic sent to the monitoring pod?

   1. AIt drops all ingress until an explicit allow policy is written for its labels, because every endpoint is deny-by-default
   2. BIt keeps accepting traffic from any source, because enforcement applies only to endpoints that a policy selects
   3. CThe new backend policy also covers it, because policies apply to the whole namespace unless they are scoped further
   4. DIt is placed into a quarantine identity that blocks every connection, including traffic from the node itself
   Show answer and explanationHide answer

   Correct answer: B

   In default enforcement mode a policy restricts only the endpoints its selector matches, so the unselected monitoring pod stays open to any source. Policies do not cover a whole namespace automatically, and there is no quarantine identity in this behaviour.

3. Question 3Service Mesh

   A team asks why Cilium's service mesh does not inject a proxy container into every application pod, which is what they are used to from sidecar-based meshes. Which explanation is correct?

   1. ACilium runs its L7 proxy per node, so application pods do not need a sidecar container injected into them
   2. BCilium adds one proxy per namespace through a mutating webhook, and that proxy is shared by every pod in the namespace
   3. CCilium moves all L7 processing into the kube-apiserver, so neither a node-level proxy nor a sidecar is needed on the worker nodes
   4. DCilium enforces L7 rules only with iptables chains in the kernel, so no proxy process is ever started on the node
   Show answer and explanationHide answer

   Correct answer: A

   Cilium Service Mesh uses an Envoy proxy on each node instead of a sidecar in every pod. The other options describe kernel-only L7 enforcement, per-namespace proxies, or L7 handling in the API server, none of which matches how Cilium handles L7 traffic.

4. Question 4Network Observability

   Intermittent connection failures occur between a web pod and an API pod. An engineer needs to know whether packets were dropped by a network policy or lost elsewhere, and wants per-flow detail. Which data source gives this most directly?

   1. Akubectl describe on the API pod, which lists every network policy that has ever matched a packet from the web pod
   2. BThe kube-apiserver audit log, which records every packet exchanged between the web pod and the API pod
   3. CNode exporter CPU counters, which break down each TCP connection by the policy that accepted or dropped it
   4. DHubble flow records, which show each flow's source, destination and verdict such as forwarded or dropped
   Show answer and explanationHide answer

   Correct answer: D

   Hubble records flows along with their verdicts, which show whether a policy dropped or forwarded them. Audit logs record API requests rather than packets, kubectl describe does not report per-packet verdicts, and node exporter counters are system metrics.

5. Question 5Installation and Configuration

   A new cluster has just been set up with the Cilium CLI, and the engineer wants a quick summary of whether the Cilium components are healthy before deploying workloads. Which command should be run?

   1. Acilium uninstall, which removes the Cilium components from the cluster so that a clean install can start
   2. Bkubectl logs on the kube-proxy pod, which shows the datapath state that Cilium is currently using
   3. Ckubectl delete pod for each cilium-agent, which forces a restart so that the health summary is recalculated
   4. Dcilium status, which reports the health of the Cilium agents, the operator and related components
   Show answer and explanationHide answer

   Correct answer: D

   cilium status is the CLI check that summarises whether the Cilium components are running and healthy. uninstall removes Cilium, kube-proxy logs do not describe Cilium's state, and deleting agent pods is disruptive and does not report health.