Practice Exam CCA: Cilium Certified Associate

Question bank: 110 · timed mock exam: 90 min

Official exam page on the vendor's site (opens in a new tab) Official exam guide (opens in a new tab) Official prep course (opens in a new tab)

Compare: CCA vs KCNA

  • Architecture 22 questions
  • Network Policy 20 questions
  • Service Mesh 19 questions
  • Network Observability 11 questions
  • Installation and Configuration 11 questions
  • eBPF 11 questions
  • Cluster Mesh 10 questions
  • BGP and External Networking 6 questions
Study mode (free) Exam mode (subscribers)

Free: 25 questions in study mode, all domains, no account.

Subscription: the 110 questions of this certification, the timed exam mode, and all other certifications too.

Subscribe · €9.99 / month

Secure card payment (Stripe) · No commitment · Cancel online

How to prepare for Cilium Certified Associate with InfraPrep

The 110 questions cover 8 domains: Architecture, Network Policy, Service Mesh, Network Observability, Installation and Configuration, eBPF, Cluster Mesh, BGP and External Networking. 25 of them are free, without an account.

Study mode

Answer at your pace: each answer is corrected straight away, with an explanation and the link to the documentation it relies on.

Exam mode

A timed exam of 90 minutes, with a question map to flag and come back to questions before you submit.

Results by domain

Your score is broken down by domain, so you know what to review first.

Original questions

Every question is written from the public documentation, never copied from the exam. You can contest an answer from study mode.

10 free sample questions

Question 1 Architecture

A platform team evaluating Cilium for a new cluster asks what Cilium fundamentally is and how it secures connectivity. Which description matches the documentation?

  1. A DNS server that resolves Service names for clients outside the cluster
  2. A container runtime that schedules pods in place of the kubelet
  3. Software that secures service-to-service connectivity, built on eBPF
  4. A sidecar proxy image that every application container must embed
Show the answer and the explanation

Correct answer: C

The documentation describes Cilium as open source software for transparently securing connectivity between application services, built at its foundation on eBPF, a Linux kernel technology.

Source: official documentation

Question 2 Network Policy

Before any CiliumNetworkPolicy exists, a freshly deployed endpoint receives traffic from another pod. What happens by default, and what changes once a policy first selects that endpoint on one direction?

  1. Traffic stays blocked by default until an administrator opens it manually
  2. The endpoint stays open to all traffic even after being selected
  3. Traffic is allowed by default; a selecting policy moves that direction to default-deny
  4. A selecting policy only changes behavior for DNS traffic, nothing else
Show the answer and the explanation

Correct answer: C

The documentation states that by default all traffic is allowed for endpoints, and once a policy selects an endpoint on a given direction, that direction transitions to a default-deny state.

Source: official documentation

Question 3 Service Mesh

A platform engineer enables the Cilium Ingress controller for the first time. What prerequisites and default Service type does the documentation describe?

  1. No prerequisites exist and Ingress works on any cluster untouched
  2. Enabling Ingress turns off Cilium's L7 proxy automatically
  3. NodePort or kube-proxy replacement is required, and the default Service type is LoadBalancer
  4. The controller can only expose Services through a NodePort, never a LoadBalancer
Show the answer and the explanation

Correct answer: C

The documentation lists NodePort (or the kube-proxy replacement) among the prerequisites, and states that by default the Ingress controller creates a Service of LoadBalancer type.

Source: official documentation

Question 4 Network Observability

Before deploying Hubble Relay, an operator runs Hubble only per node. What scope of visibility does this give, and what does Hubble UI add once Relay is in place?

  1. Hubble can only observe traffic once it has already left the cluster
  2. Visibility stays scoped to each node's own traffic; UI then maps service dependencies
  3. Hubble UI is a command-line tool with no graphical component at all
  4. Visibility already spans the whole cluster before Relay is even deployed
Show the answer and the explanation

Correct answer: B

The documentation states that by default the Hubble API operates within the scope of the individual node where the agent runs, and describes Hubble UI as a web interface enabling automatic discovery of the service dependency graph.

Source: official documentation

Question 5 Installation and Configuration

An operator needs to change one value in a running Cilium install without touching Helm values directly. What can the Cilium CLI do here, and what happens by default afterward?

  1. `cilium config set` only reads values; it never writes new ones
  2. The Cilium CLI cannot write configuration; only `kubectl edit` can
  3. `cilium config set` updates the value, and agent pods restart by default
  4. Any change always forces a full Helm reinstall of the release
Show the answer and the explanation

Correct answer: C

The documentation states that via `cilium config set`, the Cilium CLI can update individual values in the cilium-config ConfigMap, and that agent pods are restarted by default when configuration changes.

Source: official documentation

Question 6 Cluster Mesh

A team running several separate Kubernetes clusters wants pods in different clusters to talk directly while policy is still enforced. What documented feature fits, and how?

  1. Hubble Relay, which only aggregates observability data across nodes
  2. Kube-proxy replacement, unrelated to linking separate clusters together
  3. Cluster Mesh, which extends the datapath across clusters with full policy enforcement
  4. Egress Gateway, built only to route traffic toward destinations outside all clusters
Show the answer and the explanation

Correct answer: C

The documentation states that Cluster Mesh extends the networking datapath across multiple clusters, letting endpoints in all connected clusters communicate while full policy enforcement stays in effect.

Source: official documentation

Question 7 eBPF

A new engineer asks how the Cilium datapath builds features like policy enforcement at the kernel level. What is the documented mechanism?

  1. BPF programs on kernel hooks combine into higher-level constructs
  2. All Cilium functionality runs in userspace with no kernel component
  3. A custom kernel module replaces the Linux networking stack entirely
  4. iptables rules generated by kube-proxy handle every Cilium feature
Show the answer and the explanation

Correct answer: A

The documentation states that the Linux kernel offers a set of BPF hooks in the networking stack, and that the Cilium datapath loads BPF programs on these hooks which, combined, form higher-level networking constructs.

Source: official documentation

Question 8 BGP and External Networking

A team enables Egress Gateway so external traffic appears to come from a chosen gateway node's IP, but the source IP still looks wrong after enabling it. Which two documented prerequisites should they check first?

  1. Interfaces/IPs on the gateway node, plus BPF masquerading and kube-proxy replacement
  2. IPsec encryption enabled, since Egress Gateway needs encrypted egress by default
  3. The external service whitelisting each pod's own original source IP
  4. Cluster Mesh enabled, since Egress Gateway is documented as depending on it
Show the answer and the explanation

Correct answer: A

The documentation states that Cilium needs provisioned network-facing interfaces and IP addresses on the designated gateway nodes, and that enabling Egress Gateway additionally requires both BPF masquerading and the kube-proxy replacement to be enabled.

Source: official documentation

Question 9 Architecture

A new team member reads that a Cilium deployment is made of several distinct pieces running in the cluster. Which statement matches the documented architecture?

  1. Only kube-proxy is deployed; Cilium components are all optional add-ons
  2. Hubble fully replaces the cilium-agent once observability is turned on
  3. A Cilium deployment runs distinct components, including a per-node agent
  4. A Cilium deployment is a single monolithic binary with no separate parts
Show the answer and the explanation

Correct answer: C

The documentation states that a deployment of Cilium and Hubble consists of a defined set of components running in the cluster, one of which is the cilium-agent.

Source: official documentation

Question 10 Network Policy

A team asks why Cilium avoids filtering by pod IP address the way traditional container firewalls do. What is the documented reason?

  1. Cilium filters exclusively on MAC addresses instead of any identity concept
  2. Cilium assigns a shared security identity to containers with matching policies
  3. Cilium routes all filtering decisions through Kubernetes Service names only
  4. Cilium requires every pod to keep one static, manually chosen IP forever
Show the answer and the explanation

Correct answer: B

The documentation explains that instead of filtering by source IP and destination port, which requires updating firewalls everywhere, Cilium assigns a security identity to groups of containers sharing identical policies.

Source: official documentation

Frequently asked questions

Are there free questions, and do I need an account?

Yes. 25 questions of this certification are free in study mode, across all its domains, without a subscription and without registration. The account is created when you subscribe, at checkout.

How does the subscription work, and can I cancel?

One monthly subscription covers all certifications and the timed practice exams. There is no minimum period. You cancel online, at any time, with the "Cancel your contract" function in My account; cancellation takes effect at the end of the month already paid, and no further payment is taken.

Where do the questions come from?

Every question is original, written from the vendor's public documentation. Each answer comes with an explanation and a link to the documentation page it relies on. InfraPrep is not affiliated with the vendors, and certification names belong to their owners.

In which language are the questions?

The questions are written in English, also on the French version of the site.

Is the catalog updated?

Yes, the catalog changes over time: new certifications and new questions are added.