Cilium-Associate Exam Dumps and Practice Questions

Cilium tunnel mode supports VXLAN and Geneve encapsulation. In this routing model, Cilium nodes form an overlay mesh, and traffic exchanged between nodes is carried inside UDP-encapsulated packets. VXLAN is the default tunnel protocol and normally uses UDP port 8472. Geneve is the alternative and normally uses UDP port 6081. Operators select the protocol through the tunnel-protocol configuration setting, whose documented values are vxlan and geneve.

Encapsulation reduces the requirements placed on the underlying network. The underlay only needs to provide IP connectivity between the Kubernetes nodes and permit the selected UDP tunnel port. It does not need to learn or route individual PodCIDRs. Cilium also uses the tunnel metadata to carry information such as the source security identity, avoiding an additional identity lookup on the receiving node.

MPLS, OTV, STT, and EVPN are not supported values for Cilium's tunnel-protocol setting. EVPN may be used in broader data-center network designs, and MPLS is a carrier-routing technology, but neither is a Cilium overlay encapsulation choice. Therefore, B is the only supported pair.

Official references

Cilium Routing; System Requirements.

Study Guide topic: Architecture.

BIG TCP permits the Linux networking stack to process packets larger than the traditional approximately 64-KiB limit represented by the IP length field while the packets remain inside the host. IPv6 BIG TCP uses a temporary Hop-by-Hop header carrying the larger internal length, while IPv4 BIG TCP sets tot_len to zero and uses the socket buffer length internally. Before transmission, packets are segmented into sizes suitable for the physical network. C therefore identifies the problem BIG TCP addresses.

Option A is false because Cilium's documentation explicitly states that BIG TCP does not require network-interface MTU changes. The larger objects exist inside the software networking stack and are segmented before appearing on the wire.

Option B reverses the intended performance effect. Larger internal GSO and GRO packets reduce repeated stack traversal, lowering CPU utilization and generally improving throughput and latency. Option D is also false: Generic Segmentation Offload and Generic Receive Offload are fundamental to BIG TCP's operation. Cilium increases their maximum sizes when BIG TCP is enabled. The source mentions TSO, but the documented mechanism is principally described through GSO and GRO.

Official references

Cilium Performance Tuning and BIG TCP

Study Guide topic: BIG TCP, GSO/GRO, packet-length limits, and performance.

The exhibit records connections originating from default/test and directed to default/test2, eliminating B and C because those choices reverse the initiating workload. For destination port 80, the flow shows the TCP three-way handshake---SYN, SYN-ACK, and ACK---followed by bidirectional packets with ACK/PSH flags and an orderly FIN exchange. This is the pattern of a successfully established request and response, so the first curl operation succeeded.

The later connection targets port 8080. Hubble records a SYN from test followed by an ACK, RST response from test2. A reset returned immediately after the connection attempt indicates that the destination rejected or could not accept the connection, commonly because no process was listening on that port. It is not shown as a policy drop; both entries carry the FORWARDED verdict. Thus the network delivered the packets, but the TCP connection itself failed.

Option D is the only choice matching a successful request from test to port 80 and a failed request from test to port 8080. Its displayed IP strings contain source-document transcription defects, but its workload direction, ports, and outcomes match the exhibit.

Official references

Inspecting Network Flows with the CLI; Troubleshooting with Hubble.

Study Guide topic: Network Observability.

The host entity represents the local node on which the selected Cilium endpoint resides. It also includes processes and containers using the local host network namespace. Therefore, A reproduces the official entity definition accurately.

The remote-node entity does not represent arbitrary unmanaged endpoints. It represents hosts other than the local node across the local cluster and connected clusters, including host-networked containers on those nodes. Unmanaged endpoints instead have the reserved unmanaged identity.

Option C gives the definition of the separate kube-apiserver entity, not cluster. The cluster entity is the logical collection of endpoints and reserved identities inside the local cluster, including Cilium-managed endpoints, unmanaged local endpoints, hosts, remote nodes, health, ingress, initialization, and kube-apiserver identities. Current documentation separately provides a cluster-mesh entity for endpoints in connected clusters.

Option D confuses all with world. world represents endpoints outside the cluster. all covers all identities and is not simply equivalent to the IPv4 CIDR 0.0.0.0/0, particularly in identity-aware, node, and IPv6 contexts.

Official references

Cilium Layer 3 Policy Entities, Cilium Reserved Identities

Study Guide topic: Reserved entities and identity-based Layer 3 policies.

Cilium primarily improves Kubernetes network security through identity-aware policy enforcement across Layers 3 through 7. Standard Kubernetes NetworkPolicy resources provide Layer 3 and Layer 4 controls, while CiliumNetworkPolicy extends enforcement to application-layer rules. Policies can select workloads by labels and identity, restrict protocols and destination ports, control communication with CIDRs or entities, apply DNS/FQDN rules, and authorize supported HTTP or gRPC operations. This multi-layer enforcement is the capability described by D.

API Gateway and Gateway API configurations can contribute to controlling north-south traffic, but they are not Cilium's primary or comprehensive security mechanism. Database encryption is implemented by database, storage, or encryption-management systems rather than being a general function of Cilium. Persistent-volume backup is similarly outside Cilium's CNI, network-policy, and observability responsibilities.

Cilium's identity model is especially important in dynamic Kubernetes environments. Security policy follows workload identities derived from labels instead of depending exclusively on changing pod IP addresses. At Layer 7, traffic is redirected to Envoy when protocol-aware inspection or enforcement is required, while eBPF supplies the efficient kernel datapath for lower-layer processing.

Official references

Introduction to Cilium and Hubble; Network Policy; Layer 7 Policies.

Study Guide topic: Network Policy.