Linux Foundation Cilium-Associate Exam Questions

A is a supported recommendation: Cilium's WireGuard implementation provides transparent encryption between Cilium-managed endpoints, works with Cluster Mesh, and distributes node public keys to remote clusters through clustermesh-apiserver. All participating clusters must enable WireGuard, and inter-cluster firewalls must permit UDP port 51871. IPv6-only pod traffic does not inherently disqualify WireGuard.

However, this question is no longer uniquely answerable from current Cilium documentation. Current IPsec documentation supports IPv6 pod-to-pod connectivity and sets its cluster or Cluster Mesh limit at more than 65,535 nodes. The described mesh contains 10,002 nodes, so option B is also technically supportable under the stated facts. The older distinction apparently assumed by the supplied key is no longer sufficient to exclude IPsec.

Options C and D are definitively false. Ten thousand and two nodes remain below the documented IPsec ceiling, and transparent encryption is not restricted to IPv4. WireGuard may still be selected for its automatic per-node key-pair distribution and simpler Cluster Mesh integration, but workload performance, kernel support, firewall rules, key-management requirements, and operational testing should inform a production recommendation.

Official references

WireGuard Transparent Encryption, IPsec Transparent Encryption

Study Guide topic: Transparent-encryption selection, IPv6, Cluster Mesh, and scaling limits.

B expresses the principal scalability distinction intended by the question. In kube-proxy's iptables mode, Kubernetes Services and endpoints are represented by chains of netfilter rules. As the number of Services and backends grows, rule creation, synchronization, and packet traversal can involve increasingly large rule sets. Matching through those chains is generally described as having linear scaling characteristics.

Cilium's kube-proxy replacement stores service and backend state in eBPF maps. Hash-map lookups allow the datapath to locate service entries without sequentially scanning a rule for every Service, providing effectively constant-time lookup behavior for the relevant map operations. This makes the approach better suited to large and frequently changing Kubernetes environments.

Option A is false because iptables and netfilter also operate within the Linux kernel. Option C is false because kube-proxy's iptables implementation supports IPv6 when the surrounding Kubernetes and host configuration supports it. Option D does not explain kube-proxy's primary scaling limitation and introduces an unrelated SmartNIC/XDP claim.

The constant-time description is a useful architectural simplification; total performance still depends on map sizing, backend selection, connection tracking, and kernel behavior.

Official references

Cilium eBPF Datapath, Cilium Tuning Guide

Study Guide topic: kube-proxy replacement, eBPF maps, and datapath scalability.

cilium config set debug true follows the supported Cilium CLI configuration syntax and sets the debug configuration key to true. The cilium config set command accepts a key/value pair and, by default, restarts the Cilium pods so that the changed configuration is applied. The Cilium configuration documentation defines debug as the setting that enables full debug mode. This increases agent logging verbosity and causes eBPF programs to emit additional visibility events for diagnostic use.

Options A, B, and D do not match documented Cilium CLI command structures. There is no cilium log level --set=debug command in the Cilium CLI hierarchy, and neither cilium logging.level=debug nor cilium logging debug is valid configuration syntax. A Helm-managed installation may also enable debugging through the chart value debug.enabled=true, but that does not make any of the alternative commands correct.

Debug mode should be enabled deliberately because it increases log volume and may generate additional datapath visibility information. After troubleshooting, operators should normally restore the previous setting to avoid unnecessary operational overhead.

The supplied answer key incorrectly identifies B. The verified answer is C.

Official references

Cilium configuration; Cilium CLI `config set`; Helm values.

Study Guide topic: Installation and Configuration.

The manifest specifies both interface: net1 and egressIP: 10.3.4.5 in the same egressGateway configuration. These properties are mutually exclusive. Cilium ignores an Egress Gateway policy containing both, so A correctly identifies the defect.

When interface is supplied, Cilium uses the selected interface and chooses its first suitable IPv4 and IPv6 addresses as the SNAT addresses. When egressIP is supplied, that address must already be assigned to a network device on the chosen gateway node; Cilium determines the corresponding interface through a route lookup. Administrators may also omit both fields, causing Cilium to select the default-route interface and its addresses.

Option B is incorrect because matchLabels can contain multiple label key-value pairs, as the exhibit does with app: blog and component: backend. Option C is false because the egress address need not be publicly routable; private addresses are valid when routing and upstream network design support them. Option D is false because Cilium does not restrict gateway interfaces to names beginning with eth.

Official references

Cilium Egress Gateway

Study Guide topic: Egress Gateway node selection, interface selection, and SNAT addresses.

Kubernetes host-scope IPAM can be used with both Cilium tunnel routing and native direct routing. The IPAM mechanism determines how each node receives and locally allocates pod addresses; it does not inherently require a particular packet-forwarding model. The current IPAM feature matrix explicitly marks both tunnel routing and direct routing as supported for Kubernetes host-scope mode.

In this mode, Kubernetes allocates a PodCIDR to each node and publishes it through the standard v1.Node resource, normally in spec.podCIDR or spec.podCIDRs. The Cilium agent waits for the relevant range and allocates individual pod addresses from that node-specific CIDR. The correct configuration is ipam: kubernetes or the Helm equivalent ipam.mode=kubernetes, not ipam: crd; therefore, C is false.

The documented feature matrix does not provide multiple CIDRs per cluster or multiple CIDRs per node for this mode, eliminating A and B. Multi-pool IPAM is the Cilium mode designed for allocating per-node CIDRs from multiple configurable pools.

Because Kubernetes host-scope IPAM supports either overlay tunneling or direct routing while the other statements contradict its capabilities or configuration, D is correct.

Official references

IP Address Management; Kubernetes Host Scope.

Study Guide topic: Installation and Configuration.