Linux Foundation Cilium-Associate Exam Questions

cilium config set debug true follows the supported Cilium CLI configuration syntax and sets the debug configuration key to true. The cilium config set command accepts a key/value pair and, by default, restarts the Cilium pods so that the changed configuration is applied. The Cilium configuration documentation defines debug as the setting that enables full debug mode. This increases agent logging verbosity and causes eBPF programs to emit additional visibility events for diagnostic use.

Options A, B, and D do not match documented Cilium CLI command structures. There is no cilium log level --set=debug command in the Cilium CLI hierarchy, and neither cilium logging.level=debug nor cilium logging debug is valid configuration syntax. A Helm-managed installation may also enable debugging through the chart value debug.enabled=true, but that does not make any of the alternative commands correct.

Debug mode should be enabled deliberately because it increases log volume and may generate additional datapath visibility information. After troubleshooting, operators should normally restore the previous setting to avoid unnecessary operational overhead.

The supplied answer key incorrectly identifies B. The verified answer is C.

Official references

Cilium configuration; Cilium CLI `config set`; Helm values.

Study Guide topic: Installation and Configuration.

The manifest specifies both interface: net1 and egressIP: 10.3.4.5 in the same egressGateway configuration. These properties are mutually exclusive. Cilium ignores an Egress Gateway policy containing both, so A correctly identifies the defect.

When interface is supplied, Cilium uses the selected interface and chooses its first suitable IPv4 and IPv6 addresses as the SNAT addresses. When egressIP is supplied, that address must already be assigned to a network device on the chosen gateway node; Cilium determines the corresponding interface through a route lookup. Administrators may also omit both fields, causing Cilium to select the default-route interface and its addresses.

Option B is incorrect because matchLabels can contain multiple label key-value pairs, as the exhibit does with app: blog and component: backend. Option C is false because the egress address need not be publicly routable; private addresses are valid when routing and upstream network design support them. Option D is false because Cilium does not restrict gateway interfaces to names beginning with eth.

Official references

Cilium Egress Gateway

Study Guide topic: Egress Gateway node selection, interface selection, and SNAT addresses.

Kubernetes host-scope IPAM can be used with both Cilium tunnel routing and native direct routing. The IPAM mechanism determines how each node receives and locally allocates pod addresses; it does not inherently require a particular packet-forwarding model. The current IPAM feature matrix explicitly marks both tunnel routing and direct routing as supported for Kubernetes host-scope mode.

In this mode, Kubernetes allocates a PodCIDR to each node and publishes it through the standard v1.Node resource, normally in spec.podCIDR or spec.podCIDRs. The Cilium agent waits for the relevant range and allocates individual pod addresses from that node-specific CIDR. The correct configuration is ipam: kubernetes or the Helm equivalent ipam.mode=kubernetes, not ipam: crd; therefore, C is false.

The documented feature matrix does not provide multiple CIDRs per cluster or multiple CIDRs per node for this mode, eliminating A and B. Multi-pool IPAM is the Cilium mode designed for allocating per-node CIDRs from multiple configurable pools.

Because Kubernetes host-scope IPAM supports either overlay tunneling or direct routing while the other statements contradict its capabilities or configuration, D is correct.

Official references

IP Address Management; Kubernetes Host Scope.

Study Guide topic: Installation and Configuration.

Option B correctly represents the Ingress as a Gateway and an attached HTTPRoute. The Gateway is named cilium, uses gatewayClassName: cilium, and exposes an HTTP listener on port 80. The HTTPRoute uses parentRefs with the same Gateway name, cilium, so the route attaches to the declared listener. Its two rules preserve the original routing behavior: /details with PathPrefix targets the details Service on port 9080, while / with PathPrefix targets productpage on port 9080.

Option A declares a Gateway named cilium but attaches its route to nginx-gateway. Because the parent reference does not identify the displayed Gateway, it is not equivalent. Options C and D use kind: Route; the correct resource kind for HTTP path routing is HTTPRoute. They also contain malformed or altered backend and matching fields. Option D changes the details backend name, while option C contains incorrect route structure and path content.

Cilium's official migration example uses the same conversion pattern: the Ingress class becomes the Gateway's class, paths move into HTTPRoute.rules, and the route identifies its Gateway through parentRefs.

The supplied key incorrectly identifies A. The verified answer is B.

Official references

HTTP Migration Example.

Study Guide topic: Service Mesh.

The intended answer is D, but the option contains a source-bank typographical error. The valid command is cilium sysdump, not cilium sysduwp. Read literally, none of the four displayed commands exactly answers the question.

The Cilium CLI's sysdump operation gathers cluster-wide troubleshooting material, including Cilium configuration and endpoint state, agent and operator logs, Kubernetes workload information, routing and interface details, kernel messages, service state, policies, and selected eBPF-map output. This consolidated archive is the preferred diagnostic package when investigating Kubernetes networking or preparing a support report.

cilium status --verbose provides expanded health and deployment status, but it does not collect the comprehensive diagnostic archive requested. debuginfo is associated with the in-agent debug client---currently documented as cilium-dbg debuginfo---and produces useful local-agent API information; in Kubernetes environments it is already included as part of the system dump. cilium bugtool is not the current cluster-wide Cilium CLI command requested here.

For an exam-ready correction, option D should read cilium sysdump.

Official references

Cilium Troubleshooting and Sysdump

Study Guide topic: Cilium CLI troubleshooting, system dumps, and diagnostic collection.