Cilium-Associate Exam Dumps : Cilium Certified AssociateCCA

Technical explanation

The policy’s endpointSelector selects the ship workload in the namespace containing the CiliumNetworkPolicy , which is ns-cca . It also explicitly includes io.cilium.k8s.policy.cluster: cluster1 , confirming that the selected source endpoint belongs to cluster1.

The egress rule authorizes communication to an endpoint carrying name: base and the cluster label io.cilium.k8s.policy.cluster: cluster2 . Because the namespaced policy does not specify a different destination namespace through k8s:io.kubernetes.pod.namespace , the intended destination is the corresponding base workload in ns-cca on cluster2. Therefore, A matches the policy.

Options C and D incorrectly describe the rule as a deny rule. Cilium policy rules use an allow-list model unless an explicit egressDeny or ingressDeny section is present. The exhibit contains an ordinary egress rule, so matching traffic is authorized. Option B incorrectly places the destination in default .

Current Cilium versions require explicit cluster targeting for remote endpoints, which this policy provides through the cluster label.

Official references

Cluster Mesh Network Policy , Namespaces in Cilium Policy

Study Guide topic: Cluster Mesh labels, namespaced policies, and cross-cluster endpoint selection.

Technical explanation

Policy Audit Mode allows administrators to evaluate the consequences of network policies before enforcing their deny decisions. Traffic that would ordinarily be rejected remains permitted, while Cilium records an audit verdict. These verdicts can be examined with Cilium monitoring tools and used to identify legitimate communications that are missing from the proposed policies.

This is especially valuable when introducing host policies or default-deny controls into an existing environment. An incomplete policy might otherwise block access to the Kubernetes API, node-management interfaces, DNS, monitoring systems, or other operational dependencies. The recommended workflow is to enable audit mode, observe traffic and policy verdicts, adjust the rules, confirm that all required communications receive allow verdicts, and then disable audit mode to begin enforcement.

DNS enforcement mode and HTTP audit mode are not the general Cilium configuration requested. “Policy enforcement mode” describes whether policies are normally enforced, but it does not provide the non-disruptive learning behavior in the question.

Audit mode should be treated as a temporary validation mechanism because it does not actually block disallowed traffic and does not persist across every agent-restart scenario.

Official references

Cilium Policy Audit Mode

Study Guide topic: Policy validation, audit verdicts, and safe policy rollout.

Technical explanation

D is the accurate general description because eBPF programs can attach at kernel and application-related hook points where data may already be decrypted, depending on the program and the selected hook. The statement says “could,” not that every packet-processing eBPF program automatically decrypts TLS. Cilium’s documented TLS-aware inspection uses controlled TLS termination and a userspace Envoy proxy; the broader point is that eBPF is not restricted to observing encrypted wire-format packets at a single network interface.

The other choices are directly contradicted by Cilium’s eBPF documentation. XDP and traffic-control programs can be replaced atomically at runtime without rebooting the host or restarting network services, so A is false. Traffic-control BPF supports both ingress and egress hook points, making B false. Cilium also applies eBPF-based security to the host through its Host Firewall and host-policy capabilities; therefore, eBPF security is not inherently confined to container traffic, and C is false.

A critical distinction is that inspecting application plaintext depends on where the program attaches and where encryption occurs. Cilium’s ordinary L3/L4 datapath does not magically decrypt TLS, while its documented TLS interception workflow explicitly terminates and re-originates selected connections to expose application-layer content.

Official references

Cilium eBPF program types ; eBPF datapath introduction ; Inspecting TLS Encrypted Connections .

Study Guide topic: eBPF.