Exactprep Cilium-Associate Questions

Technical explanation

The Hubble Server is embedded in each Cilium agent and consumes the eBPF-derived visibility data produced on that node. It exposes gRPC services through which clients can retrieve flow events, node and namespace information, server status, and related observability data. Embedding the server in the agent enables high-performance collection with comparatively low overhead.

Hubble Relay has a different role. It is a standalone component that discovers and connects to the Hubble Server instances running across the cluster. Relay aggregates their individual APIs to provide multi-node or cluster-wide visibility to clients such as the Hubble CLI and Hubble UI. It is therefore not the component embedded in the agent.

The Cilium CNI plugin is invoked when Kubernetes creates or removes pods and asks the local agent to configure their networking and datapath. The Cilium Operator performs cluster-wide management duties such as selected IPAM and shared-state operations. Neither component is responsible for exposing eBPF flow visibility.

This server–relay distinction is central to understanding Hubble’s distributed architecture: Server provides node-local visibility, while Relay combines multiple servers into a cluster-wide view.

Official references

Hubble Internals , Cilium Component Overview

Study Guide topic: Hubble Server, Hubble Relay, and distributed flow observability.

Technical explanation

Option C has the correct Cilium policy structure. It selects pods labeled app: frontend , creates an egress rule with a valid CIDR entry, and combines that destination constraint with toPorts , port 8888 , and protocol TCP . Because the CIDR and port restriction are in the same egress rule, traffic must meet both conditions.

Option A uses an unsupported address-range structure with from and to fields rather than CIDR notation. Option B initially resembles the correct form but contains an additional malformed ports item at the egress-rule level. Option D uses unsupported action: allow and action: deny fields inside toPorts ; Cilium allow and deny behavior is expressed through policy sections such as egress and egressDeny , not per-port action properties.

The item is nevertheless defective. The prose and examples indicate 192.168.9.0/24 , while all displayed CIDR-based options specify 192.168.0.0/24 ; the source text itself shows the corrupted 192.168.e.e/24 . If 192.168.9.0/24 is authoritative, none of the exhibits permits the stated example. The supplied key B is structurally incorrect under the displayed manifests.

Official references

Cilium Layer 3 and CIDR Policies

Study Guide topic: CIDR selectors, Layer 4 ports, and rule composition.

Technical explanation

Cilium tunnel mode supports VXLAN and Geneve encapsulation. In this routing model, Cilium nodes form an overlay mesh, and traffic exchanged between nodes is carried inside UDP-encapsulated packets. VXLAN is the default tunnel protocol and normally uses UDP port 8472. Geneve is the alternative and normally uses UDP port 6081. Operators select the protocol through the tunnel-protocol configuration setting, whose documented values are vxlan and geneve .

Encapsulation reduces the requirements placed on the underlying network. The underlay only needs to provide IP connectivity between the Kubernetes nodes and permit the selected UDP tunnel port. It does not need to learn or route individual PodCIDRs. Cilium also uses the tunnel metadata to carry information such as the source security identity, avoiding an additional identity lookup on the receiving node.

MPLS, OTV, STT, and EVPN are not supported values for Cilium’s tunnel-protocol setting. EVPN may be used in broader data-center network designs, and MPLS is a carrier-routing technology, but neither is a Cilium overlay encapsulation choice. Therefore, B is the only supported pair.

Official references

Cilium Routing ; System Requirements .

Study Guide topic: Architecture.

Technical explanation

D most precisely describes Cilium’s foundational use of eBPF. The Cilium agent translates desired networking and security state into eBPF programs and maps, then attaches those programs to Linux kernel hook points such as traffic-control ingress and egress, XDP, cgroups, and sockets. Packets can consequently be classified, permitted, dropped, redirected, load-balanced, or forwarded without requiring changes to the protected application.

Endpoint-policy programs associate traffic with Cilium security identities and perform Layer 3 and Layer 4 enforcement in the kernel. Traffic requiring Layer 7 inspection can be redirected from the eBPF datapath to Envoy. This combination provides efficient kernel-level enforcement while retaining application-aware controls.

Option A describes an important Hubble observability outcome, but it is narrower than Cilium’s primary networking and enforcement model and overstates what is necessarily exposed through a UI. Option B mischaracterizes Cilium as DNS infrastructure; Cilium can enforce DNS-aware policies but does not replace Kubernetes DNS service discovery. Option C is too generic and implies a conventional threat-detection product rather than identity-based networking and policy enforcement.

Official references

Cilium eBPF Datapath Introduction , Introduction to Cilium and Hubble

Study Guide topic: Kernel hooks, endpoint policy, identities, and eBPF datapath enforcement.