Sure Pass Exam Cilium-Associate PDF

Technical explanation

Hubble obtains its visibility from Cilium’s eBPF datapath, and the Hubble Server is embedded in the Cilium agent. Hubble therefore cannot provide its normal flow-observability capabilities as a standalone installation without Cilium, eliminating B.

CNI chaining allows Cilium to coexist with a supported existing CNI. The original plugin continues to supply base connectivity and IP address management, while Cilium attaches eBPF programs to the created network devices. Those programs provide visibility, policy enforcement, and other Cilium functionality. Hubble can then be enabled on top of the chained Cilium deployment. This approach avoids an immediate, disruptive replacement of the production cluster’s networking layer and is consequently the best answer.

Options C and D could be appropriate in broader migration projects, particularly when a current CNI is incompatible with chaining or when full native-Cilium functionality is required. However, both imply substantially more workload movement or cutover activity than the stated objective of minimizing downtime.

Compatibility, chaining mode, current CNI behavior, kernel requirements, and feature limitations must still be validated before production rollout.

Official references

Cilium CNI Chaining , Hubble Internals , Troubleshooting Hubble

Study Guide topic: Hubble prerequisites, CNI chaining, and production adoption.

Technical explanation

Option D uses the correct structure for permitting egress from selected endpoints to the local host entity. The endpointSelector selects endpoints whose label env equals dev . Because the intended traffic travels from those endpoints toward the host, the policy must contain an egress rule. An egress peer is expressed through toEntities , and host is the reserved entity representing the local host, including host-networked containers on that node.

Option A is invalid because fromEntities is an ingress-oriented field and cannot express an egress destination. Option B uses nodeSelector , which selects nodes rather than workload endpoints and is only valid for node-level rules in a CiliumClusterwideNetworkPolicy ; it is not valid in the displayed namespaced CiliumNetworkPolicy . It also combines ingress with toEntities , reversing the rule direction. Option C has a valid workload selector but again uses toEntities under ingress ; ingress rules describe sources through constructs such as fromEntities .

Applying option D places the selected endpoints into egress default-deny mode and then expressly permits traffic whose destination is the host entity. Other egress traffic must be allowed separately.

Official references

Policy Enforcement and Rule Basics ; Endpoint Lifecycle policy examples .

Study Guide topic: Network Policy.