Cilium status exhibit Based on the cilium status output above, what is correct about the Cilium deployment? For accessibility, the output of the command has been edited.
Correct Answer: B
Technical explanation The status output reports Operator: OK , followed by Deployment cilium-operator Desired: 1, Ready: 1/1, Available: 1/1 . This establishes that the Cilium Operator is deployed and healthy, making B the intended answer. Cilium uses Kubernetes CustomResourceDefinitions as its default mechanism for storing and propagating cluster state, while the operator performs cluster-wide duties that should be handled once centrally rather than independently on every node. Option A is contradicted by the exhibit: both hubble-ui and hubble-relay appear as ready deployments and running containers. Option C is incorrect because the resource is explicitly identified as a Deployment ; the cilium agents, by contrast, are shown as a DaemonSet . Option D incorrectly treats the displayed desired replica count as a permanent restriction. A desired count of one describes this installation's current configuration, not a universal maximum. The exhibit also shows embedded Envoy mode and three healthy Cilium agent instances, but neither detail changes the operator conclusion. Official references Cilium Component Overview , Setting up Hubble Observability Study Guide topic: Cilium components, Cilium Operator, CRD-backed state, and status interpretation.
Question 2
Which one of the following statements accurately describes the identity-based network security model used by Cilium?
Correct Answer: C
Technical explanation Cilium derives an endpoint's security identity from its security-relevant labels rather than from its current IP address. When multiple endpoints possess the same relevant label set, they receive and share the same numeric security identity. This enables policies to follow an application as pods are recreated, rescheduled, or scaled across nodes. In Kubernetes, the Cilium agent obtains workload metadata through the Kubernetes API and associates the pod's labels with the corresponding Cilium endpoint. Identity allocation converts the relevant label set into a cluster-wide identity. Policy enforcement then matches that identity in the eBPF datapath instead of depending exclusively on short-lived pod addresses. Option A incorrectly makes the IP address the source of identity and says that identities cannot be shared. Option B incorrectly identifies annotations as the identity foundation. Annotations may configure behavior, but Cilium's security model is label-based. Option D is also incorrect because operators do not ordinarily assign each pod's numeric security identity manually. Identity allocation and lifecycle management are automatic. Official references Cilium Terminology and Identities , Limiting Identity-Relevant Labels Study Guide topic: Label-derived identities and identity-based policy enforcement.
Question 3
What is correct about the Kubernetes Host Scope IP Address Management (IPAM) mode?
Correct Answer: D
Technical explanation Kubernetes host-scope IPAM can be used with both Cilium tunnel routing and native direct routing. The IPAM mechanism determines how each node receives and locally allocates pod addresses; it does not inherently require a particular packet-forwarding model. The current IPAM feature matrix explicitly marks both tunnel routing and direct routing as supported for Kubernetes host-scope mode. In this mode, Kubernetes allocates a PodCIDR to each node and publishes it through the standard v1.Node resource, normally in spec.podCIDR or spec.podCIDRs . The Cilium agent waits for the relevant range and allocates individual pod addresses from that node-specific CIDR. The correct configuration is ipam: kubernetes or the Helm equivalent ipam.mode=kubernetes , not ipam: crd ; therefore, C is false. The documented feature matrix does not provide multiple CIDRs per cluster or multiple CIDRs per node for this mode, eliminating A and B. Multi-pool IPAM is the Cilium mode designed for allocating per-node CIDRs from multiple configurable pools. Because Kubernetes host-scope IPAM supports either overlay tunneling or direct routing while the other statements contradict its capabilities or configuration, D is correct. Official references IP Address Management ; Kubernetes Host Scope . Study Guide topic: Installation and Configuration.
Question 4
Which statement is true about Mutual Authentication with Cilium?
Correct Answer: D
Technical explanation SPIRE supplies workload identities as SPIFFE Verifiable Identity Documents, including X.509 key material used for mutual authentication. SPIFFE's identity model supports automatic issuance, rotation, and revocation, allowing short-lived certificates to be renewed without manually distributing static credentials. This makes D the correct statement. Option A reverses the documented default. Cilium's default SPIRE installation requires persistent-volume support. In-memory storage can be selected for laboratory environments by disabling server data storage, but that setting causes SPIRE data to be recreated if the server pod restarts. Option B also reverses the relationship between the projects: SPIFFE defines the identity standards and APIs, while SPIRE is a production-ready implementation of SPIFFE. Cilium's mutual-authentication integration has been validated with SPIRE. Option C overstates the operational requirement. A SPIRE server is involved, but Cilium's Helm chart can deploy and configure the supported SPIRE server and per-node agents. Administrators may provide their own deployment, yet a completely manual installation is not mandatory. Current documentation classifies this mutual-authentication implementation as beta and notes limitations, including incompatibility with Cluster Mesh trust domains. Those maturity constraints do not change the certificate-management behavior described in D. Official references Cilium Mutual Authentication . Study Guide topic: Service Mesh.
Question 5
What would be a benefit of using remote service affinity in a Cluster Mesh deployment?
Correct Answer: D
Technical explanation Remote service affinity directs a global Service to prefer healthy backend endpoints located in remote clusters. This can support maintenance or staged rollouts in which the local copy of an application is temporarily unavailable or intentionally removed from service. Requests originating in the local cluster continue through the same global Service but are forwarded to the preferred remote backends, matching the use case described by D. Cilium configures this behavior through the service.cilium.io/affinity: "remote" annotation. The preference affects backend selection; it does not require clients to use a different Service address. If remote backends are available, they are marked as preferred. This provides operators with a controlled way to direct traffic away from the local deployment during an update. Option A describes local affinity from the perspective of the cluster containing the client, not remote affinity. Option B incorrectly introduces the Egress Gateway, which provides controlled source addresses and routing for outbound traffic rather than Cluster Mesh global-Service affinity. Option C describes the normal none affinity behavior, under which Cilium has no local-or-remote preference and can load-balance across both categories. Remote affinity therefore enables temporary cross-cluster continuity while local application instances are updated or otherwise unavailable. Official references Cluster Mesh Service Affinity . Study Guide topic: Cluster Mesh.
