You must add Hubble to your Kubernetes cluster where Cilium is NOT the installed CNI. Your cluster is already running in production and you must minimise downtime. Which method is the most appropriate?
Correct Answer: A
Technical explanation Hubble obtains its visibility from Cilium's eBPF datapath, and the Hubble Server is embedded in the Cilium agent. Hubble therefore cannot provide its normal flow-observability capabilities as a standalone installation without Cilium, eliminating B. CNI chaining allows Cilium to coexist with a supported existing CNI. The original plugin continues to supply base connectivity and IP address management, while Cilium attaches eBPF programs to the created network devices. Those programs provide visibility, policy enforcement, and other Cilium functionality. Hubble can then be enabled on top of the chained Cilium deployment. This approach avoids an immediate, disruptive replacement of the production cluster's networking layer and is consequently the best answer. Options C and D could be appropriate in broader migration projects, particularly when a current CNI is incompatible with chaining or when full native-Cilium functionality is required. However, both imply substantially more workload movement or cutover activity than the stated objective of minimizing downtime. Compatibility, chaining mode, current CNI behavior, kernel requirements, and feature limitations must still be validated before production rollout. Official references Cilium CNI Chaining , Hubble Internals , Troubleshooting Hubble Study Guide topic: Hubble prerequisites, CNI chaining, and production adoption.
Question 22
The application team would like to observe egress traffic with application level information for workloads running in a Cilium based Kubernetes Cluster Which features would offer this without the need for additional tooling?
Correct Answer: D
Technical explanation Hubble UI and Hubble CLI are Cilium's integrated interfaces for examining workload network flows. Hubble records source and destination identities, namespaces, workloads, addresses, ports, forwarding verdicts, and drop reasons. When Layer 7 visibility is configured, its flow output can also contain application-level information such as HTTP methods, URLs, response codes, latency, and DNS queries. Filters can narrow the results by source workload, namespace, destination, protocol, port, or verdict, making Hubble appropriate for investigating egress behavior. Hubble CLI provides detailed event-oriented inspection, while Hubble UI presents flows and service dependencies graphically. Hubble Relay aggregates the per-node Hubble APIs so these clients can obtain cluster-wide visibility. Load balancing directs traffic but is not an observability interface. Kubernetes NetworkPolicy expresses permitted communications but does not by itself display application-level flow records. Fluentd and Grafana are external logging and visualization components and would violate the requirement to avoid additional tooling. Layer 7 information requires supported traffic to be redirected through Cilium's L7 proxy. Hubble then exposes the resulting application-layer flow events through the built-in CLI or UI, making D the complete answer. Official references Network Observability with Hubble ; Inspecting Network Flows . Study Guide topic: Network Observability.
Question 23
Which Cilium command should you execute to gather network-related troubleshooting information from your Kubernetes cluster?
