CCA Practice Test

CCA practice test: what's covered

• eBPF
• CNI
• Network Policy
• Hubble
• Cluster Mesh
• Encryption

Free CCA sample questions

1. A platform team asks why Cilium relies on eBPF rather than the traditional iptables-based dataplane used by older CNI plugins. What is the most accurate technical justification for using eBPF programs in the datapath?

   • A. eBPF runs sandboxed programs inside the Linux kernel at hook points, allowing packet processing and policy enforcement without long iptables rule chains that scale poorly
   • B. eBPF replaces the Linux kernel networking stack entirely with a userspace dataplane that bypasses the kernel for every packet
   • C. eBPF is a kernel module that must be compiled and inserted manually before any pod networking can function
   • D. eBPF only accelerates DNS resolution and has no effect on packet forwarding or policy decisions
   Show answer

   Correct: A. eBPF lets Cilium attach verified, sandboxed programs to kernel hook points (XDP, tc, socket) so forwarding and policy are decided efficiently in-kernel; this avoids the O(n) iptables rule chains that degrade as services grow. It is not a userspace bypass, not a manually inserted kernel module, and is not limited to DNS — those options misstate how eBPF works.

2. During troubleshooting an engineer wants to confirm that the eBPF programs loaded by Cilium were validated before being attached to the kernel. Which kernel component is responsible for statically analyzing an eBPF program for safety before it is allowed to run?

   • A. The eBPF verifier, which checks for unbounded loops, invalid memory access, and out-of-bounds reads before the program is accepted
   • B. The kube-proxy daemon, which signs each program and forwards it to the control plane for approval
   • C. The container runtime, which sandboxes the program inside the pod network namespace
   • D. The Cilium operator, which compiles the program to WebAssembly before loading it
   Show answer

   Correct: A. The in-kernel eBPF verifier statically analyzes every program, rejecting unbounded loops, invalid pointer arithmetic, and out-of-bounds memory access so a faulty program cannot crash or compromise the kernel. kube-proxy does not handle eBPF validation, the container runtime sandboxes containers not eBPF, and Cilium does not compile to WebAssembly.

3. An architect is documenting concrete advantages that Cilium's eBPF dataplane provides over a legacy iptables-and-kube-proxy stack in a large cluster. (Choose TWO benefits that are direct results of using eBPF.)

   • A. Service load balancing can use efficient eBPF hash maps instead of sequentially evaluated iptables rules, improving performance at scale
   • B. Network policy and identity can be enforced in-kernel based on Cilium identities rather than relying solely on IP-based iptables matching
   • C. eBPF removes the need for a container runtime such as containerd on each worker node
   • D. eBPF guarantees that no NetworkPolicy is ever required because all traffic is encrypted by default
   • E. eBPF eliminates the Kubernetes API server by storing all cluster state inside kernel maps
   Show answer

   Correct: A and B. eBPF maps give Cilium constant-time service lookups versus iptables' linear rule scanning, and identity-aware enforcement lets policy follow workload labels instead of brittle IPs. eBPF does not replace the container runtime, does not auto-encrypt or remove the need for policy, and certainly does not replace the Kubernetes API server — those options are false.

4. A new team member sees that Cilium assigns every pod a numeric security identity rather than enforcing policy purely on pod IP addresses. Why does Cilium use identities derived from labels instead of tracking individual IPs for policy enforcement?

   • A. Identities derived from a pod's labels let policy stay valid as pods churn and IPs change, and they scale far better than per-IP rules
   • B. Identities are random numbers assigned at boot that have no relationship to labels and exist only for logging
   • C. Identities replace Kubernetes namespaces so pods no longer need to belong to a namespace
   • D. Identities are only used by Hubble for display and play no role in actual policy enforcement
   Show answer

   Correct: A. Cilium computes a numeric identity from a workload's security-relevant labels; all pods sharing those labels share one identity, so policy survives pod restarts and IP reuse and the datapath compares identities instead of huge IP lists. Identities are not random, do not replace namespaces, and are central to enforcement, not just Hubble display.

5. An operator is mapping out which Cilium component runs where after a fresh install. Which statement correctly describes the role of the Cilium agent (cilium-agent) in the architecture?

   • A. It runs as a DaemonSet on every node, managing eBPF programs, endpoints, and the local datapath for pods on that node
   • B. It runs as a single Deployment that centrally programs the datapath for the entire cluster from one node
   • C. It runs only on the control-plane nodes and never touches worker-node networking
   • D. It is a CLI tool that engineers run manually whenever a pod is scheduled
   Show answer

   Correct: A. cilium-agent is deployed as a DaemonSet so one instance runs per node, where it loads eBPF programs, manages local endpoints and identities, and programs that node's datapath. It is not a single central Deployment, is not confined to control-plane nodes, and is a long-running daemon rather than a manually invoked CLI.

Last updated: 2026-10-19

CCA practice test FAQ