CCA practice exam: free questions, domains and format

Practice available102 practice questions

CCA, the Cilium Certified Associate, is the Linux Foundation multiple-choice exam on Cilium, eBPF-based networking for Kubernetes. This page lists its eight domains and weights, the verified format and cost, five sample questions with answers, and the way to start free practice.

By Ibrahim Yesilay · Published 23 Oct 2026 · Updated 23 Oct 2026

Last updated 23 Oct 2026 · Verified 23 Oct 2026 against the Linux Foundation certification page

GoldenKube is independent and not affiliated with or endorsed by CNCF or The Linux Foundation. Disclaimer

Start free practice

What is the CCA exam?

CCA is the Cilium Certified Associate exam from the Linux Foundation and CNCF. It is a proctored, online, multiple-choice exam on Cilium, the Kubernetes networking, security and observability project built on eBPF. It checks that you understand how Cilium is architected, how it enforces network policy, how its service mesh features work, how Hubble provides network observability, how Cluster Mesh connects clusters, what eBPF is and why it matters, and how BGP and external networking are handled. It is a knowledge exam, so you read policies and configuration and decide what they do. Officially it is the Cilium Certified Associate certification, a multiple-choice exam in the Golden tier of the 16-certification Golden Kubestronaut program. The sections below cover its official domains, the verified format and cost, and its place in the path.

Typical questions ask which Cilium component does what, how an identity-based network policy differs from a plain Kubernetes NetworkPolicy, what a given CiliumNetworkPolicy allows, how to read Hubble flow output, and what installation options change. Hands-on experience with a Cilium cluster makes the vocabulary much easier to retain.

CCA exam domains and weights

CCA has eight domains, which is the widest spread in the program. Architecture is the largest at 20%, then Network Policy at 18% and Service Mesh at 16%. Network Observability, Installation and Configuration, Cluster Mesh and eBPF each carry 10%, and BGP and External Networking is the smallest at 6%. Because no single domain dominates, the safest plan is to cover all eight at least once and then spend extra time on architecture and policy, which are the two largest domains. Weights come from the official certification page, checked on 23 October 2026. The official list has 8 domains: the largest is Architecture at 20% and the smallest is BGP and External Networking at 6%, so a sensible plan splits study time roughly in proportion to these weights.

Architecture is the base: the agent, the operator, identities and the datapath. Network policy builds directly on identities, and the service mesh domain extends the same datapath to layer 7. Observability, Cluster Mesh and BGP are narrower features that become straightforward once the architecture is clear.

Domain	Weight
Architecture	20%
Network Policy	18%
Service Mesh	16%
Network Observability	10%
Installation and Configuration	10%
Cluster Mesh	10%
eBPF	10%
BGP and External Networking	6%

Weights as published on the official certification page, checked 23 Oct 2026.

CCA exam format and cost

The CCA exam facts below were read from the official Linux Foundation pages on 2026-10-23, and every row of the table links to the page it came from. Format: Online, proctored, multiple-choice. Questions: 60. Duration: 90 minutes. Passing score: 75%. Price: 250 US dollars. Certification validity: 2 years. Prerequisites: None (page recommends Kubernetes and basic networking knowledge). Retake policy: One retake per exam purchase if a passing score is not achieved. Curriculum version: not published by the Linux Foundation. Prices and policies change, so confirm them on the official CCA page before you book. If the Linux Foundation changes a value, this page is updated and shows the date it was last verified.

Questions	60 source
Duration (minutes)	90 source
Passing score	75% source
Price (USD)	250 source
Validity (years)	2 source
Delivery	Online, proctored, multiple-choice source
Prerequisites	None (page recommends Kubernetes and basic networking knowledge) source
Retake policy	One retake per exam purchase if a passing score is not achieved source
Curriculum version	not published by the Linux Foundation

With 60 questions in 90 minutes you have about 90 seconds per question on average, which is enough to read a scenario carefully but not to agonise over one item. If every question counts equally, 75% of 60 is 45 correct answers, so one unknown topic does not decide the result. Flag a hard question, move on, and return to it at the end.

Treat the table as the single source for numbers on this page. If a row says the Linux Foundation does not publish a value, we print that instead of guessing, and the official CCA page remains the final word on registration and policy.

How GoldenKube practice works for CCA

GoldenKube turns the CCA bank into a practice loop. You answer one question at a time, see right away whether you were correct, and read an explanation of why. The next question is chosen for you: reviews that are due come first, then the domain where you are weakest, spread across all 8 exam domains so you do not only practise what you already know. A question you miss comes back on a spaced schedule until you answer it correctly, and a mock exam mode lets you test yourself under exam conditions. You can answer 10 questions as a guest with no sign-up; after that a free account saves your progress, with no credit card.

Adaptive order: due reviews first, then your weakest domain.
Spaced repetition: missed questions return until you have mastered them.
Every question carries an explanation, not just a right-or-wrong verdict.
Mock exam mode for a timed run once you are close to ready.

Start free practice

5 sample CCA questions

The five questions below come from the GoldenKube CCA bank, and each one shows its correct answer and a written explanation. They are practice questions written for learning, not questions from the real exam, and they were picked once so the page stays stable. Use them as a quick check of your level: if you can explain why each wrong option is wrong, you are in good shape for this part of the syllabus, and if not, the explanation shows what to revise. The sample questions page holds a larger set, and the practice app holds the full bank with adaptive ordering and review.

Question 1

Which of the following Gateway API configurations correctly creates a Gateway listening on port 80 for HTTP traffic?

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: example-gateway
spec:
  gatewayClassName: cilium
  listeners:
  - name: http
    protocol: HTTP
    port: 80
    allowedRoutes:
      namespaces:
        from: Same

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: example-gateway
spec:
  className: cilium
  listeners:
  - name: http
    protocol: HTTP
    port: 80
    routes:
      namespaces:
        from: Same

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: example-gateway
spec:
  gatewayClassName: cilium
  ports:
  - name: http
    protocol: HTTP
    number: 80
  routes:
    namespaceSelector:
      matchLabels:
        kubernetes.io/metadata.name: default

apiVersion: gateway.networking.k8s.io/v1beta1
kind: GatewayClass
metadata:
  name: example-gateway
spec:
  controllerName: io.cilium/gateway-controller
  listeners:
  - name: http
    protocol: HTTP
    port: 80

Correct answer: A

This is the correct Gateway API configuration for creating a Gateway listening on port 80 for HTTP traffic with Cilium as the controller. It includes the required fields gatewayClassName, listeners with appropriate protocol and port, and allowedRoutes to specify which routes can attach to this gateway.

Question 2

Which policy enforcement mode in Cilium enforces policies only on endpoints that match at least one network policy?

A.default
B.always
C.never
D.selective

Correct answer: C

The "never" enforcement mode only applies policies to endpoints that match at least one network policy. This is different from "default" (which denies traffic to pods without matching policies) and "always" (which enforces policies on all endpoints).

Question 3

Which network protocol does Cilium support for pod-to-pod encryption?

A.OpenVPN
B.IPsec
C.SSL
D.SSH tunneling

Correct answer: B

Cilium supports IPsec for encrypting pod-to-pod traffic, which provides secure communication at the IP layer. WireGuard is also supported in newer versions, but IPsec is the classic solution. OpenVPN and SSH tunneling are not natively supported by Cilium.

Question 4

In a Cluster Mesh setup, what's the maximum recommended number of clusters that can be connected?

A.There is no practical limit
B.255 clusters
C.100 clusters
D.5 clusters

Correct answer: A

In a Cluster Mesh setup, there is no practical limit to the number of clusters that can be connected. While there are scaling considerations, Cilium's architecture allows for large numbers of connected clusters without hard limits.

Question 5

How does eBPF provide better performance compared to iptables for network policy enforcement?

A.By optimizing rule ordering automatically
B.By using efficient map lookups instead of sequential rule evaluation
C.By offloading processing to specialized hardware
D.By caching policy decisions in user space

Correct answer: B

eBPF provides better performance compared to iptables for network policy enforcement by using efficient map lookups instead of sequential rule evaluation. While iptables must evaluate rules in sequence (O(n) complexity), eBPF can use hash maps or other optimized data structures for O(1) or O(log n) lookups.

Where CCA sits in the Golden Kubestronaut path

CCA is a Golden-tier certification, not one of the 5 core Kubestronaut certifications, and Golden Kubestronaut requires all 16 certifications in the program, so CCA is a required step. Its own prerequisites, per the Linux Foundation: None (page recommends Kubernetes and basic networking knowledge). The program page lists all 16 certifications side by side and marks which ones GoldenKube can practice today. It is best taken after KCNA or CKA has given you the cluster vocabulary. Within the program it is the networking specialisation: it pairs with KCSA and CKS on network policy, and with ICA and CNPE on service mesh and platform networking.

If networking is your weak area, CCA also helps with troubleshooting in the hands-on exams, since many cluster problems are connectivity problems. The program page shows all sixteen certifications and which ones GoldenKube practices today.

Frequently asked questions

What is the CCA exam?

CCA stands for Cilium Certified Associate. Multiple-choice exam on Cilium architecture, network policy, service mesh, Hubble observability, Cluster Mesh, eBPF and BGP. It is one of the 16 certifications in the Golden Kubestronaut program, in the Golden requirement tier.

How many questions are on the CCA exam?

60 questions, according to the Linux Foundation pages checked on 2026-10-23. Every question is multiple-choice. The exact count and format can change, so confirm it on the official page before booking.

What is the CCA passing score?

75% is the passing score published by the Linux Foundation, as checked on 2026-10-23. Aim to score clearly above it in practice, because the real exam will contain topics you have not seen.

How much does the CCA exam cost?

The exam price is 250 US dollars, with a certification validity of 2 years. Retake policy: One retake per exam purchase if a passing score is not achieved. Prices change, so check the official CCA page before you pay.

How long is the CCA exam?

90 minutes, per the Linux Foundation pages checked on 2026-10-23. Plan your pacing before the exam day: know roughly how long you can afford to spend on one question.

How hard is the CCA exam?

CCA is an associate-level, multiple-choice exam. Prior Kubernetes and basic networking knowledge is where the difficulty comes from: the questions assume you already understand pods, services and network policy, and then ask how Cilium implements them with eBPF. GoldenKube has no pass-rate data and does not claim one. With eight domains, breadth of coverage matters more than depth in any one feature.

Is CCA required for Golden Kubestronaut?

Yes. Golden Kubestronaut requires all 16 certifications in the program, including CCA.

How do I start free CCA practice?

Open the CCA practice page and answer your first question. You get 10 free guest answers with no sign-up, then a free account keeps your progress, with no credit card. Every answer has an explanation, weak domains come up more often, and missed questions return on a spaced schedule.

Exam facts verified 23 Oct 2026 on the official CCA certification page.

Practice CCA