Skip to content

20 Free CCA Sample Questions with Answers

By Ibrahim Yesilay · Published · Updated

Here are 20 free CCA sample questions with answers, taken from the GoldenKube question bank and grouped by exam domain. Every question has the correct answer marked and a written explanation, so you can check what you know and see why the wrong options fail. Cilium Certified Associate is a multiple-choice exam; this set is independent practice and not affiliated with the Linux Foundation.

How to use these CCA practice questions

Work through the 20 CCA sample questions in one sitting without looking anything up. For each question, decide on an answer first, then open the answer and read the explanation, including when you were right, because a correct guess and a correct line of reasoning look identical until the exam rewords the question. Mark every question as right, wrong or guessed, and count a guess as wrong when you score yourself. Give the set about 30 minutes, which is the average time per question on the real exam multiplied by twenty. The aim is to find out which exam domains are already solid and which ones need study before you buy the exam.

The official exam format is 60 questions in 90 minutes, with a passing score of 75%, according to the Linux Foundation documentation checked on 2026-10-23.

With JavaScript enabled, each answer starts collapsed behind a Show answer button so you can test yourself. Without JavaScript, and for any crawler or screen reader that reads the raw page, every answer and explanation is already visible below its question.

These questions were written for GoldenKube practice. They are not copied from the real exam, and nothing on this page tells you what the real exam will ask.

  • Read the question twice and underline the constraint words: "most", "least", "first", "only", "not".
  • Eliminate options you can prove wrong before you pick between the rest.
  • Where a question says to select all that apply, every correct option must be chosen and none of the wrong ones.
  • Read the explanation even for questions you got right; it often names the nearby concept the exam likes to swap in.

Architecture (4 questions)

Question 1

Which network protocol does Cilium support for pod-to-pod encryption?
  1. A.OpenVPN
  2. B.IPsec
  3. C.SSL
  4. D.SSH tunneling

Correct answer: B

Cilium supports IPsec for encrypting pod-to-pod traffic, which provides secure communication at the IP layer. WireGuard is also supported in newer versions, but IPsec is the classic solution. OpenVPN and SSH tunneling are not natively supported by Cilium.

Question 2

Which component of Cilium is responsible for monitoring and enforcing network policies on each Kubernetes node?
  1. A.Cilium Operator
  2. B.Cilium Hubble
  3. C.Cilium Agent
  4. D.Cilium CLI

Correct answer: C

The Cilium Agent runs on each node as a DaemonSet and is responsible for interacting with the Linux kernel to program eBPF, monitor, and enforce network policies. The Operator handles cluster-wide tasks, Hubble provides observability, and the CLI is a management tool.

Question 3

In Cilium, what does the term "identity" refer to?
  1. A.The unique IP address assigned to a pod
  2. B.The security context of a container
  3. C.A numeric identifier derived from pod labels that represents workload security identity
  4. D.The digital certificate used for encryption

Correct answer: C

In Cilium, "identity" refers to a numeric identifier derived from a pod's set of labels. This identity is used for policy enforcement, allowing Cilium to implement security policies based on workload characteristics rather than IP addresses, which can change.

Question 4

Which of the following is NOT a supported IPAM mode in Cilium?
  1. A.Cluster Pool
  2. B.Kubernetes Host Scope
  3. C.CRD-based
  4. D.Kubernetes PodCIDR
  5. E.Host-Local

Correct answer: E

Cilium supports several IPAM modes including Cluster Pool (default), Kubernetes (using PodCIDR from the node spec), and CRD-based IPAM, but "Host-Local" is not a supported IPAM mode in Cilium.

Network Policy (4 questions)

Question 5

Which policy enforcement mode in Cilium enforces policies only on endpoints that match at least one network policy?
  1. A.default
  2. B.always
  3. C.never
  4. D.selective

Correct answer: C

The "never" enforcement mode only applies policies to endpoints that match at least one network policy. This is different from "default" (which denies traffic to pods without matching policies) and "always" (which enforces policies on all endpoints).

Question 6

What happens if you have a CiliumNetworkPolicy with both ingress and egress rules, but do not specify policyTypes?
  1. A.The policy applies only ingress rules by default
  2. B.The policy applies both ingress and egress rules
  3. C.The policy will be rejected as invalid
  4. D.The policy applies only egress rules by default

Correct answer: B

If a CiliumNetworkPolicy includes both ingress and egress rules but does not specify policyTypes, it applies both the ingress and egress rules. The behavior is similar to Kubernetes NetworkPolicy, where the presence of ingress/egress rules implicitly enables those policy types.

Question 7

Which of the following is a valid Layer 7 protocol rule that can be enforced by Cilium?
  1. A.Restricting access based on HTTP methods and paths
  2. B.Filtering traffic based on the pod's startup time
  3. C.Allowing traffic only when the node CPU usage is below a threshold
  4. D.Limiting bandwidth for specific pods

Correct answer: A

Cilium can enforce Layer 7 protocol rules such as restricting access based on HTTP methods and paths, allowing fine-grained API-level access control.

Question 8

Which field in a CiliumNetworkPolicy allows restricting traffic based on specific DNS names?
  1. A.toDNS
  2. B.toFQDN
  3. C.toDomains
  4. D.toHostnames

Correct answer: B

The toFQDN field in a CiliumNetworkPolicy allows restricting traffic based on specific DNS names. This enables policies based on domain names rather than IP addresses, which is particularly useful for external services with changing IPs.

Service Mesh (3 questions)

Question 9

Which of the following Gateway API configurations correctly creates a Gateway listening on port 80 for HTTP traffic?
  1. A.
    apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: example-gateway
spec:
  gatewayClassName: cilium
  listeners:
  - name: http
    protocol: HTTP
    port: 80
    allowedRoutes:
      namespaces:
        from: Same
  2. B.
    apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: example-gateway
spec:
  className: cilium
  listeners:
  - name: http
    protocol: HTTP
    port: 80
    routes:
      namespaces:
        from: Same
  3. C.
    apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: example-gateway
spec:
  gatewayClassName: cilium
  ports:
  - name: http
    protocol: HTTP
    number: 80
  routes:
    namespaceSelector:
      matchLabels:
        kubernetes.io/metadata.name: default
  4. D.
    apiVersion: gateway.networking.k8s.io/v1beta1
kind: GatewayClass
metadata:
  name: example-gateway
spec:
  controllerName: io.cilium/gateway-controller
  listeners:
  - name: http
    protocol: HTTP
    port: 80

Correct answer: A

This is the correct Gateway API configuration for creating a Gateway listening on port 80 for HTTP traffic with Cilium as the controller. It includes the required fields gatewayClassName, listeners with appropriate protocol and port, and allowedRoutes to specify which routes can attach to this gateway.

Question 10

Which command can be used to verify the status of Cilium's Ingress Controller implementation?
  1. A.cilium status --ingress
  2. B.kubectl get ingresscontrollers -n kube-system
  3. C.cilium ingress list
  4. D.kubectl get pods -n kube-system -l k8s-app=cilium -o jsonpath='{.items[0].status.conditions}'

Correct answer: D

There is no dedicated command to check Cilium's Ingress Controller status. You would typically verify it by checking the Cilium pods themselves or examining the conditions/status of the pods. The other options are either non-existent commands or incorrect approaches.

Question 11

Which encryption method in Cilium preserves the original IP addresses of pods when communicating between nodes?
  1. A.VXLAN with IPsec
  2. B.WireGuard
  3. C.TLS Passthrough
  4. D.mTLS with Envoy

Correct answer: B

WireGuard encryption in Cilium preserves the original IP addresses of pods when communicating between nodes. Unlike some other encryption methods that might use tunneling or encapsulation, WireGuard operates at a lower level that doesn't alter the packet's source and destination addresses.

Network Observability (2 questions)

Question 12

Which of the following CLI commands would show HTTP flows with status code 404?
  1. A.hubble observe --http-status 404
  2. B.hubble observe --type http --http-status 404
  3. C.hubble observe --protocol http --status-code 404
  4. D.hubble observe --filter "http.status == 404"

Correct answer: B

The correct command to show HTTP flows with status code 404 is "hubble observe --type http --http-status 404". This filters for HTTP traffic and specifically for responses with the 404 status code.

Question 13

What command would you use to view real-time network flows between pods with Hubble?
  1. A.kubectl exec -n kube-system cilium-xxxx -- cilium monitor
  2. B.cilium hubble ui
  3. C.hubble observe --follow
  4. D.kubectl logs -n kube-system hubble-xxx

Correct answer: C

The command "hubble observe --follow" shows a real-time stream of network flows between pods using Hubble.

Installation and Configuration (2 questions)

Question 14

Which CLI command would you use to upgrade Cilium to a specific version?
  1. A.cilium upgrade --version 1.13.0
  2. B.helm upgrade cilium cilium/cilium --version 1.13.0
  3. C.kubectl patch cilium -n kube-system --type merge -p '{"version":"1.13.0"}'
  4. D.cilium update 1.13.0

Correct answer: A

The "cilium upgrade --version 1.13.0" command is used to upgrade Cilium to a specific version using the Cilium CLI. This performs a rolling upgrade of all Cilium components.

Question 15

Which tool can be used to validate Cilium and eBPF requirements on a node before installation?
  1. A.cilium-preflight-check
  2. B.cilium-system-validator
  3. C.cilium-kernel-check
  4. D.cilium-sysdump

Correct answer: A

The cilium-preflight-check tool can be used to validate Cilium and eBPF requirements on a node before installation. It verifies kernel version, required features, and other prerequisites to ensure Cilium will function correctly on the node.

Cluster Mesh (2 questions)

Question 16

In a Cluster Mesh setup, what's the maximum recommended number of clusters that can be connected?
  1. A.There is no practical limit
  2. B.255 clusters
  3. C.100 clusters
  4. D.5 clusters

Correct answer: A

In a Cluster Mesh setup, there is no practical limit to the number of clusters that can be connected. While there are scaling considerations, Cilium's architecture allows for large numbers of connected clusters without hard limits.

Question 17

Which annotation makes a Kubernetes Service globally available across a Cluster Mesh?
  1. A.cilium.io/global: "true"
  2. B.clustermesh.cilium.io/global-service: "true"
  3. C.io.cilium/global-service: "true"
  4. D.io.cilium/shared-service: "true"

Correct answer: C

The annotation "io.cilium/global-service: "true"" makes a Kubernetes Service globally available across a Cluster Mesh, allowing it to be accessed from any cluster in the mesh.

eBPF (2 questions)

Question 18

How does eBPF provide better performance compared to iptables for network policy enforcement?
  1. A.By optimizing rule ordering automatically
  2. B.By using efficient map lookups instead of sequential rule evaluation
  3. C.By offloading processing to specialized hardware
  4. D.By caching policy decisions in user space

Correct answer: B

eBPF provides better performance compared to iptables for network policy enforcement by using efficient map lookups instead of sequential rule evaluation. While iptables must evaluate rules in sequence (O(n) complexity), eBPF can use hash maps or other optimized data structures for O(1) or O(log n) lookups.

Question 19

Which eBPF hook point does Cilium use for implementing transparent encryption?
  1. A.tc egress
  2. B.XDP
  3. C.Socket
  4. D.cgroup

Correct answer: A

Cilium uses the tc (Traffic Control) egress hook point for implementing transparent encryption. This hook allows Cilium to intercept and encrypt outgoing packets before they leave the node, and to decrypt incoming packets.

BGP and External Networking (1 question)

Question 20

What's the difference between using direct routing and BGP for pod networking in Cilium?
  1. A.Direct routing only works within a single subnet, while BGP works across subnets
  2. B.Direct routing requires manual route configuration, while BGP automates route distribution
  3. C.Direct routing supports only IPv4, while BGP supports both IPv4 and IPv6
  4. D.Direct routing provides higher performance, while BGP offers more flexibility

Correct answer: B

The key difference between using direct routing and BGP for pod networking in Cilium is that direct routing typically requires manual route configuration in external routers, while BGP automates route distribution by dynamically advertising pod CIDR blocks to external routers.

Score yourself

The Linux Foundation lists a passing score of 75% for CCA. On a set of 20 questions that is 15 correct. Reaching 15 here is a useful signal and not a prediction: 20 questions is a small sample, and the real exam covers every domain in its published weights. Use the table below to decide what to do next. Count only the questions you answered correctly without help, and be strict about it: a question you got right for the wrong reason belongs in the missed pile. Then repeat the exercise a few days later with a different set from the full bank so that you are measuring understanding and not memory of these specific questions.

Count your misses per domain, using the headings above. One missed question in a domain is noise; three misses in one domain is a study plan. The practice mode on GoldenKube does this sorting for you by sending you back to the domains where you are weakest.

Correct out of 20What it suggestsWhat to do next
18 to 20The basics are solid in the domains sampled.Move to harder mixed practice and check the domains this set did not cover.
15 to 17Close to the benchmark, with some gaps.Review every missed explanation, then practise the domains where you missed questions.
11 to 14Several domains need real study.Read the official curriculum for those domains, then return to practice.
0 to 10You are early in your preparation.Start from the curriculum and the project documentation, then retry this set.

Architecture: what it tests

Architecture covers how Cilium is put together and why it works the way it does. Expect the agent that runs on every node, the operator, the CNI plugin, the datapath, identity-based networking where security identities replace IP addresses, and how Cilium relates to kube-proxy and to the rest of the cluster. Questions ask which component performs a task or why identity-based policy scales better than address-based rules. A common trap is attributing cluster-wide tasks to the per-node agent when they belong to the operator, or the reverse, so learn the split of responsibilities clearly. Reading a description of a traffic flow and naming each component that touches it is the usual shape of the question.

Draw the components on one node and one control-plane view, and mark where state is stored and where policy is enforced. Architecture questions are lookups in that drawing.

Network Policy: what it tests

Network Policy covers how Cilium decides what traffic is allowed. Expect Kubernetes NetworkPolicy and the Cilium-specific policy resources, selection by identity and labels, rules at layers 3, 4 and 7, DNS-based and entity-based rules, default-deny behaviour and the policy enforcement modes. Questions give a policy and ask whether a flow is allowed, or ask for the rule that achieves a goal. The traps are default-deny semantics, where selecting a workload for ingress changes what is allowed for it, and the difference between a layer 4 port rule and a layer 7 rule that inspects the request. Remember that policy is evaluated per direction, so check ingress and egress separately before deciding that a connection works.

Work through five small policies and decide for each flow whether it is allowed, then check your reasoning against the explanation. Policy evaluation is a skill that improves with repetition.

Service Mesh: what it tests

Service Mesh covers what Cilium offers for service-to-service traffic. Expect ingress and the Gateway API, mutual authentication between workloads, traffic management such as routing and load balancing, the role of Envoy in layer 7 handling, and how Cilium's approach differs from a sidecar-based mesh. Questions ask which feature provides which capability and how traffic flows through the components. The trap is assuming that every mesh feature needs a sidecar in each Pod, when the point of the Cilium design is to avoid that, so be ready to explain where the proxy runs. Questions in this area usually ask where a capability is implemented, so pay attention to whether the answer involves the node agent or a proxy.

Compare a sidecar mesh with the Cilium approach in three bullet points: where the proxy runs, what it costs, and what it can see. Those three points cover most comparisons.

Network Observability: what it tests

Network Observability covers seeing what is happening in the network. Expect Hubble, its relay, command line client and user interface, flow records with identities and verdicts, metrics exported for monitoring, and how flow data helps debug a dropped connection or verify a policy. Questions ask which tool shows a given piece of information or how to find out why traffic was denied. A common trap is treating Hubble as a separate product, when it is built on the same datapath data, so it can show policy verdicts that ordinary packet captures cannot attribute to a rule. The exam tends to describe a symptom and ask which view reveals its cause, so link each symptom to the data that exposes it.

For three failure stories, such as a blocked connection, a DNS failure and a misrouted request, write which Hubble view you would open first and what you expect to see.

Installation and Configuration: what it tests

Installation and Configuration covers getting Cilium running and tuning it. Expect installing with the command line tool or Helm, choosing an IP address management mode, enabling features through configuration, checking status and connectivity, and upgrading safely. Questions ask which command or setting does a task, or what to check when an installation looks unhealthy. The trap is mixing the configuration surface: some options live in Helm values and the ConfigMap, others in the CLI flags used during installation. Knowing the verification steps that follow an installation is as valuable as knowing the installation steps. Pay attention to which options can be changed after installation and which require a reinstall or a careful upgrade.

Go through an install, a status check and a connectivity test in order, noting which command prints which result. The exam asks about each step, usually in a short scenario.

Cluster Mesh: what it tests

Cluster Mesh covers connecting several Kubernetes clusters with Cilium. Expect the requirements for connecting clusters such as unique cluster names and identifiers and non-overlapping address ranges, the API server that shares state between clusters, global services and load balancing across clusters, and policy that spans clusters. Questions ask what must be true before clusters can be joined or how a global service behaves. The common trap is overlooking the preconditions, since an overlapping address range or a duplicated cluster identifier is a typical reason a mesh fails to form. Pay attention to which behaviours depend on shared state across the clusters and which stay local to each cluster, because the questions often separate the two.

Make a short checklist of prerequisites and the symptom each missing item causes. Troubleshooting questions in this domain nearly always reduce to one item on that list.

eBPF: what it tests

eBPF covers the kernel technology underneath Cilium. Expect what eBPF is, how programs are loaded and checked by the verifier, attachment points in the networking stack, maps that share state between kernel and user space, and why running in the kernel gives performance and visibility advantages. Questions are conceptual and ask what eBPF makes possible or why Cilium uses it. The trap is treating eBPF as only a networking feature, when it is a general mechanism that Cilium applies to networking, observability and security, so the exam may ask about benefits that go beyond packet forwarding. Expect short conceptual questions where one option overstates what the kernel technology does by itself, so favour the careful statement over the dramatic one.

Explain eBPF in four sentences to an imaginary colleague: what runs, where it runs, who checks it and how it talks to user space. If the explanation holds together, the questions will too.

BGP and External Networking: what it tests

BGP and External Networking covers connecting a cluster to the networks outside it. Expect the BGP control plane in Cilium, advertising Pod address ranges and service addresses to routers, peering configuration, load balancer address handling, and egress controls for traffic leaving the cluster. Questions ask what is advertised, to whom and why. The trap is mixing the direction of information: BGP here lets the cluster announce its own routes to the network so that external clients can reach services, which differs from the cluster learning every external route. The domain is small but its terms are distinct from the rest of the exam.

Learn the handful of BGP terms the domain uses, such as peer, advertisement and autonomous system, and attach each to one sentence about what it does in a cluster.

What a 20-question CCA sample can and cannot tell you

A set of 20 questions is a screening test, not a measurement. With only a few questions per domain, one lucky guess or one unlucky wording moves your result by five percentage points, and a domain with only two questions behind it says almost nothing about that domain's true strength. The set is also fixed, so after one read-through it measures your memory of these items and not your command of CCA. Use it to choose where to start studying, not to decide whether you are ready, and then rely on the larger bank, where questions repeat only after a gap and the app tracks which domains stay weak.

A second limit is style. Written practice questions share one author voice, while a real exam draws on many writers and reads differently. Treat any practice score, here or elsewhere, as one input next to the official curriculum, hands-on experience with the technology, and the documentation of the project itself.

A one-week plan after the CCA sample set

After the sample set, spend a week turning the result into a plan. Start with the domains where you missed questions and read the matching part of the official curriculum before you try more questions, because practice is far more useful once you can explain the topic. Return to practice in short daily sessions, review every missed question the next day, and leave the last day for a fresh mixed set. Keep a simple note of which concepts caused misses; the same three or four ideas usually explain most of them, and naming them is what turns practice into progress.

The largest CCA domain is Architecture, at 20% of the published weights. If two domains tie for weakest in your tally, start with the heavier one, and keep the other 7 domains ticking over with short reviews.

Adjust the pace to your calendar. If you have more time, spread the same steps over two or three weeks and add a second mixed session at the end of each week. If you have less, keep days 1 to 3 and day 6 and accept a rougher picture. What matters is that every study session starts from a specific weak domain and ends with a check, not that the plan is followed to the letter.

DayTask
1Tally misses per domain and rank the domains from weakest to strongest.
2Read the official curriculum and documentation for the weakest domain.
3Practise that domain in the app and read every explanation.
4Repeat the exercise for the second weakest domain.
5Review the questions you missed on days 3 and 4 without looking at notes.
6Do a mixed session across all domains and compare the result with this page.
7Rest, then retake the 20 questions on this page and note which misses persist.

Practice the full CCA bank

These 20 questions are a small slice of the GoldenKube CCA bank, which holds more than 100 questions. In practice mode the app serves the questions you are due to review first, then the domain where you are weakest, and it brings missed questions back after a gap until you answer them correctly. You can answer 10 questions as a guest without an account; after that a free account keeps your progress, and no credit card is asked for at any point. Each answer comes with the same kind of written explanation you saw on this page, so a wrong answer is always followed by the reasoning that fixes it.

Practice mode shows one question at a time and gives the verdict and explanation as soon as you answer. A focus option lets you stay inside a single domain until it feels solid, which is the natural next step after finding your weakest domain on this page. There is no timer and no exam simulation in practice mode; the goal is learning, not performance under pressure.

Practice CCA

Frequently asked questions

Are these the real CCA exam questions?

No. They are practice questions written for GoldenKube to cover the published CCA domains. GoldenKube does not have the real exam, does not claim any overlap with it, and does not sell or share exam content. Use them to find gaps in your understanding, not to predict what you will be asked.

How many CCA questions does GoldenKube have?

The CCA bank holds more than 100 questions as of 2026-10-23. This page shows 20 of them. The full bank is available in practice mode, where the app chooses what to show you next based on what you have already answered and what you got wrong.

Do the answers come with explanations?

Yes. Every question on this page has the correct answer marked and a written explanation of why it is correct and, where useful, why the other options are not. Only questions that have an explanation are published on public pages, and where a question carries references they are listed under the explanation.

Is this free?

Yes. Reading this page needs no account. In the practice app you can answer 10 questions as a guest, and then you create a free account to continue. No credit card is requested at any point.

How were these 20 questions chosen?

A script picks them with a fixed seed, so the set does not change between visits. It considers only questions that have a written explanation and tries to follow the published domain weights. The domain labels in the bank do not always match the official wording, so a domain can be thinly represented in a single set of 20; the full bank is the better measure of coverage.

How often is this page updated?

The exam facts and the domain list were last checked against the Linux Foundation pages on 2026-10-23, and the page shows its update date at the top. When the curriculum changes or questions are added, corrected or removed in the bank, the page is reviewed again.

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation.