CCA practice test
Cilium Certified Associate · free · 102 questions in the bank today
By Ibrahim Yesilay · Published · Updated
Start a free CCA practice test: Cilium Certified Associate questions with an instant verdict and explanation, an order that returns to your weakest domains, and a timed mock in the official format. The official CCA exam is 60 questions in 90 minutes with a passing score of 75%, as read from the Linux Foundation documentation on 2026-10-28.
Ten guest answers need no account; mock exams need a free one. Independent practice, not affiliated with the CNCF or the Linux Foundation.
CCA exam snapshot
Exam facts from the Linux Foundation pages, checked 2026-10-28; full table with sources on the CCA certification page.
What this CCA practice test is
This page starts a free CCA practice session on GoldenKube. The official CCA exam is 60 questions in 90 minutes with a passing score of 75%, as read from the Linux Foundation documentation on 2026-10-28. The GoldenKube CCA bank held 102 questions when this page was written; the live count is shown above. One question at a time. As soon as you answer you see whether you were right and read the explanation; reloading the page keeps the verdict on screen. The next question comes from the questions due for review first, then from the domain where you are weakest and still have unseen questions, then from the rest of the bank. Use it next to a local cluster running Cilium; most questions describe a policy, a Hubble flow or a CLI command and ask what happens.
Every CCA question in the bank has a written explanation, so a wrong answer is always followed by the reasoning that fixes it.
What the CCA bank covers
The CCA bank covers all eight official domains with a similar number of questions each, which flattens the exam weights: Installation and Configuration holds a larger share of the bank than its weight, and Architecture a smaller one. The table compares the official domain weights, checked against the CCA certification page on 2026-10-28, with the share of the bank each domain holds and the number of explained questions, both read from the database when the page is served. Architecture is the heaviest domain at 20%, so it deserves the largest share of your study time whatever the bank's share is.
| Official domain | Exam weight | Bank share | Questions | Explained |
|---|---|---|---|---|
| Architecture | 20% | 15% | 15 | 15 |
| Network Policy | 18% | 15% | 15 | 15 |
| Service Mesh | 16% | 16% | 16 | 16 |
| Network Observability | 10% | 13% | 13 | 13 |
| Installation and Configuration | 10% | 15% | 15 | 15 |
| Cluster Mesh | 10% | 12% | 12 | 12 |
| eBPF | 10% | 7.8% | 8 | 8 |
| BGP and External Networking | 6% | 7.8% | 8 | 8 |
All 102 questions have a written explanation. Live from the database; the CCA bank coverage report explains the method.
A domain whose bank share is well below its weight is one to study from the official curriculum and the project documentation as well; the bank-coverage report linked below tracks these gaps over time.
How the bank covers the CCA curriculum
CCA spreads its weight over eight domains, more than any other associate exam in the Golden Kubestronaut program, and the CNCF curriculum lists between two and five topics under each. The GoldenKube CCA bank is small enough that every domain has roughly the same handful of questions, from 8 for eBPF and for BGP up to 16 for Service Mesh. That evens out the weights: Architecture, the largest domain at 20%, has 15 questions, the same as Installation and Configuration at 10%. Read the cards as a map of where the bank is thin relative to the exam, and give Architecture and Network Policy extra time in the Cilium documentation. Every question in the bank maps to one official domain, so there is no mixed-practice note. The topic lists quote the curriculum PDF.
Architecture
20% of the exam · 15 questions in the bank
What each Cilium component does, how IP addresses are managed and which datapath model a cluster runs.
Official curriculum topics
- Understand the Role of Cilium in Kubernetes Environments
- Cilium Architecture
- IP Address Management (IPAM) with Cilium
- Cilium Component Roles
- Datapath Models
Network Policy
18% of the exam · 15 questions in the bank
Whether you can read a Cilium policy, predict what it allows and explain how identity-based enforcement differs from Kubernetes NetworkPolicy.
Official curriculum topics
- Interpret Cilium Network Policies and Intent
- Understand Cilium's Identity-based Network Security Model
- Policy Enforcement Modes
- Policy Rule Structure
- Kubernetes Network Policies versus Cilium Network Policies
Service Mesh
16% of the exam · 16 questions in the bank
How Cilium handles ingress routing, encryption in transit and mesh features with and without sidecars.
Official curriculum topics
- Know How to use Ingress or Gateway API for Ingress Routing
- Service Mesh Use Cases
- Understand the Benefits of Gateway API over Ingress
- Encrypting Traffic in Transit with Cilium
- Sidecar-based versus Sidecarless Architectures
Network Observability
10% of the exam · 13 questions in the bank
What Hubble can show, how layer 7 visibility is switched on and how flows are read from the CLI or the UI.
Official curriculum topics
- Understand the Observability Capabilities of Hubble
- Enabling Layer 7 Protocol Visibility
- Know How to Use Hubble from the Command Line or the Hubble UI
Installation and Configuration
10% of the exam · 15 questions in the bank
How the Cilium CLI installs Cilium, runs connectivity tests, reports status and changes configuration.
Official curriculum topics
- Know How to Use Cilium CLI to Query and Modify the Configuration
- Using Cilium CLI to Install Cilium, Run Connectivity Tests, and Monitor its Status
Cluster Mesh
10% of the exam · 12 questions in the bank
Why clusters are meshed and how services are discovered and load-balanced across them.
Official curriculum topics
- Understand the Benefits of Cluster Mesh for Multi-cluster Connectivity
- Achieve Service Discovery and Load Balancing Across Clusters with Cluster Mesh
eBPF
10% of the exam · 8 questions in the bank
What eBPF gives Cilium and how an eBPF datapath compares with an iptables-based one.
Official curriculum topics
- Understand the Role of eBPF in Cilium
- eBPF Key Benefits
- eBPF-based Platforms versus IPtables-based Platforms
BGP and External Networking
6% of the exam · 8 questions in the bank
How traffic leaves the cluster and how Cilium-managed clusters connect to outside networks.
Official curriculum topics
- Egress Connectivity Requirements
- Understand Options to Connect Cilium-managed Clusters with External Networks
Weights from the official certification page; question counts from the GoldenKube bank when this page was built; topics as named in the CNCF curriculum PDF listed under Sources.
Try three CCA questions
Three questions from the bank with their answers and explanations. The CCA sample-questions page has twenty more; the practice session has the whole bank.
Question 1
- A.tc egress
- B.XDP
- C.Socket
- D.cgroup
Correct answer: A
Question 2
- A.
kubectl exec -n kube-system cilium-xxxx -- cilium monitor - B.
cilium hubble ui - C.
hubble observe --follow - D.
kubectl logs -n kube-system hubble-xxx
Correct answer: C
Question 3
- A.Cluster Pool
- B.Kubernetes Host Scope
- C.CRD-based
- D.Host-Local
Correct answer: D
How to practise CCA with GoldenKube
With 102 questions, the CCA bank can be answered end to end in a few sessions, so the loop is less about coverage and more about turning each miss into a small experiment. Answer the whole bank once in the adaptive order, which serves your weakest subdomain first and keeps returning misses on the review ladder: 12 other answers later, then 1 day later, then 4 days after that. Once every question has been seen and no review is due, practice shows Nothing left to practice right now, with buttons to take pending reviews early or send your mistakes back to the start. That is the moment to switch to a local cluster: install Cilium, apply one of the policies from a missed question and watch the flows in Hubble. Then come back for the due reviews. Two timed mocks close the loop; a 60-question mock draws more than half of this bank, so most of its questions will be familiar by then; judge it by the domain breakdown rather than by the score.
The 14-day loop, and the same steps in 7 days
- Days 1-27-day plan: Day 1Answer in the adaptive order until roughly half the bank is seen. Bookmark every policy question you could not predict.
- Days 3-47-day plan: Day 2Finish the bank. Focus mode on Network Policy and Architecture, the two heaviest domains.
- Days 5-77-day plan: Day 3On a local cluster, install Cilium with the Cilium CLI, run the connectivity test, apply a bookmarked policy and observe the flows with Hubble.
- Days 8-97-day plan: Day 4Clear the due reviews in the Review center, then Focus mode on Service Mesh and Network Observability.
- Day 107-day plan: Day 5First timed mock exam; read every explanation on the result page.
- Days 11-137-day plan: Day 6Focus mode on the two weakest domains in the mock breakdown, then practise the bookmarks list.
- Day 147-day plan: Day 7Second mock exam. Compare the domain breakdown with the first one, not just the total.
The hands-on step is outside GoldenKube: the CCA is multiple choice, but its options often differ in one field of a policy or one CLI flag, and seeing the behaviour once on a cluster settles those questions faster than rereading.
Common CCA mistakes
CCA questions often describe a cluster and ask what traffic is allowed or what Hubble will show. The traps below are about defaults, because a candidate who knows the feature but not its default picks the wrong option. Each item is stated as the Cilium documentation or ebpf.io states it, for Cilium 1.20 at the time of writing, and links to the page.
1. Forgetting that the first policy flips an endpoint to default deny
Endpoints start with unrestricted access. As soon as any rule with an ingress section selects an endpoint, it denies all ingress not explicitly allowed; egress works the same way, separately, per direction.
2. Mixing up the three enforcement modes
default enforces only on endpoints selected by a policy, always enforces on every endpoint even without a selecting rule, and never disables enforcement even when rules select endpoints. The Helm value is policyEnforcementMode.
3. Thinking Cilium policy is IP-based
Every endpoint gets a security identity derived from its security-relevant labels, and endpoints with the same labels share one identity. Enforcement uses that identity, which is why policy scales as Pods come and go.
4. Expecting HTTP details in Hubble without an L7 rule
By default Hubble sees layer 3 and 4 events. Layer 7 visibility needs L7 proxy support and a CiliumNetworkPolicy with L7 rules, and those rules also restrict which requests are allowed.
5. Assuming EnableDefaultDeny covers layer 7
A policy can be written so it does not switch an endpoint into default deny, but that option does not apply to layer 7: an L7 rule without an L7 allow-all still causes drops.
6. Assuming Cilium replaces kube-proxy by default
The Helm chart sets kubeProxyReplacement=false by default, which only enables per-packet in-cluster load balancing of ClusterIP services. Full replacement is opted into with kubeProxyReplacement=true.
7. Describing eBPF programs as kernel modules
eBPF runs sandboxed programs in the kernel without changing kernel source or loading modules. A verifier checks each program is safe before it runs, and a JIT compiler turns it into native instructions.
Source: ebpf.io: What is eBPF?
Mock exam
The CCA mock exam draws 60 questions from the bank, gives you 90 minutes and scores the run against the 75% threshold, the same numbers as the official format. It is a timed rehearsal of pacing and stamina, not a prediction: the questions are GoldenKube's own and the result is practice feedback. Mock exams need a free account; your history of runs is kept on the exam's mock page.
Frequently asked questions
Is the CCA practice test free?
Yes. Your first 10 answers need no account. After that a free account keeps your progress; there is no paid tier and no card.
How many CCA questions are there?
102 when this page was written; the live count from the database is shown at the top of the page. Questions are added and corrected over time.
Does the CCA practice test match the real exam format?
The mock exam uses the published format: 60 questions, 90 minutes, 75% to pass. Practice mode is untimed and adaptive. The questions themselves are GoldenKube's own, not exam content.
Where are more sample questions with answers?
The CCA sample-questions page shows 20 questions with answers and explanations without an account, and each CCA topic page shows three more for its subdomain.
What is the difference between the XDP and tc hooks Cilium uses?
XDP runs at the earliest point in the network driver, before any other processing, which suits filtering and DDoS protection. The tc ingress and egress hooks run after the stack has done initial processing but before layer 3, with access to most packet metadata, which suits applying L3/L4 endpoint policy.
How are Cilium security identities represented?
They are generated from labels and stored as unsigned 32-bit integers, so the smallest identity is 1 and the largest is 2^32 - 1. All endpoints that share the same security-relevant labels share one identity across the cluster.
Which Cilium CLI tasks does the curriculum expect?
The Installation and Configuration domain lists installing Cilium, running connectivity tests, monitoring its status, and querying and modifying the configuration with the Cilium CLI. The Hubble setup guide adds cilium hubble enable, which deploys Hubble Relay.
Sources
- Cilium Certified Associate (official certification page) (read )
- CNCF curriculum: CCA Curriculum (PDF) (read )
- Cilium docs: Security identities (read )
- Cilium docs: eBPF datapath introduction (read )
- Cilium docs: Setting up Hubble observability (read )
- Cilium docs: Policy enforcement modes (read )
- Cilium docs: Terminology (identity) (read )
- Cilium docs: Layer 7 protocol visibility (read )
- Cilium docs: Kubernetes without kube-proxy (read )
- ebpf.io: What is eBPF? (read )
Last updated