Linux Foundation Cilium-Associate Exam Dumps

B is the best answer, with two qualifications. First, ''pop-to-pod'' is evidently a source typo for ''pod-to-pod.'' Second, default WireGuard mode encrypts traffic between Cilium-managed pods on different nodes; node-to-node, pod-to-node, and node-to-pod coverage requires enabling the additional encryption.nodeEncryption=true mode.

Cilium creates WireGuard peers per node, not per pod. Each Cilium agent generates a node key pair, advertises the public key through its CiliumNode resource, and forms secure tunnels with other known nodes. This makes D incorrect. Same-node packets do not traverse a WireGuard tunnel because encryption cannot protect them from an observer already able to inspect raw traffic on that host, so A reverses the documented behavior.

C also reverses the encapsulation sequence. In tunnel-routing mode, pod traffic is first encapsulated for the VXLAN or Geneve overlay and is then encapsulated by WireGuard. The result is double encapsulation, with WireGuard protecting the overlay packet while it crosses the network between nodes.

Thus, B describes WireGuard's supported traffic coverage most closely, but exam candidates should remember the separate node-encryption configuration requirement.

Official references

WireGuard Transparent Encryption

Study Guide topic: WireGuard peer architecture, encrypted traffic matrix, same-node behavior, and encapsulation order.

In cluster-scope IPAM, the Cilium Operator allocates a PodCIDR to each node from the configured cluster-wide address pool. It records those allocations in each node's CiliumNode custom resource, specifically under spec.ipam.podCIDRs. The Cilium agent waits for this allocation during startup and then performs host-local allocation of individual pod addresses from the CIDR assigned to its node.

This division of responsibility explains why C is correct. The agent consumes its assigned range and allocates endpoint addresses locally, but it does not independently choose the cluster-wide per-node PodCIDR. The Operator coordinates those ranges to prevent nodes from receiving overlapping allocations.

Options A and D describe Kubernetes host-scope IPAM rather than Cilium cluster-scope IPAM. In Kubernetes host-scope mode, the Kubernetes controller manager assigns PodCIDRs and exposes them through spec.podCIDR or spec.podCIDRs in the standard Kubernetes Node resource. Cluster-scope mode is specifically useful when Kubernetes is not configured to perform that allocation or when Cilium should control the cluster address pool.

Therefore, the managing component and resource are the Cilium Operator and CiliumNode, respectively.

Official references

Cluster-Pool IPAM; Cluster Scope IPAM.

Study Guide topic: Installation and Configuration.

Cilium's official documentation confirms that a CiliumEgressGatewayPolicy selects traffic originating from matching pods, routes traffic destined for the configured destinationCIDRs through the selected egress gateway node, and SNATs that traffic using the configured egressIP.

For every pod managed by Cilium, the responsible node-local Cilium agent creates a CiliumEndpoint object with the same name and namespace. The object exposes endpoint state such as labels, the allocated security identity, addressing information, and effective policy. The agents also create endpoint objects for their inter-agent health endpoints. B is therefore correct.

The other responsibilities belong primarily to the Cilium Operator. The operator normally registers Cilium's CustomResourceDefinitions, manages addresses for LoadBalancer Services when LB IPAM is active, and performs configured cluster-wide synchronization or shared-state operations. It also garbage-collects orphaned CiliumEndpoint resources when their associated pods no longer exist or have permanently completed.

The Cilium agent itself runs on each node. It responds to workload lifecycle events, creates and manages local endpoints, loads eBPF programs, applies policies, and maintains the node's datapath. This division ensures that latency-sensitive forwarding and endpoint operations remain node-local while logically cluster-wide activities are consolidated in the operator.

Official references

CiliumEndpoint CRD, Cilium Operator Responsibilities

Study Guide topic: Cilium agent, Cilium Operator, and CiliumEndpoint lifecycle.

Cilium tunnel mode supports VXLAN and Geneve encapsulation. In this routing model, Cilium nodes form an overlay mesh, and traffic exchanged between nodes is carried inside UDP-encapsulated packets. VXLAN is the default tunnel protocol and normally uses UDP port 8472. Geneve is the alternative and normally uses UDP port 6081. Operators select the protocol through the tunnel-protocol configuration setting, whose documented values are vxlan and geneve.

Encapsulation reduces the requirements placed on the underlying network. The underlay only needs to provide IP connectivity between the Kubernetes nodes and permit the selected UDP tunnel port. It does not need to learn or route individual PodCIDRs. Cilium also uses the tunnel metadata to carry information such as the source security identity, avoiding an additional identity lookup on the receiving node.

MPLS, OTV, STT, and EVPN are not supported values for Cilium's tunnel-protocol setting. EVPN may be used in broader data-center network designs, and MPLS is a carrier-routing technology, but neither is a Cilium overlay encapsulation choice. Therefore, B is the only supported pair.

Official references

Cilium Routing; System Requirements.

Study Guide topic: Architecture.