A.  

HAProxy

B.  

Squid

C.  

Linkerd2-proxy

D.  

Envoy

A.  

cilium log level --set=debug

B.  

cilium logging.level=debug

C.  

cilium config set debug true

D.  

cilium logging debug

A.  

cilium status

B.  

cilium sysdump

C.  

cilium context

D.  

cilium config view

A.  

The Kubernetes cluster where Cilium has been deployed should consist of four nodes.

B.  

When specific Cilium features require Layer 7 processing, the Cilium agent starts an Envoy proxy as a separate process within the Cilium agent pod.

C.  

The component that allows you to query multiple Hubble instances simultaneously and aggregate the results is unhealthy.

D.  

Cilium has been installed and configured in a multi-cluster deployment model to provide load balancing and service discovery.

A.  

Migrating to Cilium and Hubble by reconfiguring /etc/cni/net .6/ to point to Cilium and restarting the nodes, accepting an outage.

B.  

Install Hubble on the cluster without Cilium. Hubble can be deployed in a standalone model by downloading and installing the Hubble binary

C.  

Install Cilium and Hubble on top of the cluster in a CNI chaining model, without disrupting the existing CNI.

D.  

Migrating to Cilium and Hubble on a node-by-node basis, without requiring a complete cluster outage, by using Dual Overlays.

A.  

cilium config view

B.  

cilium show config

C.  

kubectl describe ciliumconfig.ciliu � .io

D.  

cilium show run

A.  

Packets are encrypted when they are destined to the same node from which they were sent. This is to ensure confidentiality of traffic within the node.

B.  

It provides encryption for node-to-node, pod-to-node, node-to-pod, and pop-to-pod traffic as long as the pods are on different nodes.

C.  

When running in the tunneling mode, pod-to-pod traffic will be sent over the WireGuard tunnel before being transmitted over the overlay tunnel.

D.  

When WireGuard is enabled in Cilium, each pod will establish a secure WireGuard tunnel between it and all other known pods in the cluster.

A.  

DNS visibility in available in the ingress direction only.

B.  

It can be enabled by deploying a standard Kubernetes network policy.

C.  

It results in traffic being proxied through an Envoy instance.

D.  

It supports any Layer 7 protocols, including SSH, Telnet and FTP.

A.  

By default, data of SPIRE is stored In memory.

B.  

Cilium's Mutual authentication has been validated with SPIFFE, the production-ready implementation of SPIRE.

C.  

Enabling Mutual Authentication on Cilium requires installing, managing, and configuring a SPIRE server.

D.  

Through SPIRE, TLS certificates are automatically managed and frequently rotated.

A.  

Cilium Agent registers the Custom Resource Definitions that Cilium uses.

B.  

Cilium Agent creates the CiliumEndpoint objects for each pod in the cluster.

C.  

Cilium Agent manages IP addresses for LoadBalancer type services (if LB IPAM is used).

D.  

Cilium Agent synchronizes Kubernetes nodes information to the shared KVStore.

A.  

The manifest cannot specify both an interface and an egress IP.

B.  

Cilium egress gateway manifests only support one label selector.

C.  

The egress IP must be taken from a public IP address CIDR.

D.  

Only interfaces named eth* can be used with Cilium egress gateway

A.  

Each cluster must be in the same geographical location.

B.  

All clusters must run the same distribution and version of Kubernetes.

C.  

All clusters must run the same version of Cilium.

D.  

Each cluster must be configured with a unique cluster I

D.  

A.  

It would enable operators to avoid the unavailability of an application by temporarily forwarding traffic to local clusters while the remote application is being updated.

B.  

It would enable operators to avoid the unavailability of an application by using the Egress Gateway to send the traffic to a remote destination.

C.  

It would enable operators to avoid the unavailability of an application by load-balancing traffic to all endpolnts across both local and remote clusters.

D.  

It would enable operators to avoid the unavailability of an application by temporarily forwarding traffic to remote clusters while the local application is being updated.

A.  

Ingress and Gateway API serve the same purpose, but they are Just different names for the same Kubernetes resource. Ingress is used in older Kubernetes versions, while Gateway API is the updated version for modern clusters, but the underlying functionality is identical.

B.  

Ingress primarily targets exposing HTTP applications with a simple, declarative syntax. Gateway API exposes a more general API for proxying that can be used for more protocols than just HTTP, and models more infrastructure components to provide better deployment and management options for cluster operators.

C.  

Cilium offers seamless integration with the Gateway API, enhancing Kubernetes networking and security through advanced features powered by eBPF. This integration provides a robust solution for network management. In contrast, Ingress relies on IPtables for its functionality.

D.  

Gateway API is primarily used for internal cluster routing, while Ingress is exclusively for external traffic management. Gateway API does not support routing for internet-exposed services, whereas Ingress is specifically designed for that purpose.

A.  

What is the configuration of Cilium B6P?

B.  

Which container database query ran the longest?

C.  

Which containers have the highest CPU utilization?

D.  

Which services had connections blocked due to network policy?

A.  

If any rule selects an Endpoint and the rule has an ingress section, the Endpoint goes Into default deny at egress. f any rule selects an Endpoint and the rule has an egress section, the Endpoint goes into default deny at ingress.

B.  

If any rule selects an Endpoint and the rule has an ingress section, the Endpoint goes Into default allow at egress, f any rule selects an Endpoint and the rule has an egress section, the Endpoint goes into default allow at ingress.

C.  

If any rule selects an Endpoint and the rule has an ingress section, the Endpoint goes Into default allow at Ingress, f any rule selects an Endpoint and the rule has an egress section, the Endpoint goes into default allow at egress.

D.  

If any rule selects an Endpoint and the rule has an ingress section, the Endpoint goes into default deny at ingress. f any rule selects an Endpoint and the rule has an egress section, the Endpoint goes into default deny at egress.

A.  

For traffic management features, such as gRPC parsing.

B.  

For traffic management features, such as DNS parsing.

C.  

For traffic management features, such as Kafka parsing.

D.  

For traffic management features, such as Layer 3/Layer 4 forwarding.

A.  

AP| request limiting

B.  

API authorization

C.  

Layer 7 Load Balancing of gRPC

D.  

Fault injection, such as injection of delay