01. An administrator is writing a CiliumLoadBalancerIPPool so that LB IPAM can hand out addresses to LoadBalancer Services.
Which two ways can an entry in the pool's blocks list define its addresses?
(Choose two.)
a) As a start and stop address bounding a contiguous range
b) As a node selector whose matching nodes lend their own IP addresses
c) As a CIDR prefix, such as a /28 taken from the data center range
d) As a reference to a CiliumPodIPPool whose pod ranges it borrows
02. A cluster runs Cilium with IPv4 only. The upstream router team expects IPv6 Pod CIDR routes from the cluster's BGP peers as well, but receives none. What explains this?
a) IPv6 prefixes need their own CiliumLoadBalancerIPPool before they can be advertised
b) BGP Control Plane advertises only the address families Cilium itself is configured for
c) The router must first enable L2 Announcements for IPv6 neighbor discovery
d) BGP carries IPv4 routes only, so IPv6 needs a separate routing protocol
03. A network team configures its router to open BGP connections toward the Cilium nodes, which list the router as a peer and use default BGP settings. The router's own connection attempts are refused.
Why are the router's attempts refused?
a) Cilium refuses incoming BGP from routers whose ASN differs from the nodes' ASN
b) Incoming sessions wait until LB IPAM has assigned at least one Service IP
c) The router must be selected by a CiliumBGPAdvertisement before the nodes accept it
d) Cilium's BGP router initiates sessions but does not listen for incoming ones unless localPort is set
04. Only the nodes labeled for rack r1 should peer with the r1 top-of-rack router; nodes in other racks must not. How is that scoping expressed?
a) With a separate CiliumLoadBalancerIPPool whose blocks are reserved for rack r1
b) With a namespaceSelector on a CiliumBGPAdvertisement for rack r1
c) With a nodeSelector in the CiliumBGPClusterConfig
d) With a CiliumL2AnnouncementPolicy listing the interfaces of the rack r1 nodes
05. Every node in a rack shares one BGP cluster configuration, but a single node needs a few BGP settings that differ from the rest of the group. Which resource provides that per-node exception without changing the shared configuration?
a) CiliumLoadBalancerIPPool
b) CiliumBGPNodeConfigOverride
c) CiliumBGPAdvertisement
d) CiliumNode
06. A cluster peers with twelve top-of-rack routers, and every session must use the same timers, MD5 password and graceful-restart settings. Where should those shared settings be defined so each peer can reuse them?
a) In a CiliumBGPAdvertisement that every peer selects by its label
b) In a CiliumL2AnnouncementPolicy for the uplink interfaces
c) In a CiliumBGPPeerConfig that each listed peer references
d) In a CiliumLoadBalancerIPPool shared by the advertised Services
07. Before opening a support request, an engineer needs to record the version of the cilium CLI binary installed on the workstation. Which command prints it?
a) cilium version
b) cilium-dbg version
c) cilium config view
d) cilium status
08. External clients reach a backend Service through Cilium's Ingress controller, which proxies the requests through Envoy. Which reserved identity does the backend pods' ingress policy see as the source of the proxied connections?
a) reserved:world
b) reserved:host
c) reserved:ingress
d) reserved:remote-node
09. Which statements describe how the Cilium agent works with Envoy?
(Choose three.)
a) The agent sends Envoy its configuration over a UNIX domain socket
b) Envoy returns access logs to the agent over a UNIX domain socket
c) Envoy reads its routes from annotations on each application pod
d) The Cilium Operator runs Envoy as one cluster-wide Deployment
e) Cilium ships its own minimal Envoy build as the host proxy
10. An egress CiliumNetworkPolicy needs HTTP rules for an API on port 8080 and DNS rules for the pods' lookups to the cluster DNS server. Which statements about placing these L7 rules are accurate?
(Choose two.)
a) A policy may hold one L7 rule type in total, so the DNS rules need their own policy
b) Both rule types can sit in one policy, because each is attached to a different port
c) The http and dns rules cannot be combined under the same port
d) One port can carry both the http and the dns rules, as long as they share a peer