Cilium Certified Associate (CCA)
Validate foundational competence in cloud-native networking, security, and observability using Cilium and eBPF, including CNI routing, CiliumNetworkPolicies, transparent encryption, Hubble monitoring, and service mesh features.
Official Exam Specification & Quick Facts
Question Difficulty Breakdown
Exam Guidelines & Simulation Rules
Frequently Asked Questions (FAQ)
The CCA is a foundational, multiple-choice certification created by the CNCF and Linux Foundation validating knowledge of eBPF-based cloud-native networking, security, and observability using Cilium.
The CCA is a 90-minute multiple-choice examination consisting of 60 questions administered online with remote proctoring.
A passing scaled score of 75% is required. Results are displayed immediately upon submission.
Domains include: (1) Architecture (20%), (2) Network Policy & Security (25%), (3) Service Mesh & Ingress (15%), (4) Observability (Hubble) (20%), and (5) Advanced Networking (20%).
eBPF (extended Berkeley Packet Filter) allows sandboxed programs to run in the Linux kernel without changing kernel code. Cilium uses eBPF to implement high-performance networking, security filtering, and observability directly in the kernel.
Cilium eBPF Host-Routing completely replaces kube-proxy, eliminating slow iptables table evaluations by using eBPF hash maps for $O(1)$ scale-independent service load balancing.
A CiliumNetworkPolicy extends standard Kubernetes NetworkPolicies with Layer 7 filtering (HTTP, Kafka, DNS), identity-based enforcement, and cluster-wide CiliumClusterwideNetworkPolicies (CCNP).
Hubble is Cilium's observability platform built on eBPF. It provides real-time visibility into network flows, DNS lookups, HTTP metrics, security policy verdicts, and service-to-service dependency graphs.
Cilium automatically encrypts all node-to-node and pod-to-pod network traffic using either WireGuard (kernel-level, fast, easy key rotation) or IPsec without modifying applications.
Cilium Service Mesh provides L7 traffic management, mTLS, and ingress routing using eBPF for networking acceleration and Envoy for complex L7 proxying, supporting both sidecar and sidecar-less modes.
Cilium BGP Control Plane advertises PodCIDRs and service Virtual IPs directly to top-of-rack physical routers without overlay encapsulation. Cilium ClusterMesh interconnects multiple Kubernetes clusters.
Platform engineers, cloud network architects, SREs, Kubernetes administrators, and security specialists looking to leverage eBPF-powered infrastructure.