CCA: CNCF CCA (Certified Cilium Associate)

About the CCA Exam

Prove you can run Kubernetes networking, security, and observability with Cilium

Master Cilium end to end — the eBPF-powered architecture (the cilium-agent, Cilium Operator, and CLI component model, IPAM modes, and tunnel-versus-native-routing datapaths), identity-based network policy (CiliumNetworkPolicy and CiliumClusterwideNetworkPolicy versus standard Kubernetes NetworkPolicy, plus L3/L4/L7 and DNS/FQDN rules), the sidecarless service mesh (Ingress, Gateway API, and transparent WireGuard/IPsec encryption), Hubble network observability, installing and configuring Cilium with the Cilium CLI, Cluster Mesh for multi-cluster connectivity, eBPF versus iptables, and BGP and external networking. Original practice questions covering all 8 official CCA domains. Not affiliated with, endorsed by, or sourced from CNCF or Linux Foundation certification exams.

Who Should Take This Exam?

The CCA is designed for platform engineers, network engineers, DevOps engineers, and SREs who run Kubernetes clusters with Cilium as the CNI for networking, security, and observability. There are no formal prerequisites; a working familiarity with Kubernetes networking, YAML, and the Linux/eBPF datapath is helpful but not required. The exam is multiple-choice and focuses on how Cilium works — its eBPF architecture, identity-based policy, service mesh, Hubble observability, Cluster Mesh, and BGP.

Typical study time: 2-4 weeks of focused study

Exam Quick Facts

Exam Domains & Weights

The CCA exam covers 8 domains. Focus your study time based on the weights below — higher-weighted domains have more exam questions.

💡 Study tip: Architecture (20%) and Network Policy (18%) are the two heaviest domains — know the eBPF datapath and Cilium’s component roles, the IPAM modes, and how Cilium’s identity-based CiliumNetworkPolicy differs from a standard Kubernetes NetworkPolicy (L7, DNS/FQDN, entities, cluster-wide, and deny rules). Then make sure you can explain the Service Mesh domain (16%) — Ingress versus Gateway API, and sidecar versus sidecarless — and read a Hubble flow in the Network Observability domain.

Practice Exam — 250 Questions

Prepare for the CCA with our 250-question practice exam covering all 8 exam domains. Every question includes detailed explanations and maps to official exam objectives.

What you get:

• ✅ Exam simulation mode with timer
• ✅ Spaced repetition for weak areas
• ✅ Detailed explanations for every question
• ✅ Progress tracking across domains
• ✅ 20 free questions — no account needed

CNCF Certification Path

Start with KCNA (Kubernetes and Cloud Native Associate) for cloud native fundamentals. The CCA (Cilium) certifies your ability to run Kubernetes networking, security, and observability with eBPF, and pairs naturally with the Kubernetes track — CKA (administrator), CKAD (developer), and KCSA/CKS (security) — as well as PCA (Prometheus) for metrics and CGOA/CAPA for GitOps continuous delivery.

Related CNCF Certifications

If you’re studying for the CCA, you might also be interested in these CNCF certifications:

• KCNA: CNCF Kubernetes and Cloud Native Associate — 250 practice questions
• CKS: CNCF Certified Kubernetes Security Specialist — 250 practice questions
• PCA: CNCF Prometheus Certified Associate — 250 practice questions
• CAPA: CNCF Certified Argo Project Associate — 250 practice questions

Study Tips

1. Master the eBPF datapath and policy model — Architecture (20%) and Network Policy (18%) are the two biggest domains; know how Cilium uses eBPF instead of iptables and how identity-based CiliumNetworkPolicy compares to Kubernetes NetworkPolicy
2. Use our practice exam — try the 20 free questions first to gauge your readiness
3. Review explanations — don’t just check if you got it right; read why each answer is correct
4. Simulate exam conditions — use the timed exam mode to practice under pressure