> For the complete documentation index, see [llms.txt](https://atomoh.gitbook.io/kubernetes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://atomoh.gitbook.io/kubernetes/en/quiz-collection/networking/cilium/04-ipam-policy-quiz.md).

# Part 4: IPAM and Policies Quiz

> **Supported Version**: Cilium 1.17 **Last Updated**: February 22, 2026

## IPAM (IP Address Management)

1. **What is Cilium's default IPAM mode?**
   * A) Kubernetes Host Scope
   * B) Cluster Scope
   * C) CRD-based
   * D) AWS ENI
2. **Which Cilium IPAM mode has each node allocate IPs from its own CIDR range?**
   * A) Cluster Scope
   * B) Kubernetes Host Scope
   * C) CRD-based
   * D) AWS ENI
3. **What is the recommended IPAM mode when using Cilium on AWS EKS?**
   * A) Kubernetes Host Scope
   * B) Cluster Scope
   * C) AWS ENI
   * D) CRD-based
4. **What Kubernetes feature does Cilium's 'PodCIDR' IPAM mode utilize?**
   * A) NodeSpec.PodCIDR
   * B) NodeSpec.CIDR
   * C) NodeSpec.Subnet
   * D) NodeSpec.IPRange
5. **What command is used to check Cilium's IPAM configuration?**
   * A) `cilium status --ipam`
   * B) `cilium ipam`
   * C) `cilium config get ipam`
   * D) `kubectl -n kube-system get configmap cilium-config -o yaml | grep -E 'ipam|allocator'`

## Network Policy Basics

6. **What is the API version of Cilium NetworkPolicy?**
   * A) networking.k8s.io/v1
   * B) cilium.io/v1
   * C) cilium.io/v2
   * D) policy.cilium.io/v1
7. **What is the role of 'endpointSelector' in Cilium NetworkPolicy?**
   * A) Select target Pods for policy application
   * B) Select target nodes for policy application
   * C) Select target namespaces for policy application
   * D) Select target services for policy application
8. **What does the 'ingress' rule control in Cilium NetworkPolicy?**
   * A) Traffic coming into the selected Pods
   * B) Traffic going out from the selected Pods
   * C) Traffic within the selected Pods
   * D) Traffic to outside the cluster
9. **What does the 'egress' rule control in Cilium NetworkPolicy?**
   * A) Traffic coming into the selected Pods
   * B) Traffic going out from the selected Pods
   * C) Traffic within the selected Pods
   * D) Traffic from outside the cluster
10. **What is the role of the 'labels' field in Cilium NetworkPolicy?**
    * A) Select Pods for policy application
    * B) Identifier for the policy itself
    * C) Select namespaces for policy application
    * D) Select nodes for policy application

## Advanced Network Policy

11. **What does the 'toCIDR' rule in Cilium NetworkPolicy allow?**
    * A) Traffic to specific IP address ranges
    * B) Traffic to specific domain names
    * C) Traffic to specific services
    * D) Traffic to specific ports
12. **What does the 'toFQDNs' rule in Cilium NetworkPolicy allow?**
    * A) Traffic to specific IP addresses
    * B) Traffic to specific ports
    * C) Traffic to specific domain names
    * D) Traffic of specific protocols
13. **What does the 'world' entity mean in the 'toEntities' rule of Cilium NetworkPolicy?**
    * A) All internal cluster endpoints
    * B) All external networks
    * C) All nodes
    * D) All namespaces
14. **What does the 'toServices' rule in Cilium NetworkPolicy allow?**
    * A) Traffic to specific Kubernetes services
    * B) Traffic to specific external services
    * C) Traffic to specific ports
    * D) Traffic of specific protocols
15. **What is the role of 'nodeSelector' in Cilium NetworkPolicy?**
    * A) Select target Pods for policy application
    * B) Select target nodes for policy application
    * C) Select target namespaces for policy application
    * D) Select target services for policy application

## L7 Policy

16. **What attributes can be filtered in Cilium's L7 HTTP policy?**
    * A) Path
    * B) Method
    * C) Headers
    * D) All of the above
17. **What attributes can be filtered in Cilium's L7 Kafka policy?**
    * A) Topic
    * B) API Key
    * C) Client ID
    * D) All of the above
18. **What does the 'matchPattern' rule in Cilium's L7 DNS policy allow?**
    * A) Exact domain name matching
    * B) Domain name pattern matching with wildcards
    * C) IP address matching
    * D) Port number matching
19. **What attributes can be filtered in Cilium's L7 gRPC policy?**
    * A) Method name
    * B) Service name
    * C) Metadata
    * D) All of the above
20. **What component is required to apply Cilium's L7 policy?**
    * A) kube-proxy
    * B) Envoy Proxy
    * C) NGINX Ingress Controller
    * D) HAProxy