CCA: The Cilium Certified Associate Exam, Domain by Domain

The Cilium Certified Associate (CCA) is the only certification specific to Cilium, and it is the newest of the associate exams around Kubernetes. It is aimed at platform and cloud engineers working on networking, security and observability, and The Linux Foundation rates it beginner with no prerequisites — though it recommends you bring Kubernetes knowledge and basic networking, meaning the seven-layer model and how TCP, UDP, DNS and HTTP behave.

The blueprint is where this exam surprises people. Cilium is famous for eBPF, so the natural assumption is that the exam is largely a kernel-programming paper. It is not: eBPF is 10 %, level with Cluster Mesh, Network Observability, and Installation and Configuration. The weight sits in Cilium's own model instead — Architecture (20 %), Network Policy (18 %) and Service Mesh (16 %) are 54 % of the paper between them. Preparation aimed at the technology's reputation rather than its blueprint spends half its effort on a tenth of the exam.

Below: the eight domains by weight, what the multiple-choice format does to how you should study, and where this exam sits among the associate credentials. For the whole field see which cloud native certification should you take?; if a service mesh rather than a CNI is your day job, the Istio Certified Associate guide is the closer comparison. Gnoseed does not sell or proctor these exams — it is a free study companion.

Cilium's public identity is eBPF. Every conference talk, every diagram, every introduction leads with the kernel. So the intuitive study plan is to go deep on eBPF — verifier semantics, map types, program attachment points — and treat the Cilium-specific material as a thin layer on top. The blueprint inverts that. eBPF is 10 %. Architecture, Network Policy and Service Mesh together are 54 %.

That does not make eBPF unimportant; it makes it context. What the exam appears to want is enough eBPF to understand why Cilium's datapath behaves as it does — why identity-based policy scales where IP-based rules do not, why replacing kube-proxy changes the packet path — rather than the ability to write and load a program yourself. Understanding the mechanism is examinable at 10 %; being able to build one is not what an associate credential is for.

The practical reordering: spend your first pass on Cilium's identity model and datapath, your second on the two policy surfaces, and treat eBPF as the layer that explains both. If your notes are thicker on kernel internals than on CiliumNetworkPolicy, they are weighted for a different exam.

CCA is a 90-minute online proctored multiple-choice exam — no live cluster, no terminal. That has two consequences people underestimate. First, Linux Foundation multiple-choice exams require 75 % to pass, a higher bar than the 66 % on the hands-on CKA. Second, candidates are not permitted to access tools, resources or external sites during a multiple-choice exam. Cilium's documentation is excellent and you will not have it.

So this is a recall exam, not a fluency exam. On a performance-based paper, half-remembering a flag is survivable because you can look it up and the clock is the real constraint. Here there is nothing to look up: an approximate memory of what CiliumClusterwideNetworkPolicy does differently from CiliumNetworkPolicy converts directly into a wrong answer. Exactly the profile spaced repetition is built for — which is the honest reason this page exists on a flashcards site rather than a lab site.

It is also worth knowing what the format cannot test. Nothing here proves you have debugged a broken datapath at two in the morning. The credential says you understand Cilium's model; pair it with cluster time if you want it to mean more than that.

If you think of Cilium as a CNI, the third-largest domain is a surprise. Service Mesh is 16 % — Cilium's sidecar-free approach, where mesh functionality lives in the datapath rather than in a proxy container beside every pod. Add Cluster Mesh at 10 % and more than a quarter of the exam is about connecting things across service and cluster boundaries rather than about pod networking on one cluster.

This is where the CCA and the Istio Certified Associate genuinely differ rather than overlap. ICA is a two-hour, partly performance-based exam devoted entirely to one mesh, with Traffic Management alone at 35 %. CCA gives the mesh 16 % and asks about Cilium's way of doing it. If mesh work is your job, ICA is the deeper credential; if the mesh is one property of the CNI you already run, CCA is the one that matches.

The tail of the blueprint is worth a glance too. BGP and External Networking is 6 % — the smallest domain, but it is the one most likely to be entirely unfamiliar if your background is application platforms rather than networking. Six per cent of a paper you need 75 % on is not a domain to skip on the grounds of size.

CCA joins a family of associate certifications that are unusually uniform: no prerequisites, $250 for the exam alone, valid two years, a twelve-month eligibility window and one retake included. Seven of the eight — CCA among them — are 90-minute multiple-choice papers rated beginner; only ICA breaks the pattern at two hours and partly performance-based.

Because none of them gates another, the sensible order is whatever your work already suggests rather than a difficulty ladder. CCA earns its place if Cilium is the CNI in your clusters, or if network policy is something you are asked about and answer vaguely. It is a poor first badge for someone new to Kubernetes generally — KCNA or the CKA covers that ground, and the CCA assumes it.

Bundles exist: the Linux Foundation lists CCA with a THRIVE-ONE annual subscription at $495, which is worth pricing only if you intend to take more than one exam or use the wider catalogue.