# A CiliumNetworkPolicy contains HTTP rules, such as allowing only GET requests to /api. Which component enforces those rules?

Cilium, Hard (Expert), Policies. https://k8wiz.com/uquiz/a-ciliumnetworkpolicy-contains-http-rules-such-as-allowing-only-get-requests-to-api-which-component-enforces-those-rules

- A. The eBPF program attached to the pod's network interface
- B. An Envoy proxy that Cilium redirects the matching traffic to
- C. kube-proxy
- D. The Hubble server on each node

**Answer:** An Envoy proxy that Cilium redirects the matching traffic to

**Explanation:** eBPF programs enforce L3 and L4 rules in the kernel. When a rule has an L7 section, the datapath redirects that traffic to Envoy, which parses the HTTP or gRPC requests and applies the rule. Envoy runs inside the agent or as a separate cilium-envoy DaemonSet. Only traffic selected by L7 rules goes through the proxy.