# How can you roll out a new Cilium network policy without risking dropped traffic?

Cilium, Hard (Expert), Policies. https://k8wiz.com/uquiz/how-can-you-roll-out-a-new-cilium-network-policy-without-risking-dropped-traffic

- A. Create the policy with spec.action: DryRun and watch the logs
- B. Apply it as a Kubernetes NetworkPolicy, which Cilium only logs
- C. Give it an empty endpointSelector so it selects nothing yet
- D. Turn on policy audit mode and watch for AUDIT verdicts

**Answer:** Turn on policy audit mode and watch for AUDIT verdicts

**Explanation:** Policy audit mode, set cluster-wide with policyAuditMode or per endpoint, makes Cilium allow traffic it would otherwise drop and report those flows with the AUDIT verdict. Watch them with 'hubble observe --verdict AUDIT', adjust the policy until nothing unexpected shows up, then turn audit mode off. Note that Cilium does enforce standard Kubernetes NetworkPolicies.