# What is wrong with a Cilium egress rule that lists both toFQDNs and toEndpoints?

Cilium, Hard (Expert), Policies. https://k8wiz.com/uquiz/what-is-wrong-with-a-cilium-egress-rule-that-lists-both-tofqdns-and-toendpoints

- A. Both selectors are combined with AND, so traffic must match both
- B. toEndpoints needs its own DNS rules block when paired with toFQDNs
- C. A toFQDNs rule can't contain other L3 selectors such as toEndpoints
- D. Cilium silently ignores toFQDNs when toEndpoints is in the same rule

**Answer:** A toFQDNs rule can't contain other L3 selectors such as toEndpoints

**Explanation:** Cilium's documentation states that toFQDNs egress rules can't contain other L3 rules such as toEndpoints or toCIDR. They may contain toPorts with L4 and L7 rules. Put the DNS rule to kube-dns and the toFQDNs rule in separate entries of the same egress list.