# With Cilium's default policy enforcement mode, when does a pod go from allowing all ingress traffic to denying everything that isn't explicitly allowed?

Cilium, Hard (Expert), Policies. https://k8wiz.com/uquiz/with-ciliums-default-policy-enforcement-mode-when-does-a-pod-go-from-allowing-all-ingress-traffic-to-denying-everything-that-isn

- A. When a CiliumClusterwideNetworkPolicy exists anywhere in the cluster
- B. Only after you set the enforcement mode to always
- C. As soon as any policy with an ingress section selects the pod
- D. When the pod's namespace has the label cilium.io/enforce=true

**Answer:** As soon as any policy with an ingress section selects the pod

**Explanation:** In the default mode, an endpoint that no policy selects allows all traffic. Once a policy with ingress rules selects it, ingress becomes default-deny and only the listed peers get through. Egress is handled separately in the same way. The 'always' mode makes every endpoint default-deny even without a policy, and 'never' turns enforcement off.