# You want a Cilium policy that limits which traffic can reach the Kubernetes nodes themselves. Which resource and selector do you use?

Cilium, Hard (Expert), Security. https://k8wiz.com/uquiz/you-want-a-cilium-policy-that-limits-which-traffic-can-reach-the-kubernetes-nodes-themselves-which-resource-and-selector-do-you

- A. A CiliumNetworkPolicy in kube-system with an endpointSelector
- B. A Kubernetes NetworkPolicy that selects hostNetwork pods
- C. A CiliumClusterwideNetworkPolicy with a nodeSelector, with the host firewall enabled
- D. A CiliumNetworkPolicy with a nodeSelector in the default namespace

**Answer:** A CiliumClusterwideNetworkPolicy with a nodeSelector, with the host firewall enabled

**Explanation:** Host policies protect the node, not pods. They must be CiliumClusterwideNetworkPolicies that use nodeSelector instead of endpointSelector, and the host firewall must be enabled (hostFirewall.enabled=true). Start with audit mode on the host endpoint, because a mistake can cut off SSH or kubelet traffic.