200-901 Practice Test 13 — 15 Questions

Question 1

Refer to the exhibit. A security audit requires that the container cannot run as root. Which part of the pod spec ensures this?

Accepted Answer

runAsUser: 1000. Option D is correct because setting `runAsUser: 1000` in the pod's security context explicitly instructs the container runtime to launch the container's main process with a user ID of 1000, which is a non-root user. This directly satisfies the security audit requirement that the container cannot run as root (UID 0). The `runAsUser` field overrides the default behavior where containers run as root unless a non-root user is specified in the container image or security context.

Answer

The configMap volume

Answer

The image tag "latest"

Answer

allowPrivilegeEscalation: false

Question 2

A network engineer runs an Ansible playbook to backup a Cisco router configuration. The playbook fails with the error: 'ssh: connect to host 192.168.1.1 port 22: Connection timed out'. What is the most likely cause?

Accepted Answer

The router's IP address is unreachable from the control node.. The error 'Connection timed out' indicates that the control node sent a TCP SYN to 192.168.1.1 on port 22 but never received a SYN-ACK response. This occurs when the destination IP is unreachable due to routing issues, a firewall dropping packets, or the host being offline. Since Ansible uses SSH to connect to network devices, a timeout at the transport layer points directly to network reachability problems, not authentication or service configuration.

Answer

The playbook uses the incorrect gather_facts setting.

Answer

The SSH key is not authorized on the router.

Answer

The router does not have SSH enabled.

Question 3

A company wants to implement a zero-trust model for API access between microservices. What is the most effective way to authenticate service-to-service communication?

Accepted Answer

Issue short-lived TLS certificates for each service.. Option C is correct because mutual TLS (mTLS) with short-lived certificates validates identity and limits exposure. Options A and D are incorrect because shared secrets and long-lived API keys are less secure. Option B is incorrect because network segmentation is not authentication.

Answer

Rely on network segmentation with firewalls.

Answer

Use a shared secret that all services know.

Answer

Use long-lived API keys.

Question 4

A network automation script using NX-API on a Nexus switch fails intermittently with HTTP 500 errors. Which two troubleshooting steps are most effective in diagnosing the issue? (Choose two.)

Accepted Answer

Enable NX-API debugging on the switch to capture detailed logs.. Option C is correct because enabling NX-API debugging on the switch (using the 'debug nxapi' command) captures detailed logs of API requests and responses, including HTTP 500 error details. This allows you to pinpoint the root cause, such as malformed payloads, internal server errors, or resource exhaustion. Without debugging, the generic 500 error provides no insight into the specific failure.

Answer

Check the length of the JSON payload sent to the API.

Answer

Ensure the switch is running NX-OS version 9.3(1) or later.

Answer

Use HTTP instead of HTTPS for the API requests.

Question 5

A company has a microservices application deployed on Kubernetes. There are three services: frontend, backend, and database. The frontend is exposed via an Ingress. The API gateway is used for authentication. Recently, after updating the backend service, users are experiencing 401 Unauthorized errors when accessing endpoints that previously worked. The authentication mechanism uses JWT tokens issued by an external identity provider. The JWT tokens are validated by the API gateway. The backend service itself does not validate tokens; it relies on the gateway to forward user identity via headers. The development team checked the logs and found that the backend is receiving requests with the correct JWT from the gateway but still returning 401. What is the most likely cause?

Accepted Answer

The backend service code now attempts to validate the JWT itself and fails.. The scenario states that the backend service relies on the gateway to forward user identity via headers and does not validate JWT tokens itself. If the new backend version now attempts to validate the JWT, it would likely fail because the backend lacks the necessary signing key or validation logic, causing 401 errors even though the gateway correctly forwards the token. This matches option D, as the change in backend behavior introduces a new validation step that was not present before.

Answer

The Ingress controller is stripping the Authorization header before forwarding to the backend.

Answer

The API gateway's JWT signing key has changed and the backend is using the old key.

Answer

The new backend version uses a different HTTP method for the affected endpoints.

Question 6

Refer to the exhibit. A developer from subnet 10.10.10.0/24 cannot reach the RESTCONF API on the IOS-XE device. What is the most likely cause?

Accepted Answer

The 10.10.10.0/24 subnet is not permitted by the access-class.. The access-class configured under the RESTCONF API restricts incoming connections to specific subnets. Since the developer is on subnet 10.10.10.0/24, which is not listed in the permit statement, all HTTPS requests from that subnet are dropped before reaching the API. This is the most direct cause of the connectivity failure.

Answer

HTTPS is not enabled on the device.

Answer

The HTTP server is not enabled.

Answer

Authentication is not configured as local.

Question 7

A developer is building a REST API for a Cisco DNA Center application. The API must allow external partners to retrieve network device inventory. Which security mechanism should be implemented to ensure that only authorized partners can access the API while maintaining the ability to revoke access for a specific partner without affecting others?

Accepted Answer

Use unique API keys per partner. Option B is correct because API keys are simple tokens that can be issued per partner and easily revoked. Option A is wrong because OAuth 2.0 with client credentials requires a more complex setup but still allows per-client revocation; however, API keys are simpler and sufficient for this scenario. Option C is wrong because basic authentication would require sharing passwords and revoking would change credentials for all. Option D is wrong because IP whitelisting does not scale well and may not work across different partner networks.

Answer

Whitelist partner IP addresses in the API gateway firewall

Answer

Require HTTP basic authentication with a shared username and password

Answer

Implement OAuth 2.0 with client credentials grant

Question 8

Which THREE are valid methods for managing Kubernetes application configuration?

Accepted Answer

Helm values.. Helm values (A) are correct because Helm is a package manager for Kubernetes that uses values.yaml files to inject configuration into templates at deployment time, enabling dynamic, environment-specific application configuration without modifying the underlying chart. This is a standard method for managing Kubernetes application configuration in production workflows.

Answer

Operator custom resources.

Answer

Environment variables in the Dockerfile.

Question 9

An application running in a Kubernetes pod needs to access an external database securely. The database credentials are rotated every 24 hours. Which approach ensures that the pod always uses the current credentials without manual intervention?

Accepted Answer

Use a Secrets Store CSI driver to mount secrets from an external vault as a volume.. Option D is correct because a Secrets Store CSI driver can dynamically mount secrets from an external vault, and the application can read the updated secret from the volume without restarting the pod. Option A is incorrect because restarting daily is disruptive. Option B is valid but the CSI driver is more integrated and standard. Option C is not a specific solution.

Answer

Embed a token in the application code that refreshes automatically.

Answer

Store credentials in a Kubernetes Secret and mount as volume; restart pod daily.

Answer

Use a sidecar container that watches a vault and updates the application config.

Question 10

During a security audit of a microservices application deployed on Cisco Container Platform, the auditor discovers that some containers are running with privileged access. The development team argues that certain containers need to modify kernel parameters. Which security best practice should be recommended to minimize risk while allowing necessary kernel adjustments?

Accepted Answer

Set the container security context to add only the necessary Linux capabilities, e.g., CAP_SYS_ADMIN. Option A is correct because it follows the principle of least privilege by granting only the specific Linux capability (CAP_SYS_ADMIN) needed to modify kernel parameters, rather than full privileged access. In Kubernetes (used by Cisco Container Platform), a security context with `capabilities.add: ['SYS_ADMIN']` allows the container to perform privileged operations like sysctl modifications without exposing the host or other containers to the broader risks of privileged mode.

Answer

Set the container to privileged: false and add the SYS_ADMIN capability only for containers that need it

Answer

Run the container as root user but remove the CAP_SYS_ADMIN capability

Answer

Drop all Linux capabilities and run the container as a non-root user

Question 11

A company is implementing an API gateway for its microservices. Which TWO security features should be enabled at the gateway to protect backend services?

Accepted Answer

JWT validation.. JWT validation at the API gateway ensures that only requests with valid, unexpired, and properly signed JSON Web Tokens are forwarded to backend microservices. This offloads authentication and token verification from individual services, enforcing a consistent security boundary and preventing unauthorized access.

Answer

In-depth packet inspection.

Answer

Database connection pooling.

Answer

CORS configuration.

Question 12

Which TWO of the following are recommended practices for securing a CI/CD pipeline in a DevOps environment? (Choose two.)

Accepted Answer

Store secrets and credentials in a secure vault and inject them at runtime. Option A is correct because storing secrets (e.g., API keys, database passwords) in a secure vault (like HashiCorp Vault or AWS Secrets Manager) and injecting them at runtime prevents hard-coded credentials in source code or configuration files. This follows the principle of least privilege and ensures that secrets are never exposed in logs, version control, or build artifacts, which is a fundamental security practice for CI/CD pipelines.

Answer

Grant all developers write access to the production environment to enable faster fixes

Answer

Deploy code to production first, then run security tests to check for issues

Answer

Use the same API token for all pipeline stages to simplify authentication

Question 13

A developer is deploying a containerized application to a Kubernetes cluster. To ensure that the application can securely access a third-party API, what is the best practice for storing the API key?

Accepted Answer

Store it as a Kubernetes Secret and mount it as an environment variable.. Option A is correct because Kubernetes Secrets are designed for sensitive data and can be mounted as environment variables. Option B is insecure because hardcoding keys in images exposes them. Option C is incorrect because ConfigMaps are for non-sensitive data. Option D is incorrect because service account tokens are for cluster authentication, not external APIs.

Answer

Hardcode the API key in the Docker image.

Answer

Use a service account token.

Answer

Store it in a ConfigMap and reference it from the pod.

Question 14

During a CI/CD pipeline, a security scan reveals that a Docker image contains a vulnerability in a base layer. Which action BEST addresses the issue?

Accepted Answer

Rebuild the image using an updated base image from a trusted registry.. Option B is correct because the vulnerability exists in the base layer of the Docker image, which is immutable once built. The only way to eliminate the vulnerability is to rebuild the image using an updated base image from a trusted registry (e.g., Docker Hub official images or a private registry with patched images). This ensures the vulnerable packages are replaced with patched versions at the OS or application level, directly addressing the root cause.

Answer

Disable the security scanner to avoid false positives.

Answer

Implement run-time security monitoring to detect exploitation.

Answer

Add an exception to the vulnerability report.

Question 15

Which THREE of the following are common security vulnerabilities listed in the OWASP Top 10? (Choose three.)

Accepted Answer

Cross-Site Scripting (XSS). Cross-Site Scripting (XSS) is a common security vulnerability in the OWASP Top 10 because it allows attackers to inject malicious scripts into web pages viewed by other users, typically through input fields that are not properly sanitized. This can lead to session hijacking, defacement, or redirection to malicious sites, exploiting the trust a user has in a legitimate application.

Answer

Multi-Factor Authentication

Answer

DNS Cache Poisoning

200-901 Practice Test 13 — 15 Questions

Exhibit

200-901 Practice Test 13 — 15 Questions

Exhibit