200-901 Practice Test 20 — 15 Questions

Question 1

A developer is building a container image for a Python application using Docker. The Dockerfile contains several instructions, including a RUN pip install command that downloads dependencies. The developer wants to reduce the final image size and improve build cache efficiency. Which Dockerfile instruction should be used to combine multiple commands and avoid leaving unnecessary files in the image layer?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a single RUN instruction with commands chained using && and clean up temporary files in the same RUN.. Combining commands into a single RUN instruction with && and cleaning up temporary files in the same layer minimizes the number of layers and prevents leftover files from persisting in the image. This approach directly reduces image size and improves build cache utilization by keeping related operations together.

Answer

Use the COPY instruction to copy a pre-built virtual environment into the image.

Answer

Use multiple RUN instructions, one for each command, to make the Dockerfile more readable.

Answer

Use the ADD instruction to download and extract dependencies automatically.

Question 2

A developer is using the Meraki Dashboard API to list all organizations. The base URL is https://api.meraki.com/api/v1/. What is the correct endpoint and authentication method?

Accepted Answer

GET /organizations with X-Cisco-Meraki-API-Key header. The Meraki Dashboard API uses a custom API key for authentication, sent via the `X-Cisco-Meraki-API-Key` header. To list all organizations, the correct HTTP method is GET, and the endpoint is `/organizations` (relative to the base URL `https://api.meraki.com/api/v1/`). This matches option C exactly.

Answer

POST /organizations with Bearer token in Authorization header

Answer

GET /organizations with Basic Auth username and password

Answer

GET /v1/organizations with Cookie authentication

Question 3

A developer is working with the Meraki Dashboard API to manage SSIDs. Which TWO statements about pagination are correct? (Choose two.)

Accepted Answer

The 'endingBefore' parameter is used to go to the previous page. Meraki uses the Link header with 'prev' and 'next' URLs for pagination. Additionally, the startingAfter and endingBefore query parameters allow manual pagination.

Answer

Pagination is handled automatically by the client library; no action required

Answer

The 'page' query parameter is used to specify page number

Answer

The Link header contains a 'last' URL for the final page

Question 4

A developer is building a Python microservice that will run in a Docker container on a shared host. The application must read its database connection string and API token from environment variables at runtime, and the developer wants to avoid baking those secrets into the image. Which approach best satisfies this requirement?

Accepted Answer

Pass the values at runtime with docker run --env or --env-file so the process reads them from the container environment.. Secrets that must not persist in a distributed image should be supplied from outside the image at container start. Runtime environment injection keeps the image portable and secret-free, while Dockerfile instructions and source files permanently record whatever they contain. The requirement is about where the value lives, so the mechanism that never writes it into the image is the only one that satisfies it.

Answer

Copy a .env file containing the secrets into the image with the COPY instruction.

Answer

Use the ENV instruction in the Dockerfile to set the connection string and token as defaults.

Answer

Commit the secrets into the application's settings.py module so they load at import time.

Question 5

Which THREE of the following are common steps in a CI/CD pipeline for a Python application that manages Cisco devices?

Accepted Answer

Build a Docker container. Option A (Build a Docker container) is correct because packaging the Python application and its dependencies into a Docker image is a standard CI/CD build step that ensures consistent, portable deployment artifacts across environments. Option C (Perform static code analysis/linting) is correct because tools like flake8, pylint, or black are typically run in the pipeline to catch syntax errors, style violations, and potential bugs before code is merged or deployed. Option D (Run unit tests on each commit) is correct because executing automated tests (e.g., pytest or unittest) on every commit provides fast feedback and verifies that the Python code managing Cisco devices behaves as expected. Option B (Manually review code before merge) is not a pipeline step—it is a human code-review activity typically handled via pull requests, not automated CI/CD execution. Option E (Deploy to production on every commit) is not a common practice; production deployments usually require passing tests and approvals, and continuous deployment to production on every commit is risky and not a standard CI/CD step for network automation.

Answer

Manually review code before merge

Answer

Deploy to production on every commit

Question 6

A team deploys a containerized web application and wants to verify that the image running in production was built from the reviewed source and has not been altered since. Which practice directly provides this guarantee?

Accepted Answer

Reference the image by an immutable digest and enable Docker Content Trust so only signed images are pulled.. Verifying that a running container corresponds to reviewed, unmodified source requires two properties: immutability and authenticity. Pinning by digest makes the image reference immutable, and content trust verifies the signature of the publisher. Mutable tags and build-hygiene practices cannot demonstrate either property, so only the combination of digest pinning and signing answers the question.

Answer

Store the Dockerfile in the same repository as the application source code.

Answer

Tag the image with the string latest so every deployment uses the newest build.

Answer

Run docker image prune on the production host before each deployment.

Question 7

A security review of a containerized application finds that the running process has far more privileges than it needs. Which TWO changes reduce the attack surface of the container at runtime? (Choose two.)

Accepted Answer

Run the application process as a non-root user inside the container.. Least privilege for containers is enforced along two axes: the identity the process runs under and the kernel capabilities it retains. Running as a non-root user removes root-owned access inside the container, while dropping unneeded capabilities prevents privileged kernel operations even if the process is compromised. Options that grant daemon access, full privileges, or broader network exposure all move in the opposite direction.

Answer

Add the --privileged flag so the container can access all devices directly.

Answer

Publish the container's port to the host with the -p 0.0.0.0:8080:8080 mapping.

Answer

Mount the host's Docker socket into the container so it can manage sibling containers.

Question 8

An application running on a Cisco IOS XE device must call an external REST API that uses a self-signed certificate. The developer's Python script using the requests library fails with an SSL verification error. The security team requires that the script still validates the server identity. Which approach satisfies the requirement?

Accepted Answer

Provide the path to the server's CA certificate through the verify parameter. A self-signed certificate is not chained to a public root authority, so the default trust store cannot validate it. Supplying that certificate, or the CA that issued it, to the verify parameter gives the client an explicit trust anchor while keeping hostname and chain validation active. Disabling verification or stripping the trust store would silence the error at the cost of the identity assurance the security team requires.

Answer

Downgrade the request to plain HTTP on port 80 so TLS is not involved

Answer

Pass verify=False to the requests call to skip certificate validation

Answer

Set the REQUESTS_CA_BUNDLE environment variable to an empty string before running the script

Question 9

A developer is configuring a GitHub Actions workflow that must authenticate to AWS to push an image to Amazon ECR. The security team prohibits long-lived AWS access keys in repository secrets. Which authentication method should the workflow use?

Accepted Answer

Configure an OpenID Connect (OIDC) identity provider in AWS IAM and assume a role using the workflow's OIDC token.. OIDC federation lets GitHub Actions exchange a short-lived identity token for temporary AWS credentials through a trusted IAM role. This removes long-lived access keys entirely, which is the only option consistent with the security team's prohibition. Storing static keys in secrets, passing them to actions, or embedding them in images all retain long-lived credentials and expand the attack surface.

Answer

Embed the AWS credentials in the Docker image at build time using build arguments and read them at runtime.

Answer

Use the `aws-actions/configure-aws-credentials` action with `aws-access-key-id` and `aws-secret-access-key` inputs populated from repository secrets.

Answer

Store the AWS secret access key in an encrypted repository secret and reference it in the workflow.

Question 10

A network automation team is adopting Git for managing Python scripts and YAML device templates. They want a branching model where each new feature is developed in isolation and merged back into a shared integration branch before release. Which Git branching strategy best matches this requirement?

Accepted Answer

Git Flow. Git Flow defines a develop branch that acts as the integration point for completed feature branches and a main branch that stores release-ready code. Because the team wants features isolated and then merged into a shared integration branch before release, Git Flow is the model that matches those constraints.

Answer

Trunk-Based Development

Answer

GitHub Flow

Answer

Forking Workflow

Question 11

Given the JSON string: '{"name": "Alice", "scores": [90, 85, 92]}', which Python code correctly extracts the second score (85)?

Accepted Answer

json.loads(json_str)['scores'][1]. json.loads converts to dict, then access scores list index 1.

Answer

json.dumps(json_str)['scores'][1]

Answer

json_str['scores'][1]

Answer

json.loads(json_str)['scores'][2]

Question 12

A developer is writing a Python application that calls a REST API. The API requires an OAuth 2.0 bearer token. The token must not be stored in the source code. Which approach should the developer use to make the token available to the application at runtime?

Accepted Answer

Read the token from an environment variable that is injected by the deployment platform at runtime.. The token must be provided at runtime and kept out of source control. Environment variables are a standard way to inject secrets into a running application without embedding them in code or configuration files committed to the repository. The other options either commit the secret to the repository or ship it inside the application artifact, both of which expose the token.

Answer

Hardcode the token in a configuration file that is committed to the repository so the application can read it on startup.

Answer

Store the token in a comment at the top of the main application file so it is easy for the developer to find.

Answer

Embed the token in the application's compiled bytecode so it is not visible in the plain source files.

Question 13

A team is hardening a Kubernetes deployment that exposes a web API. They want to reduce the impact of a container compromise and enforce network segmentation. Which TWO configurations should they apply? (Choose two.)

Accepted Answer

Define a NetworkPolicy that allows ingress only from the required client pods and denies all other traffic.. Reducing the impact of a compromise requires limiting the container's privileges and its ability to communicate laterally. Running as a non-root user removes a key privilege, while a default-deny NetworkPolicy with explicit allows enforces segmentation. Image pull policy, external exposure, and resource limits address other concerns and do not satisfy the stated security objectives.

Answer

Expose the API through a Service of type `LoadBalancer` for external access.

Answer

Set `imagePullPolicy: Always` on the container so the newest image is always used.

Answer

Add resource requests and limits for CPU and memory to the container.

Question 14

A developer is deploying a web application to a Kubernetes cluster. The application must be reachable from the internet on port 443, and the team wants the cluster to automatically provision a TLS certificate. Which Kubernetes resource should the developer create to expose the application with TLS termination and automatic certificate management?

Accepted Answer

An Ingress resource with a TLS section that references a Secret, combined with a certificate manager that issues the certificate.. Exposing an application over HTTPS with automatic certificate management requires an Ingress resource with a TLS section and a certificate manager that provisions the referenced secret. The Ingress handles external routing and TLS termination, while the certificate manager issues and renews certificates. The other resources either do not expose the application or do not manage TLS certificates.

Answer

A Service of type LoadBalancer with port 443 and a TLS secret referenced in the Service spec.

Answer

A NetworkPolicy that allows inbound traffic on port 443 and a ConfigMap that stores the certificate.

Answer

A PodDisruptionBudget that ensures the application pods remain available during certificate rotation.

Question 15

A developer is preparing to add a new feature to a shared Git repository. The team uses a workflow where each feature is developed on its own branch and then merged back into the main branch through a pull request. Which Git operation should the developer perform first to begin work on the new feature?

Accepted Answer

git checkout -b feature/new-feature. Starting a feature requires an isolated branch so commits do not land directly on the shared main branch. Creating and switching to a new branch in one step provides that isolation and prepares the work for a later pull request. Committing, pushing main, or merging does not establish the new branch.

Answer

git merge main

Answer

git push origin main

Answer

git commit -m "start feature"