200-901 Practice Test 23 — 15 Questions

Question 1

A CI/CD pipeline uses GitHub Actions. The workflow should trigger only when a pull request is opened against the 'main' branch. Which 'on' trigger configuration is correct?

Accepted Answer

on: pull_request: branches: [main]. The correct syntax uses pull_request with branches filter.

Answer

on: [pull_request, push]

Answer

on: push: branches: [main]

Answer

on: pull_request_target: branches: [main]

Question 2

A CI/CD pipeline for a Python project should run unit tests and check for known vulnerabilities in dependencies. Which tool can be integrated into the pipeline to perform dependency scanning?

Accepted Answer

Snyk. Snyk is a popular dependency scanning tool that integrates with CI/CD pipelines. pip audit and npm audit are similar but for specific ecosystems. Snyk supports multiple languages.

Answer

Docker

Answer

Kubernetes

Answer

Jenkins

Question 3

In a Kubernetes deployment, a developer needs to expose a set of pods internally within the cluster on a stable IP address. The pods are stateless and serve HTTP traffic. Which Service type should be used?

Accepted Answer

ClusterIP. ClusterIP exposes the service on a cluster-internal IP, making it reachable only within the cluster. NodePort and LoadBalancer expose externally. ExternalName maps to an external DNS name.

Answer

LoadBalancer

Answer

ExternalName

Answer

NodePort

Question 4

In a Kubernetes cluster, you need to expose a set of pods running a web application to external traffic on a specific port. Which Service type should you use to provide a stable external IP address?

Accepted Answer

LoadBalancer. LoadBalancer provisions a cloud load balancer and assigns a stable external IP, making the service accessible from outside the cluster.

Answer

ClusterIP

Answer

NodePort

Question 5

A network engineer wants to retrieve a list of all network devices from Cisco DNA Center using REST API. Which URL and HTTP method should be used?

Accepted Answer

GET /dna/intent/api/v1/network-device. Cisco DNA Center provides the GET /dna/intent/api/v1/network-device endpoint to list all network devices.

Answer

POST /dna/intent/api/v1/network-device

Answer

GET /dna/system/api/v1/auth/token

Answer

GET /dna/intent/api/v1/topology/l2/{vlanID}

Question 6

A web application is vulnerable to SQL injection. Which secure coding practice should the developer implement in the code to prevent this?

Accepted Answer

Use parameterised queries for database access.. Using parameterised queries (prepared statements) ensures that user input is treated as data, not executable SQL code, preventing SQL injection.

Answer

Escape all user input with htmlspecialchars.

Answer

Use a CAPTCHA on the login form.

Question 7

A developer is creating a Dockerfile for a Python Flask application. The application runs on port 5000. Which directive should be used to document that the container listens on this port?

Accepted Answer

EXPOSE 5000. The EXPOSE directive informs Docker that the container listens on specified ports at runtime. It does not actually publish the port but serves as documentation.

Answer

PORT 5000

Answer

PUBLISH 5000

Answer

LISTEN 5000

Question 8

A Docker container needs to be started in detached mode with port mapping from host port 8080 to container port 80. Which command accomplishes this?

Accepted Answer

docker run -d -p 8080:80 myapp. The -d flag runs container in detached mode, -p maps host port to container port.

Answer

docker start -d -p 8080:80 myapp

Answer

docker run -it -p 8080:80 myapp

Answer

docker run -d -p 80:8080 myapp

Question 9

Which TWO practices help prevent sensitive data exposure in a CI/CD pipeline? (Select two.)

Accepted Answer

Run dependency scanning tools (e.g., Snyk) in the pipeline.. Using environment variables for secrets (not hardcoding) and scanning dependencies for vulnerabilities help prevent exposure.

Answer

Hardcode credentials in the source code for simplicity.

Answer

Commit .env files to the repository with dummy values.

Answer

Disable HTTPS to avoid certificate management overhead.

Question 10

A Kubernetes Service must expose a pod running a database to other pods in the same cluster, but not externally. Which Service type should be used?

Accepted Answer

ClusterIP. ClusterIP exposes the service on a cluster-internal IP, making it accessible only within the cluster.

Answer

LoadBalancer

Answer

ExternalName

Answer

NodePort

Question 11

Which TWO commands are used to view information about Docker containers? (Select two.)

Accepted Answer

docker logs -f. docker ps -a lists all containers (including stopped), and docker logs -f shows logs of a container.

Answer

docker build

Answer

docker images

Answer

docker volume ls

Question 12

A developer writes a web application that accepts user input and displays it on a page. To prevent cross-site scripting (XSS), what is the most effective defense?

Accepted Answer

Implement output encoding when rendering user input in HTML.. Output encoding converts special characters (e.g., < >) to HTML entities, so the browser does not interpret them as code. Input validation alone is insufficient for XSS.

Answer

Use parameterized queries for all database access.

Answer

Store user input in a secure cookie.

Answer

Disable JavaScript in the browser.

Question 13

In a Docker Compose file with multiple services, one service depends on another to be healthy before starting. Which key should be used to express this dependency and ensure the dependent service is started first?

Accepted Answer

depends_on. depends_on in Docker Compose controls startup order. 'links' is legacy, 'networks' defines networks, 'volumes' mounts volumes.

Answer

volumes

Answer

networks

Answer

links

Question 14

A Kubernetes pod needs to run a database that requires persistent storage. Which volume type should be used to store data that persists beyond the pod lifecycle?

Accepted Answer

PersistentVolumeClaim. PersistentVolumeClaim requests persistent storage that survives pod restarts. emptyDir is ephemeral, hostPath ties to a node, configMap is for configuration.

Answer

emptyDir

Answer

configMap

Answer

hostPath

Question 15

A developer needs to store a database password securely in a Kubernetes cluster. Which resource should be used?

Accepted Answer

Secret. Secrets are designed to store sensitive information like passwords, encoded in base64 but intended for secrets. ConfigMaps are for non-sensitive data.

Answer

PersistentVolume

Answer

ConfigMap

Answer

ServiceAccount