200-901 Practice Test 31 — 15 Questions

Question 1

A Kubernetes Deployment manages a set of identical pods. You update the container image to a new version. The rollout gets stuck. Which kubectl command should you use to view the rollout status and determine the cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

kubectl rollout status deployment/my-deployment. The `kubectl rollout status deployment/my-deployment` command is specifically designed to track the progress of a rollout and report its current state, including whether it is stuck or progressing. It provides real-time status updates and can surface underlying issues like image pull errors or resource constraints that cause the rollout to hang, making it the correct tool for diagnosing a stuck rollout.

Answer

kubectl get pods

Answer

kubectl describe deployment my-deployment

Question 2

In the OAuth 2.0 authorization code flow, what does the client receive after the user grants authorization?

Accepted Answer

An authorization code. In the OAuth 2.0 authorization code flow, after the user grants authorization, the authorization server redirects the client with an authorization code in the query string. This code is a temporary credential that the client must exchange for an access token by sending it along with its client credentials to the token endpoint. The authorization code itself is not the final token; it is a one-time-use intermediary that prevents the access token from being exposed to the user agent.

Answer

A client secret

Answer

A refresh token

Answer

An access token

Question 3

A developer is using the ncclient library in Python to connect to a network device via NETCONF. Which operation should be used to modify the running configuration and commit the changes?

Accepted Answer

edit_config() followed by commit(). In NETCONF, the `edit-config()` operation is used to modify the running configuration, and the `commit()` operation is required to make those changes permanent when the device operates in candidate configuration mode. The ncclient library provides these methods to align with the NETCONF protocol's standard operations.

Answer

validate() followed by get_config()

Answer

get_config() followed by copy_config()

Answer

discard_changes() followed by edit_config()

Question 4

In an SDN architecture, which layer is responsible for making decisions about where traffic should be forwarded?

Accepted Answer

Control plane. In SDN architecture, the control plane is responsible for making forwarding decisions by maintaining the network topology and computing paths for traffic flows. It communicates these decisions to the data plane via southbound protocols like OpenFlow or NETCONF, ensuring that packets are forwarded according to the desired policies.

Answer

Data plane

Answer

Application plane

Answer

Management plane

Question 5

Which transport layer protocol is used by HTTP and guarantees reliable delivery?

Accepted Answer

TCP. HTTP relies on TCP (Transmission Control Protocol) as its transport layer protocol because TCP provides reliable, connection-oriented data delivery. TCP ensures that all HTTP requests and responses are delivered in order, without loss or duplication, by using acknowledgments, retransmissions, and sequence numbers. This reliability is essential for HTTP, which expects complete and correct data transfer for web pages and resources.

Answer

ICMP

Answer

IP

Answer

UDP

Question 6

A developer is writing a CI/CD pipeline using Jenkins Declarative Pipeline. They want to ensure that sensitive credentials (e.g., API keys) are never exposed in console logs. Which two security practices should be implemented? (Choose two.)

Accepted Answer

Store the API key in a Jenkins 'Secret text' credential and use the withCredentials step in the pipeline.. Jenkins' `withCredentials` step securely binds a 'Secret text' credential to a variable, masking the value in console logs and preventing exposure. This is the standard practice for handling sensitive data in Declarative Pipeline, as it integrates with Jenkins' credential store and automatically redacts the secret from output.

Answer

Hardcode the API key in the Jenkinsfile and use the sh step to echo it.

Answer

Pass the API key as a command-line argument to the build script.

Answer

Print the API key to the console for debugging.

Question 7

An engineer sees that a DNS query for 'www.example.com' returns a CNAME record. What does this mean?

Accepted Answer

The domain is an alias for another domain. A CNAME (Canonical Name) record maps an alias domain name to another canonical domain name. When a DNS query for 'www.example.com' returns a CNAME record, it means 'www.example.com' is an alias for another domain (e.g., 'example.com'), and the resolver must perform a second query to obtain the actual A or AAAA record. This is defined in RFC 1035 and is used to simplify domain management.

Answer

The domain has multiple IP addresses

Answer

The domain uses IPv6

Answer

The IP address is directly provided

Question 8

A network administrator is configuring a new subnet for a branch office that requires 50 usable host addresses. The corporate network uses the 192.168.10.0/24 block. Which subnet mask should be used to meet the requirement with minimal waste?

Accepted Answer

255.255.255.192 (/26). A /26 subnet mask (255.255.255.192) provides 2^(32-26) = 64 total addresses, of which 62 are usable (subtracting network and broadcast addresses). This meets the requirement of 50 usable hosts with minimal waste, as the next smaller mask (/27) only offers 30 usable addresses, which is insufficient.

Answer

255.255.255.128 (/25)

Answer

255.255.255.0 (/24)

Answer

255.255.255.224 (/27)

Question 9

Which THREE are valid Kubernetes Service types? (Select three.)

Accepted Answer

NodePort. A is correct because NodePort is a standard Kubernetes Service type that exposes a service on a static port (30000-32767) on each node's IP address, allowing external traffic to reach the service by targeting :. It builds on top of ClusterIP and is commonly used for development or direct access scenarios.

Answer

Deployment

Answer

Ingress

Question 10

A developer runs 'docker run -d -p 8080:80 --name web nginx:alpine'. The container fails to start. Which command is the most appropriate to investigate the issue?

Accepted Answer

docker logs -f web. `docker logs -f web` streams the container's stdout and stderr output, which typically contains the error message explaining why the container failed to start (e.g., port conflict, missing configuration, or process crash). Since the container is not running, `docker logs` is the primary diagnostic tool to retrieve its exit logs without requiring the container to be active.

Answer

docker inspect web

Answer

docker exec -it web bash

Question 11

In Docker, which command is used to build an image from a Dockerfile and tag it as 'myapp:v1'?

Accepted Answer

docker build -t myapp:v1 .. The `docker build -t myapp:v1 .` command builds a Docker image from the Dockerfile in the current directory and tags it with the name `myapp` and version tag `v1`. The `-t` flag assigns the tag, and the dot (`.`) specifies the build context (the current directory). This is the standard Docker command for building and tagging images.

Answer

docker run -t myapp:v1 .

Answer

docker create myapp:v1 .

Answer

docker commit myapp:v1 .

Question 12

A developer is deploying a containerized application with Docker Compose. The application requires environment variables for database credentials that should not be hardcoded in the docker-compose.yml file. Which two methods securely provide these credentials? (Choose two.)

Accepted Answer

Use an .env file and add it to .gitignore, then reference it with env_file in the service.. Using an `.env` file allows you to externalize sensitive environment variables (like database credentials) from the `docker-compose.yml` file. By adding the `.env` file to `.gitignore`, you prevent it from being committed to version control, thus keeping credentials secure. The `env_file` directive in the service definition loads these variables at runtime without exposing them in the compose file.

Answer

Use a public registry to store the credentials.

Answer

Hardcode the credentials in the docker-compose.yml under environment.

Answer

Store the credentials in the Docker image during build.

Question 13

Which HTTP method should be used to replace an entire existing resource in a RESTful API?

Accepted Answer

PUT. PUT is the correct HTTP method for replacing an entire existing resource in a RESTful API because it is defined as idempotent in RFC 7231, meaning the client sends a full representation of the resource to replace the current state at the target URI. Unlike POST, PUT is intended for full updates where the client specifies the URI and the server replaces the resource entirely with the provided payload.

Answer

POST

Answer

PATCH

Answer

DELETE

Question 14

A developer runs 'docker-compose up -d' for a multi-service application. What does the '-d' flag do?

Accepted Answer

It runs containers in detached mode (background). The `-d` flag in `docker-compose up -d` stands for 'detached mode', which instructs Docker Compose to run the containers in the background, freeing the terminal for other commands. This is analogous to the `-d` flag in `docker run -d` and is essential for long-running services that should not block the command-line session.

Answer

It enables debugging output

Answer

It pulls the latest images before starting

Answer

It deletes the containers after they stop

Question 15

A network administrator is configuring a DNS server. Which TWO DNS record types are used for IPv6 address resolution?

Accepted Answer

PTR record. The AAAA record (option D) maps a hostname to a 128-bit IPv6 address, analogous to the A record for IPv4. The PTR record (option C) performs reverse DNS lookup, mapping an IPv6 address to a hostname, which is essential for IPv6 address resolution in scenarios like logging or mail server verification.

Answer

MX record

Answer

CNAME record

Answer

A record