200-901 Application Deployment and Security — 30 Questions

Question 1

A developer wants to ensure that a Docker container running a web application can only accept incoming traffic on port 443. Which Docker run option should be used?

Accepted Answer

docker run -p 443:443 myapp. Option C is correct because the `-p 443:443` flag publishes container port 443 to the host port 443, mapping incoming traffic on the host's port 443 to the container's port 443. This ensures the web application inside the container only accepts incoming traffic on port 443, as the host firewall and Docker's port mapping restrict access to that specific port.

Answer

docker run --port 443 myapp

Answer

docker run --net host myapp

Answer

docker run --expose 443 myapp

Question 2

During a security audit, an engineer discovers that a CI/CD pipeline is storing API keys in plain text in environment variables. Which best practice should be implemented to mitigate this risk?

Accepted Answer

Use a dedicated secrets management service like HashiCorp Vault or AWS Secrets Manager and retrieve secrets at runtime.. Option C is correct because dedicated secrets management services like HashiCorp Vault or AWS Secrets Manager provide secure storage, access control, and audit logging for sensitive data. They allow the CI/CD pipeline to retrieve API keys at runtime via authenticated API calls, ensuring secrets are never stored in plain text in environment variables or configuration files. This approach aligns with the principle of least privilege and eliminates the risk of exposure through source code or build logs.

Answer

Store secrets in a .env file and add it to the repository with restricted access.

Answer

Encrypt the environment variables using a tool like openssl and store the key elsewhere.

Answer

Remove the API keys from the pipeline and require manual entry each time a build runs.

Question 3

A network engineer is troubleshooting a Kubernetes deployment where pods are failing to start with the error 'CrashLoopBackOff'. The pod log shows 'bind: address already in use'. The deployment runs multiple replicas of a container that listens on port 8080. What is the most likely cause?

Accepted Answer

The deployment has hostPort: 8080 specified, causing port conflict when multiple replicas are scheduled on the same node.. The 'bind: address already in use' error indicates that the container's process cannot bind to port 8080 because it is already occupied. When `hostPort: 8080` is specified in the pod spec, Kubernetes instructs the container runtime to map the container port to the same port on the node's network namespace. If multiple replicas of the deployment are scheduled on the same node, each pod attempts to bind to port 8080 on the host, causing a conflict and the CrashLoopBackOff state. This is a common misconfiguration when using hostPort without ensuring that replicas are spread across different nodes.

Answer

The container is attempting to bind to a privileged port without the necessary capabilities.

Answer

The service is using NodePort and the node port is already in use.

Answer

Multiple containers in the same pod are trying to bind to the same port.

Question 4

A developer needs to ensure that microservice A can securely communicate with microservice B over HTTPS within a Kubernetes cluster. What is the simplest approach?

Accepted Answer

Create a Kubernetes Service of type ClusterIP for microservice B and configure microservice A to use HTTPS with the service DNS name.. Option D is correct because using a ClusterIP Service for microservice B provides a stable DNS name within the cluster, allowing microservice A to communicate over HTTPS without exposing the service externally. This approach leverages Kubernetes' internal service discovery and can be paired with a service mesh or mutual TLS (mTLS) for secure communication, meeting the requirement for simplicity and security.

Answer

Use a Kubernetes Ingress resource with TLS termination for microservice B.

Answer

Expose microservice B via a LoadBalancer Service and use HTTPS from microservice A.

Answer

Connect directly using the pod IP of microservice B over HTTP.

Question 5

An engineer is designing a CI/CD pipeline for a Python application. The pipeline should automatically run unit tests, build a Docker image, push it to a private registry, and deploy to a Kubernetes cluster. Which sequence of stages is correct?

Accepted Answer

Test -> Build -> Push -> Deploy. Option D is correct because a CI/CD pipeline for a Python application must first run unit tests to validate code quality, then build the Docker image from the tested code, push the image to a private registry, and finally deploy to Kubernetes. This sequence ensures that only tested and built artifacts are deployed, preventing deployment of broken or untested code.

Answer

Build -> Test -> Push -> Deploy

Answer

Test -> Push -> Deploy

Answer

Test -> Deploy -> Build -> Push

Question 6

A security policy requires that all container images in a registry are scanned for vulnerabilities before deployment. Which approach best integrates this into a CI/CD pipeline without slowing down the pipeline?

Accepted Answer

Build the image, scan it locally, and if it passes, push it to the registry; run scans in parallel with the build if possible.. Option C is correct because it shifts the vulnerability scan left in the pipeline: the image is built and scanned locally before being pushed to the registry. If the scan passes, the image is pushed; if it fails, the pipeline stops early, avoiding the overhead of pushing a vulnerable image and then rebuilding. This approach minimizes pipeline latency by running scans in parallel with the build where possible, ensuring security without blocking the deployment flow.

Answer

Build the image, push it, then scan it, and if vulnerabilities are found, rebuild and repush.

Answer

Run the vulnerability scan on the image after pushing to the registry and block deployment if critical vulnerabilities are found.

Answer

Scan the source code dependencies before building the image, and skip image scanning.

Question 7

A DevOps engineer wants to automate the configuration of network devices using Ansible. Which file format is commonly used for Ansible playbooks?

Accepted Answer

YAML. Ansible playbooks are written in YAML (YAML Ain't Markup Language) because YAML is human-readable, supports complex data structures like lists and dictionaries, and is designed for configuration files. YAML's indentation-based syntax aligns with Ansible's declarative automation model, making it the default and recommended format for defining tasks, variables, and handlers in playbooks.

Answer

INI

Answer

XML

Answer

JSON

Question 8

In a Cisco DNA Center environment, an application needs to retrieve the network device list using REST API. Which authentication method is required?

Accepted Answer

Obtain an API token by POSTing credentials to /dna/system/api/v1/auth/token, then use the token in subsequent requests. Cisco DNA Center uses token-based authentication. The correct flow is to first send a POST request to the /dna/system/api/v1/auth/token endpoint with a valid username and password (typically using Basic Authentication over HTTPS). The response contains a JSON Web Token (JWT) that must be included in the Authorization header of all subsequent API requests as 'Bearer <token>'. This token has a configurable expiry (default 60 minutes) and must be refreshed before it expires.

Answer

OAuth 2.0 client credentials grant with client ID and secret

Answer

Basic authentication with username and password in the header

Answer

API key passed in a query parameter

Question 9

Which TWO statements about Dockerfile best practices are correct? (Choose two.)

Accepted Answer

Use a .dockerignore file to exclude unnecessary files from the build context.. Option C is correct because a .dockerignore file prevents unnecessary files (e.g., node_modules, .git, logs) from being sent to the Docker daemon as part of the build context. This reduces build time, minimizes the risk of including sensitive data, and ensures a cleaner, more efficient image build.

Answer

Use the ADD instruction instead of COPY to copy local files into the image.

Answer

Combine multiple RUN commands into a single RUN statement to reduce image layers.

Answer

Use the EXPOSE instruction to secure the container by limiting exposed ports.

Question 10

Which THREE security measures should be implemented in a CI/CD pipeline to protect against supply chain attacks? (Choose three.)

Accepted Answer

Pin dependency versions to specific hashes.. Option B is correct because pinning dependency versions to specific hashes (e.g., using `integrity` attributes in npm’s package-lock.json or `sha256` checksums in pip’s requirements.txt) ensures that only the exact, verified content is downloaded. This prevents an attacker from substituting a malicious version of a dependency, even if the version tag remains the same, by validating the cryptographic hash of the artifact against a known good value.

Answer

Enable verbose logging for all build steps to detect anomalies.

Answer

Sign all build artifacts with a GPG key.

Question 11

Which TWO are valid methods to secure a REST API? (Choose two.)

Accepted Answer

Use HTTPS to encrypt data in transit.. HTTPS (HTTP over TLS) encrypts the entire HTTP conversation, including headers and payload, using Transport Layer Security (TLS). This prevents eavesdropping, man-in-the-middle attacks, and tampering of data in transit. For a REST API, HTTPS is a fundamental security requirement to protect sensitive data and credentials from being exposed on the network.

Answer

Use HTTP with basic authentication.

Answer

Embed API keys in the URL query string.

Answer

Implement rate limiting to prevent abuse.

Question 12

Refer to the exhibit. A Python script uses the Cisco IOS-XE RESTCONF API to retrieve the device configuration. The returned JSON is shown. What must be done to enable the GigabitEthernet0/1 interface using the API?

Accepted Answer

Send a PATCH request to the interface resource with the JSON payload {"enabled": true}.. Option A is correct because RESTCONF uses PATCH for partial updates. To enable an interface, you only need to send the specific field that changes ({"enabled": true}) to the interface resource URI, which modifies the configuration without replacing the entire resource.

Answer

Send a DELETE request to the interface resource.

Answer

Send a GET request to the interface resource and parse the response.

Answer

Send a PUT request to the interface resource with the entire JSON payload.

Question 13

Refer to the exhibit. A developer is building a Docker image for a Node.js application. The Dockerfile contains:
```
FROM node:14
WORKDIR /usr/src/app
COPY package*.json ./
RUN npm install
COPY . .
CMD ["node", "app.js"]
```
When building, the error shown occurs. What is the most likely cause?

Accepted Answer

The application is running as a non-root user (e.g., node) that lacks write permission to the working directory.. The error occurs because the official Node.js Docker image (node:14) runs as a non-root user named 'node' by default. The WORKDIR /usr/src/app is owned by root, so the 'node' user lacks write permission to that directory. When npm install tries to create node_modules or write package-lock.json, it fails with a permission error. Option D correctly identifies this user-permission mismatch.

Answer

The Dockerfile should use the root user for running npm install.

Answer

The npm install command should be run with the --unsafe-perm flag.

Answer

The base image node:14 is outdated and contains a bug.

Question 14

A company runs a microservices application on a Kubernetes cluster with 10 worker nodes. The application consists of 3 services: frontend, backend, and database. The database service is stateful and uses persistent volumes. Recently, the operations team noticed that the backend service is experiencing intermittent failures with 'Connection refused' errors when trying to connect to the database. The database service is exposed via a ClusterIP service named 'database-service'. The backend service uses environment variable DB_HOST=database-service to connect. The pod logs show that the connection is attempted to an IP address that does not correspond to any database pod. Further investigation reveals that the database pod has been restarted multiple times due to OOMKilled errors. The backend service is configured with a liveness probe that checks the health endpoint every 10 seconds, and a readiness probe that checks the same endpoint every 5 seconds. The database pod has resource limits set to 512Mi memory and 500m CPU. The node running the database pod has 4Gi memory and 2 CPU cores. What is the most likely cause of the intermittent connection failures?

Accepted Answer

The database pod is being killed due to memory limits, causing frequent restarts and temporary unavailability; the backend's connection attempts fail during the restart window.. The intermittent 'Connection refused' errors are caused by the database pod being repeatedly killed due to exceeding its memory limit (512Mi), which triggers OOMKilled restarts. During the restart window, the database pod is unavailable, and the backend's connection attempts to the ClusterIP service (which resolves to the pod's IP) fail because no pod is ready to accept connections. The frequent restarts create a pattern of temporary unavailability that aligns with the observed symptoms.

Answer

The backend service is using a hardcoded IP address instead of the service DNS name.

Answer

The backend service's readiness probe is failing, so it is not receiving traffic, but the backend still tries to connect.

Answer

The DNS entry for database-service is cached and pointing to the old pod IP after the database pod restarts.

Question 15

A network engineer is automating the deployment of a new VLAN across multiple Cisco switches using Ansible. The engineer has written a playbook that uses the ios_vlan module to create VLAN 100 with name 'Users'. The playbook runs successfully on the first switch but fails on the second switch with the error message: 'VLAN name is already in use'. The engineer checks the second switch and confirms that VLAN 100 does not exist, but a different VLAN with the name 'Users' exists. The engineer wants to ensure that the playbook creates VLAN 100 with the exact name 'Users' only if it does not already exist, and without conflicting with existing VLANs. Which approach should the engineer take?

Accepted Answer

Use the ios_vlan module with parameters vlan_id=100 and name='Users' and set state=present. The module will create the VLAN if it does not exist or update the name if it exists with a different name.. Option A is correct because the `ios_vlan` module with `state=present` ensures idempotency: if VLAN 100 does not exist, it creates it with the specified name; if VLAN 100 exists but has a different name, it updates the name to 'Users'. This directly resolves the conflict where a different VLAN ID already uses the name 'Users', as the module will not attempt to reuse a name that is already assigned to another VLAN — instead, it will fail with the observed error only if the name is already in use by a different VLAN ID. The engineer's goal is to create VLAN 100 with name 'Users' only if it does not already exist, and the module's default behavior (without additional checks) will fail when the name is taken, so the correct approach is to rely on the module's built-in idempotency to create or update VLAN 100 without conflicting with existing VLAN names.

Answer

First use the ios_command module to run 'show vlan name Users' and then conditionally create VLAN 100 if no output is returned.

Answer

Use the ios_config module to directly apply the configuration 'vlan 100
 name Users' and then use the 'parents' directive to ensure idempotency.

Answer

Use the ios_vlan module with vlan_id=100 and state=present, but omit the name parameter.

Question 16

A DevOps team is deploying a microservices application on Cisco UCS using Docker containers. They need to ensure that secrets such as database credentials are securely managed without hardcoding them in the application code or container images. Which approach should they use?

Accepted Answer

Use a secure secret store like HashiCorp Vault and retrieve secrets at runtime via API.. Option C is correct because it follows the principle of secret management by decoupling sensitive data from application code and container images. HashiCorp Vault provides a centralized, encrypted secret store with dynamic secrets, access policies, and audit logging, allowing the microservices to authenticate and retrieve credentials at runtime via its REST API, eliminating the need to hardcode secrets.

Answer

Embed secrets directly in the container image using COPY instructions.

Answer

Pass secrets as build arguments in the Docker build command.

Answer

Store secrets as environment variables in the Docker Compose file.

Question 17

Which TWO of the following are valid security considerations when deploying an application to a Kubernetes cluster managed by Cisco Intersight? (Choose two.)

Accepted Answer

Define Network Policies to isolate pods and control traffic flow.. Option B is correct because Network Policies in Kubernetes act as a firewall at the pod level, using label selectors and namespace selectors to control ingress and egress traffic. In a Cisco Intersight-managed cluster, defining these policies is a critical security consideration to enforce micro-segmentation and prevent lateral movement of threats. Option E is correct because Pod Security Policies (PSPs) are a cluster-level resource that control security-sensitive aspects of pod specification, such as preventing privileged containers, which is a key security best practice in Kubernetes.

Answer

Store secrets in ConfigMaps for easy retrieval.

Answer

Disable RBAC to simplify management and reduce overhead.

Answer

Use default service accounts for all pods to avoid misconfiguration.

Question 18

Refer to the exhibit. An engineer applied this configuration to a Cisco switch port connected to an application server. The server runs a critical business application that should not be disrupted. However, after applying the configuration, the port goes into errdisable state. What is the most likely cause?

Accepted Answer

The server is generating BPDU frames, triggering BPDU guard.. The correct answer is D because BPDU guard is enabled on the switch port (implicitly or explicitly via spanning-tree bpduguard enable). When the application server sends BPDU frames—perhaps because it is running a software bridge, virtualization host, or has a misconfigured NIC—the switch detects these frames on a port configured with portfast and immediately errdisables the port to prevent a potential bridging loop. This matches the symptom of the port going into errdisable state after applying the configuration.

Answer

The VLAN 10 does not exist on the switch.

Answer

The spanning-tree portfast command is incompatible with access ports.

Answer

The switchport mode access command is incorrect for a server connection.

Question 19

Drag and drop the steps to set up a basic DHCP server on a Cisco router into the correct order.

Question 20

Drag and drop the steps to configure a Cisco IOS device for NETCONF access into the correct order.