200-901 Application Deployment and Security Practice Test 2 — 15 Questions

Question 1

A DevOps team is deploying a microservices application on Cisco UCS using Docker containers. They need to ensure that secrets such as database credentials are securely managed without hardcoding them in the application code or container images. Which approach should they use?

Accepted Answer

Use a secure secret store like HashiCorp Vault and retrieve secrets at runtime via API.. Option C is correct because it follows the principle of secret management by decoupling sensitive data from application code and container images. HashiCorp Vault provides a centralized, encrypted secret store with dynamic secrets, access policies, and audit logging, allowing the microservices to authenticate and retrieve credentials at runtime via its REST API, eliminating the need to hardcode secrets.

Answer

Embed secrets directly in the container image using COPY instructions.

Answer

Pass secrets as build arguments in the Docker build command.

Answer

Store secrets as environment variables in the Docker Compose file.

Question 2

Which TWO of the following are valid security considerations when deploying an application to a Kubernetes cluster managed by Cisco Intersight? (Choose two.)

Accepted Answer

Define Network Policies to isolate pods and control traffic flow.. Option B is correct because Network Policies in Kubernetes act as a firewall at the pod level, using label selectors and namespace selectors to control ingress and egress traffic. In a Cisco Intersight-managed cluster, defining these policies is a critical security consideration to enforce micro-segmentation and prevent lateral movement of threats. Option E is correct because Pod Security Policies (PSPs) are a cluster-level resource that control security-sensitive aspects of pod specification, such as preventing privileged containers, which is a key security best practice in Kubernetes.

Answer

Store secrets in ConfigMaps for easy retrieval.

Answer

Disable RBAC to simplify management and reduce overhead.

Answer

Use default service accounts for all pods to avoid misconfiguration.

Question 3

Refer to the exhibit. An engineer applied this configuration to a Cisco switch port connected to an application server. The server runs a critical business application that should not be disrupted. However, after applying the configuration, the port goes into errdisable state. What is the most likely cause?

Accepted Answer

The server is generating BPDU frames, triggering BPDU guard.. The correct answer is D because BPDU guard is enabled on the switch port (implicitly or explicitly via spanning-tree bpduguard enable). When the application server sends BPDU frames—perhaps because it is running a software bridge, virtualization host, or has a misconfigured NIC—the switch detects these frames on a port configured with portfast and immediately errdisables the port to prevent a potential bridging loop. This matches the symptom of the port going into errdisable state after applying the configuration.

Answer

The VLAN 10 does not exist on the switch.

Answer

The spanning-tree portfast command is incompatible with access ports.

Answer

The switchport mode access command is incorrect for a server connection.

Question 4

Drag and drop the steps to set up a basic DHCP server on a Cisco router into the correct order.

Question 5

Drag and drop the steps to configure a Cisco IOS device for NETCONF access into the correct order.

Question 6

Match each network automation tool to its primary purpose.

Question 7

Match each Python library to its typical use in network automation.

Question 8

A developer wants to deploy a containerized application on a Cisco Container Platform (CCP) cluster. The application requires persistent storage. Which Kubernetes resource should be used to provision storage?

Accepted Answer

ConfigMap. PersistentVolumeClaim (PVC) is the correct Kubernetes resource for requesting persistent storage in a CCP cluster. A PVC binds to a PersistentVolume (PV) that has been provisioned by the cluster administrator or dynamically via a StorageClass, making it the standard abstraction for storage consumption in containerized applications.

Answer

Secret

Answer

Service

Answer

PersistentVolumeClaim

Question 9

Which of the following is a best practice for securing API keys in a CI/CD pipeline?

Accepted Answer

Share via email. Option A is correct because sharing API keys via email is not a best practice; the correct best practice is to use environment variables in the build configuration (Option D). Environment variables keep secrets out of source code, Dockerfiles, and insecure communication channels like email, ensuring they are injected at runtime and not exposed in logs or artifacts.

Answer

Hardcode in Dockerfile

Answer

Store them in source code

Answer

Use environment variables in build configuration

Question 10

An application running on Kubernetes is experiencing intermittent 503 errors. The logs show 'upstream timed out'. The application is behind a Cisco Application Policy Infrastructure Controller (APIC) load balancer. What is the most likely cause?

Accepted Answer

The Readiness probe is not defined. The 'upstream timed out' error in a Kubernetes environment behind a Cisco APIC load balancer indicates that the load balancer is attempting to forward traffic to a pod that is not ready to accept connections. Without a Readiness probe, Kubernetes assumes the pod is ready as soon as it starts, but the application may still be initializing or unable to handle requests. The APIC load balancer then sends traffic to an unready pod, causing timeouts and 503 errors.

Answer

The service port is misconfigured

Answer

The Liveness probe timeout is too low

Answer

The pod is not ready

Question 11

A DevOps team is using Cisco AppDynamics to monitor a microservices application. They notice that a specific service's response time spikes under load. Which AppDynamics feature should be used to drill down into the transaction trace?

Accepted Answer

Business Transactions. Business Transactions in AppDynamics represent the logical business operations (e.g., checkout, login) that span across multiple tiers. When a response time spike occurs, selecting the specific Business Transaction allows you to drill into its Transaction Snapshots, which capture the full distributed trace including call chains, method timings, and database queries. This is the correct entry point for root-cause analysis of performance degradation.

Answer

Health Rules

Answer

Transaction Snapshots

Answer

Service Endpoints

Question 12

Which Docker command is used to build an image from a Dockerfile?

Accepted Answer

docker build. The `docker build` command reads the instructions in a Dockerfile and assembles a Docker image layer by layer. Each instruction in the Dockerfile (e.g., FROM, RUN, COPY) creates a new layer that is cached and reused, making subsequent builds faster. This is the standard and only command designed specifically for building images from a Dockerfile.

Answer

docker run

Answer

docker commit

Answer

docker create

Question 13

A Kubernetes cluster is configured with a NetworkPolicy that allows ingress traffic only from pods with label 'app: frontend'. A new backend service needs to communicate with the database pod. What must be done to allow this?

Accepted Answer

Delete the existing NetworkPolicy. Option A is correct because the existing NetworkPolicy explicitly restricts ingress traffic to only pods with the label 'app: frontend'. Since the new backend service does not have this label, its traffic will be blocked by the policy. Deleting the NetworkPolicy removes all ingress restrictions, allowing the backend service to communicate with the database pod. In Kubernetes, NetworkPolicies are additive and default-deny if any policy selects the pod, so removing the policy is the simplest way to permit all ingress traffic.

Answer

Add label 'app: backend' to the database pod

Answer

Modify the NetworkPolicy to include an additional rule allowing from pods with label 'app: backend'

Answer

Create a new NetworkPolicy for the database

Question 14

In a CI/CD pipeline using Jenkins, which plugin is commonly used to integrate with Cisco Container Platform for deploying containers?

Accepted Answer

Cisco Container Platform Plugin. The Cisco Container Platform Plugin is the correct choice because it provides native integration between Jenkins and Cisco Container Platform (CCP), enabling automated deployment of containers directly to CCP clusters. This plugin handles authentication, cluster discovery, and deployment orchestration specific to CCP, which is built on Kubernetes but includes Cisco-specific extensions for policy and networking.

Answer

Docker Pipeline Plugin

Answer

Kubernetes CLI Plugin

Answer

SSH Plugin

Question 15

Which Cisco product provides end-to-end application visibility and performance monitoring across hybrid cloud environments?

Accepted Answer

Cisco Intersight. Cisco Intersight is the correct answer because it provides unified infrastructure management with end-to-end application visibility and performance monitoring across hybrid cloud environments. It integrates telemetry from compute, storage, and network resources, enabling real-time insights into application behavior regardless of whether workloads run on-premises or in public clouds.

Answer

Cisco DNA Center

Answer

Cisco AppDynamics

Answer

Cisco SecureX