200-901 Application Deployment and Security Practice Test 5 — 15 Questions

Question 1

A network automation script using NX-API on a Nexus switch fails intermittently with HTTP 500 errors. Which two troubleshooting steps are most effective in diagnosing the issue? (Choose two.)

Accepted Answer

Enable NX-API debugging on the switch to capture detailed logs.. Option C is correct because enabling NX-API debugging on the switch (using the 'debug nxapi' command) captures detailed logs of API requests and responses, including HTTP 500 error details. This allows you to pinpoint the root cause, such as malformed payloads, internal server errors, or resource exhaustion. Without debugging, the generic 500 error provides no insight into the specific failure.

Answer

Check the length of the JSON payload sent to the API.

Answer

Ensure the switch is running NX-OS version 9.3(1) or later.

Answer

Use HTTP instead of HTTPS for the API requests.

Question 2

Refer to the exhibit. A developer from subnet 10.10.10.0/24 cannot reach the RESTCONF API on the IOS-XE device. What is the most likely cause?

Accepted Answer

The 10.10.10.0/24 subnet is not permitted by the access-class.. The access-class configured under the RESTCONF API restricts incoming connections to specific subnets. Since the developer is on subnet 10.10.10.0/24, which is not listed in the permit statement, all HTTPS requests from that subnet are dropped before reaching the API. This is the most direct cause of the connectivity failure.

Answer

HTTPS is not enabled on the device.

Answer

The HTTP server is not enabled.

Answer

Authentication is not configured as local.

Question 3

Refer to the exhibit. A Meraki network has a group policy 'Block Social Media' that references a content filtering rule. The policy is applied to VLAN 1. Users in that VLAN cannot access instagram.com but can access facebook.com. What is the most likely reason?

Accepted Answer

The blocked URL patterns list does not include all social media sites.. Option C is correct because the group policy 'Block Social Media' references a content filtering rule that likely uses a predefined or custom URL category list. If the rule blocks only specific URL patterns (e.g., 'instagram.com') but does not include all social media sites (e.g., 'facebook.com'), then users can still access unblocked sites. Meraki content filtering operates on URL category matching or explicit URL pattern lists; if the list is incomplete, the policy will not block all intended sites.

Answer

The content filtering rule blocks only a specific set of URLs, but not all social media sites.

Answer

The group policy is not applied to the VLAN.

Answer

The content filtering is not enabled on the MX appliance.

Question 4

Refer to the exhibit. A developer builds this Docker image and runs it. The container starts but cannot be accessed on port 5000 from the host. What is the most likely cause?

Accepted Answer

The EXPOSE instruction does not publish the port; the container was run without -p.. The EXPOSE instruction in a Dockerfile is documentation only; it does not actually publish the container's port to the host. For the container to be accessible on port 5000 from the host, the container must be run with the `-p` (or `--publish`) flag (e.g., `docker run -p 5000:5000 ...`). Without this, the container's port 5000 is only reachable from within the Docker network, not from the host.

Answer

The requirements.txt is missing Flask.

Answer

The Python application is not listening on 0.0.0.0.

Answer

The container is using a different port inside.

Question 5

A developer is deploying a containerized application to a Kubernetes cluster. To ensure that the application can securely access a third-party API, what is the best practice for storing the API key?

Accepted Answer

Store it as a Kubernetes Secret and mount it as an environment variable.. Option A is correct because Kubernetes Secrets are designed for sensitive data and can be mounted as environment variables. Option B is insecure because hardcoding keys in images exposes them. Option C is incorrect because ConfigMaps are for non-sensitive data. Option D is incorrect because service account tokens are for cluster authentication, not external APIs.

Answer

Hardcode the API key in the Docker image.

Answer

Use a service account token.

Answer

Store it in a ConfigMap and reference it from the pod.

Question 6

During a CI/CD pipeline, a security scan reveals that a Docker image contains a vulnerability in a base layer. Which action BEST addresses the issue?

Accepted Answer

Rebuild the image using an updated base image from a trusted registry.. Option B is correct because the vulnerability exists in the base layer of the Docker image, which is immutable once built. The only way to eliminate the vulnerability is to rebuild the image using an updated base image from a trusted registry (e.g., Docker Hub official images or a private registry with patched images). This ensures the vulnerable packages are replaced with patched versions at the OS or application level, directly addressing the root cause.

Answer

Disable the security scanner to avoid false positives.

Answer

Implement run-time security monitoring to detect exploitation.

Answer

Add an exception to the vulnerability report.

Question 7

A microservice application uses JWT for authentication. The JWT is signed with RS256. Which practice ensures that the public key used for verification is securely distributed to all services?

Accepted Answer

Store the public key in a Kubernetes ConfigMap and mount it into pods.. Option D is correct because Kubernetes ConfigMaps allow you to decouple configuration artifacts like public keys from container images, enabling secure, centralized distribution. Mounting the ConfigMap into pods ensures that all microservice instances can access the same public key without embedding it in source code or relying on external PKI for every verification. This approach aligns with cloud-native best practices for managing secrets and configuration in a microservice architecture.

Answer

Include the public key in the JWT header.

Answer

Embed the public key in each service's source code.

Answer

Use a public key infrastructure (PKI) and distribute via HTTPS.

Question 8

A company wants to implement a zero-trust model for API access between microservices. What is the most effective way to authenticate service-to-service communication?

Accepted Answer

Issue short-lived TLS certificates for each service.. Option C is correct because mutual TLS (mTLS) with short-lived certificates validates identity and limits exposure. Options A and D are incorrect because shared secrets and long-lived API keys are less secure. Option B is incorrect because network segmentation is not authentication.

Answer

Rely on network segmentation with firewalls.

Answer

Use a shared secret that all services know.

Answer

Use long-lived API keys.

Question 9

In a Kubernetes deployment, the container image pull policy is set to "Always". This causes performance issues during rollouts because the image registry is slow. What is the best practice to reduce pull time while maintaining security?

Accepted Answer

Set pullPolicy to "IfNotPresent" for stable releases and use image tags like v1.2.3.. Option A is correct because setting `pullPolicy` to `IfNotPresent` for stable releases (using immutable tags like `v1.2.3`) avoids unnecessary image pulls from a slow registry when the image already exists on the node. This reduces rollout time while maintaining security by ensuring that only explicitly versioned, verified images are used, preventing accidental use of stale or untagged images.

Answer

Use the ":latest" tag to ensure always fresh images.

Answer

Set pullPolicy to "Never" and pre-pull images on nodes.

Answer

Disable image verification to speed up pulls.

Question 10

A security team wants to ensure that only signed Docker images are deployed in production. Which CI/CD pipeline step validates the image signature before deployment?

Accepted Answer

Use Docker Content Trust with Notary to verify signatures.. Docker Content Trust (DCT) integrates with Notary to provide a framework for signing and verifying Docker images. When DCT is enabled in the CI/CD pipeline, the Docker client verifies the image's signature against a trusted signing key before allowing the image to be pulled or deployed, ensuring only images signed by authorized parties are used in production.

Answer

Compare the image SHA with a known good hash.

Answer

Run a vulnerability scan on the image.

Answer

Check the image size on registry.

Question 11

An application running in a Kubernetes pod needs to access an external database securely. The database credentials are rotated every 24 hours. Which approach ensures that the pod always uses the current credentials without manual intervention?

Accepted Answer

Use a Secrets Store CSI driver to mount secrets from an external vault as a volume.. Option D is correct because a Secrets Store CSI driver can dynamically mount secrets from an external vault, and the application can read the updated secret from the volume without restarting the pod. Option A is incorrect because restarting daily is disruptive. Option B is valid but the CSI driver is more integrated and standard. Option C is not a specific solution.

Answer

Embed a token in the application code that refreshes automatically.

Answer

Store credentials in a Kubernetes Secret and mount as volume; restart pod daily.

Answer

Use a sidecar container that watches a vault and updates the application config.

Question 12

A developer is creating a Helm chart for a stateless web application. Where should the application's configuration settings (like log level and feature flags) be stored?

Accepted Answer

In values.yaml file of the Helm chart.. In a Helm chart, the `values.yaml` file is the standard location for configuration settings like log level and feature flags. This file allows developers to externalize configuration from the application code and Docker image, enabling environment-specific overrides without rebuilding the image. Helm uses `values.yaml` to inject these settings into Kubernetes manifests via template directives, making the chart reusable across different deployments.

Answer

Directly in the Docker image.

Answer

Hardcoded in the application code.

Answer

In a Kubernetes Secret.

Question 13

During a security audit, it is found that a microservice exposes its internal IP address in error responses. This could help attackers map the network. What is the BEST remediation?

Accepted Answer

Configure the application to return generic error messages without internal details.. Option C is correct because exposing internal IP addresses in error responses violates the principle of least information disclosure. The best remediation is to configure the application to return generic error messages (e.g., HTTP 500 with a generic body) that strip out internal details like IP addresses, stack traces, or debug data. This prevents attackers from using error responses to map the internal network topology, a common information-gathering technique.

Answer

Use a service mesh to encrypt traffic.

Answer

Log the errors and monitor them.

Answer

Add a firewall to block external access to the service.

Question 14

A company is implementing an API gateway for its microservices. Which TWO security features should be enabled at the gateway to protect backend services?

Accepted Answer

JWT validation.. JWT validation at the API gateway ensures that only requests with valid, unexpired, and properly signed JSON Web Tokens are forwarded to backend microservices. This offloads authentication and token verification from individual services, enforcing a consistent security boundary and preventing unauthorized access.

Answer

In-depth packet inspection.

Answer

Database connection pooling.

Answer

CORS configuration.

Question 15

A DevOps team is securing a CI/CD pipeline that deploys containerized applications to Kubernetes. Which THREE practices enhance security?

Accepted Answer

Implementing network policies to restrict pod communication.. Network policies in Kubernetes act as a firewall for pods, restricting ingress and egress traffic based on labels, namespaces, or IP blocks. This implements a zero-trust model by default, preventing lateral movement if a container is compromised. Option A is correct because it directly reduces the attack surface within the cluster.

Answer

Allowing containers to run with privileges.

Answer

Running containers as root.