200-901 Application Deployment and Security — 15 Questions

Question 1

A developer creates a Dockerfile for a Python web application. Which instruction should be used to copy the application source code into the container image?

Accepted Answer

COPY. The COPY instruction copies files or directories from the build context into the container filesystem. RUN executes commands, EXPOSE documents ports, and CMD sets default command.

Answer

CMD

Answer

RUN

Answer

EXPOSE

Question 2

A Docker container needs to be started in detached mode with port mapping from host port 8080 to container port 80. Which command accomplishes this?

Accepted Answer

docker run -d -p 8080:80 myapp. The -d flag runs container in detached mode, -p maps host port to container port.

Answer

docker start -d -p 8080:80 myapp

Answer

docker run -it -p 8080:80 myapp

Answer

docker run -d -p 80:8080 myapp

Question 3

In a docker-compose.yaml file, which key is used to define the container image to be built from a Dockerfile in the current directory?

Accepted Answer

build. The 'build' key specifies the path to the Dockerfile context; 'image' specifies a pre-built image from a registry.

Answer

dockerfile

Answer

image

Answer

context

Question 4

A company deploys a microservice using Kubernetes. The service must be accessible externally via a stable IP address and load-balanced across pods. Which Service type should be used?

Accepted Answer

LoadBalancer. LoadBalancer exposes the service externally using a cloud provider's load balancer. ClusterIP is internal only, NodePort exposes on each node's IP, ExternalName maps to external DNS.

Answer

NodePort

Answer

ClusterIP

Answer

ExternalName

Question 5

A CI/CD pipeline has a stage that runs security vulnerability scans on dependencies. Which tool is specifically designed to scan Python packages for known vulnerabilities?

Accepted Answer

pip audit. pip audit checks Python packages for vulnerabilities. npm audit is for Node.js, Snyk is a third-party tool, Dependabot automates dependency updates.

Answer

Snyk

Answer

Dependabot

Answer

npm audit

Question 6

A developer is writing a Dockerfile for a Node.js application. They want to set a build-time variable for the application version that can be changed without modifying the Dockerfile. Which instruction should be used?

Accepted Answer

ARG. ARG allows passing build-time variables. ENV sets environment variables that persist in the container. CMD and RUN are not for variable definition.

Answer

RUN

Answer

ENV

Answer

CMD

Question 7

A Kubernetes pod needs to read configuration data such as database hostname, which is non-sensitive and may change across environments. Which resource should be used to store this data and inject it into the pod?

Accepted Answer

ConfigMap. ConfigMap stores non-sensitive configuration data. Secret stores sensitive data. Deployment and Service are for workload and networking.

Answer

Deployment

Answer

Secret

Answer

Service

Question 8

A developer needs to apply a Kubernetes deployment manifest from a file named 'deployment.yaml'. Which kubectl command should be used?

Accepted Answer

kubectl apply -f deployment.yaml. kubectl apply -f creates or updates resources from a file. get, describe, and create are not used for applying manifests.

Answer

kubectl create deployment.yaml

Answer

kubectl describe -f deployment.yaml

Answer

kubectl get -f deployment.yaml

Question 9

In a Docker bridge network, two containers can communicate with each other using which identifier by default?

Accepted Answer

Their IP addresses only. On the default Docker bridge network, DNS resolution for container names is not provided. Therefore, containers can only communicate using IP addresses by default. User-defined bridge networks enable name resolution.

Answer

Their image names

Answer

Their container names

Answer

Their MAC addresses

Question 10

A developer needs to view the logs of a running Docker container with ID 'abc123'. Which command should be used?

Accepted Answer

docker logs -f abc123. docker logs -f follows the log output. docker exec runs a command inside container, docker attach attaches to a running container's I/O, docker inspect shows detailed info.

Answer

docker inspect abc123

Answer

docker exec -it abc123 logs

Answer

docker attach abc123

Question 11

A Kubernetes Deployment is configured with rolling update strategy. A new version of the image is pushed, and the deployment is updated. During the rollout, the new pods are failing health checks. Which command can be used to pause the rollout and prevent further updates?

Accepted Answer

kubectl rollout pause deployment/myapp. kubectl rollout pause suspends the rollout. kubectl rollout undo rolls back to previous revision. kubectl rollout status shows status, and kubectl delete does not pause rollout.

Answer

kubectl rollout undo deployment/myapp

Answer

kubectl delete deployment/myapp

Answer

kubectl rollout status deployment/myapp

Question 12

A CI/CD pipeline using GitHub Actions needs to build a Docker image and push it to Docker Hub. Which event trigger should be used to run the workflow only when code is pushed to the main branch?

Accepted Answer

on: push: branches: [ main ]. The 'push' event with branch filter triggers on pushes to main. 'pull_request' triggers on PRs, 'release' on releases, 'workflow_dispatch' manual trigger.

Answer

on: workflow_dispatch

Answer

on: release: types: [ published ]

Answer

on: pull_request: branches: [ main ]

Question 13

A developer is implementing secure coding practices to prevent SQL injection. Which approach is most effective when building a SQL query with user input?

Accepted Answer

Using parameterized queries with prepared statements. Parameterized queries separate SQL code from data, preventing injection. Input validation helps but not sufficient alone. Stored procedures can help but parameterized queries are standard. Escaping is error-prone.

Answer

Validating user input to allow only alphanumeric characters

Answer

Storing user input in a database before using it in a query

Answer

Escaping all user input with a function like mysqli_real_escape_string

Question 14

In a Docker Compose file with multiple services, one service depends on another to be healthy before starting. Which key should be used to express this dependency and ensure the dependent service is started first?

Accepted Answer

depends_on. depends_on in Docker Compose controls startup order. 'links' is legacy, 'networks' defines networks, 'volumes' mounts volumes.

Answer

volumes

Answer

networks

Answer

links

Question 15

A Kubernetes pod needs to run a database that requires persistent storage. Which volume type should be used to store data that persists beyond the pod lifecycle?

Accepted Answer

PersistentVolumeClaim. PersistentVolumeClaim requests persistent storage that survives pod restarts. emptyDir is ephemeral, hostPath ties to a node, configMap is for configuration.

Answer

emptyDir

Answer

configMap

Answer

hostPath