200-901 Application Deployment and Security — 30 Questions

Question 1

A developer creates a Dockerfile for a Python web application. Which instruction should be used to copy the application source code into the container image?

Accepted Answer

COPY. The COPY instruction copies files or directories from the build context into the container filesystem. RUN executes commands, EXPOSE documents ports, and CMD sets default command.

Answer

CMD

Answer

RUN

Answer

EXPOSE

Question 2

A Docker container needs to be started in detached mode with port mapping from host port 8080 to container port 80. Which command accomplishes this?

Accepted Answer

docker run -d -p 8080:80 myapp. The -d flag runs container in detached mode, -p maps host port to container port.

Answer

docker start -d -p 8080:80 myapp

Answer

docker run -it -p 8080:80 myapp

Answer

docker run -d -p 80:8080 myapp

Question 3

In a docker-compose.yaml file, which key is used to define the container image to be built from a Dockerfile in the current directory?

Accepted Answer

build. The 'build' key specifies the path to the Dockerfile context; 'image' specifies a pre-built image from a registry.

Answer

dockerfile

Answer

image

Answer

context

Question 4

A company deploys a microservice using Kubernetes. The service must be accessible externally via a stable IP address and load-balanced across pods. Which Service type should be used?

Accepted Answer

LoadBalancer. LoadBalancer exposes the service externally using a cloud provider's load balancer. ClusterIP is internal only, NodePort exposes on each node's IP, ExternalName maps to external DNS.

Answer

NodePort

Answer

ClusterIP

Answer

ExternalName

Question 5

A CI/CD pipeline has a stage that runs security vulnerability scans on dependencies. Which tool is specifically designed to scan Python packages for known vulnerabilities?

Accepted Answer

pip audit. pip audit checks Python packages for vulnerabilities. npm audit is for Node.js, Snyk is a third-party tool, Dependabot automates dependency updates.

Answer

Snyk

Answer

Dependabot

Answer

npm audit

Question 6

A developer is writing a Dockerfile for a Node.js application. They want to set a build-time variable for the application version that can be changed without modifying the Dockerfile. Which instruction should be used?

Accepted Answer

ARG. ARG allows passing build-time variables. ENV sets environment variables that persist in the container. CMD and RUN are not for variable definition.

Answer

RUN

Answer

ENV

Answer

CMD

Question 7

A Kubernetes pod needs to read configuration data such as database hostname, which is non-sensitive and may change across environments. Which resource should be used to store this data and inject it into the pod?

Accepted Answer

ConfigMap. ConfigMap stores non-sensitive configuration data. Secret stores sensitive data. Deployment and Service are for workload and networking.

Answer

Deployment

Answer

Secret

Answer

Service

Question 8

A developer needs to apply a Kubernetes deployment manifest from a file named 'deployment.yaml'. Which kubectl command should be used?

Accepted Answer

kubectl apply -f deployment.yaml. kubectl apply -f creates or updates resources from a file. get, describe, and create are not used for applying manifests.

Answer

kubectl create deployment.yaml

Answer

kubectl describe -f deployment.yaml

Answer

kubectl get -f deployment.yaml

Question 9

In a Docker bridge network, two containers can communicate with each other using which identifier by default?

Accepted Answer

Their IP addresses only. On the default Docker bridge network, DNS resolution for container names is not provided. Therefore, containers can only communicate using IP addresses by default. User-defined bridge networks enable name resolution.

Answer

Their image names

Answer

Their container names

Answer

Their MAC addresses

Question 10

A developer needs to view the logs of a running Docker container with ID 'abc123'. Which command should be used?

Accepted Answer

docker logs -f abc123. docker logs -f follows the log output. docker exec runs a command inside container, docker attach attaches to a running container's I/O, docker inspect shows detailed info.

Answer

docker inspect abc123

Answer

docker exec -it abc123 logs

Answer

docker attach abc123

Question 11

A Kubernetes Deployment is configured with rolling update strategy. A new version of the image is pushed, and the deployment is updated. During the rollout, the new pods are failing health checks. Which command can be used to pause the rollout and prevent further updates?

Accepted Answer

kubectl rollout pause deployment/myapp. kubectl rollout pause suspends the rollout. kubectl rollout undo rolls back to previous revision. kubectl rollout status shows status, and kubectl delete does not pause rollout.

Answer

kubectl rollout undo deployment/myapp

Answer

kubectl delete deployment/myapp

Answer

kubectl rollout status deployment/myapp

Question 12

A CI/CD pipeline using GitHub Actions needs to build a Docker image and push it to Docker Hub. Which event trigger should be used to run the workflow only when code is pushed to the main branch?

Accepted Answer

on: push: branches: [ main ]. The 'push' event with branch filter triggers on pushes to main. 'pull_request' triggers on PRs, 'release' on releases, 'workflow_dispatch' manual trigger.

Answer

on: workflow_dispatch

Answer

on: release: types: [ published ]

Answer

on: pull_request: branches: [ main ]

Question 13

A developer is implementing secure coding practices to prevent SQL injection. Which approach is most effective when building a SQL query with user input?

Accepted Answer

Using parameterized queries with prepared statements. Parameterized queries separate SQL code from data, preventing injection. Input validation helps but not sufficient alone. Stored procedures can help but parameterized queries are standard. Escaping is error-prone.

Answer

Validating user input to allow only alphanumeric characters

Answer

Storing user input in a database before using it in a query

Answer

Escaping all user input with a function like mysqli_real_escape_string

Question 14

In a Docker Compose file with multiple services, one service depends on another to be healthy before starting. Which key should be used to express this dependency and ensure the dependent service is started first?

Accepted Answer

depends_on. depends_on in Docker Compose controls startup order. 'links' is legacy, 'networks' defines networks, 'volumes' mounts volumes.

Answer

volumes

Answer

networks

Answer

links

Question 15

A Kubernetes pod needs to run a database that requires persistent storage. Which volume type should be used to store data that persists beyond the pod lifecycle?

Accepted Answer

PersistentVolumeClaim. PersistentVolumeClaim requests persistent storage that survives pod restarts. emptyDir is ephemeral, hostPath ties to a node, configMap is for configuration.

Answer

emptyDir

Answer

configMap

Answer

hostPath

Question 16

Which TWO actions are best practices for managing secrets in a CI/CD pipeline?

Accepted Answer

Store secrets as environment variables from a .env file not committed to version control. Environment variables from .env files not committed, and using a secret vault (like HashiCorp Vault) are recommended. Hardcoding in code, storing in config files in git, and using long-lived passwords are insecure.

Answer

Use long-lived static passwords for service accounts

Answer

Hardcode secrets directly in application code for ease of access

Answer

Store secrets in a configuration file stored in the git repository

Question 17

Which TWO Docker network drivers allow a container to communicate with the host's network stack directly?

Accepted Answer

host. Host mode shares the host's network stack directly with the container, allowing it to use the host's IP and ports. Macvlan assigns a MAC address to the container, making it appear as a separate device on the host's network, thus enabling direct communication with the host's network stack. Overlay is for multi-host communication, bridge provides isolation, and none disables networking.

Answer

bridge

Answer

none

Answer

overlay

Question 18

Which THREE options are valid methods to expose a Kubernetes service to external traffic?

Accepted Answer

NodePort. NodePort exposes on each node's IP, LoadBalancer creates external load balancer, Ingress provides HTTP routing. ClusterIP is internal only, ExternalName maps to DNS record.

Answer

ExternalName

Answer

ClusterIP

Question 19

A developer creates a Dockerfile with the following content: FROM python:3.9-slim, COPY app.py /app/, RUN pip install flask, EXPOSE 5000, CMD ["python", "/app/app.py"]. When building the image with 'docker build -t myapp .', what is the purpose of the EXPOSE instruction?

Accepted Answer

It informs Docker that the container listens on port 5000, but the port must be published at runtime.. EXPOSE documents that the container listens on port 5000 at runtime. It does not publish the port; that requires -p flag when running the container.

Answer

It automatically publishes port 5000 to a random host port.

Answer

It installs the Flask framework on port 5000.

Answer

It maps host port 5000 to container port 5000.

Question 20

A CI/CD pipeline for a microservice application includes stages: code commit, build Docker image, push to registry, deploy to staging, run integration tests, and deploy to production. The team wants to ensure that if integration tests fail, the pipeline stops and does not proceed to production. Which CI/CD concept is used to enforce this behavior?

Accepted Answer

Stage gates. Stage gates are conditional checkpoints in a CI/CD pipeline that evaluate predefined criteria before allowing the pipeline to proceed to the next stage. In this scenario, the integration test stage acts as a gate: if the tests fail, the gate blocks the pipeline from advancing to the production deployment stage, ensuring only validated code reaches production.

Answer

Rolling update

Answer

Container orchestration

Answer

Artifact management