200-901 Application Deployment and Security Practice Test 10 — 15 Questions

Question 1

A developer is writing a Python application that interacts with a REST API. The API requires authentication using an API key. The developer wants to avoid hardcoding the API key in the source code. Which approach should be used to securely provide the API key to the application?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use environment variables to pass the API key at runtime.. Using environment variables keeps the API key out of source code and version control, allowing it to be injected securely at runtime. This practice supports separation of configuration from code and is recommended for secrets management. Hardcoding, committing to Git, or using public storage all risk exposing the key.

Answer

Embed the API key directly in the source code as a constant.

Answer

Store the API key in a configuration file that is committed to the Git repository.

Answer

Store the API key in a public cloud storage bucket and retrieve it at runtime.

Question 2

A security engineer is configuring a CI/CD pipeline that builds container images. The pipeline must fail the build if the image contains a package with a known critical vulnerability. The scanner runs as a separate step after the image is built. Which approach correctly integrates vulnerability scanning into the pipeline?

Accepted Answer

Configure the scanner step to exit with a non-zero status when a critical vulnerability is detected, so the pipeline stage fails.. To enforce a security gate, the scanner must cause the pipeline to fail when it finds a critical vulnerability. A non-zero exit code from the scanner step is the standard mechanism CI/CD systems use to stop the pipeline. Notification-only or source-only approaches do not block deployment of the vulnerable image, so they do not satisfy the requirement.

Answer

Run the scanner with a flag that only prints findings to the log, then rely on the developer to review the log before merging.

Answer

Add the scanner as a post-build notification that sends an email to the security team, then allow the pipeline to continue to deployment.

Answer

Run the scanner before the image is built, scanning only the source code repository for vulnerable dependencies.

Question 3

An application running on a Cisco IOS XE device must call an external REST API that uses a self-signed certificate. The developer's Python script using the requests library fails with an SSL verification error. The security team requires that the script still validates the server identity. Which approach satisfies the requirement?

Accepted Answer

Provide the path to the server's CA certificate through the verify parameter. A self-signed certificate is not chained to a public root authority, so the default trust store cannot validate it. Supplying that certificate, or the CA that issued it, to the verify parameter gives the client an explicit trust anchor while keeping hostname and chain validation active. Disabling verification or stripping the trust store would silence the error at the cost of the identity assurance the security team requires.

Answer

Downgrade the request to plain HTTP on port 80 so TLS is not involved

Answer

Pass verify=False to the requests call to skip certificate validation

Answer

Set the REQUESTS_CA_BUNDLE environment variable to an empty string before running the script

Question 4

A developer is configuring a GitHub Actions workflow that must authenticate to AWS to push an image to Amazon ECR. The security team prohibits long-lived AWS access keys in repository secrets. Which authentication method should the workflow use?

Accepted Answer

Configure an OpenID Connect (OIDC) identity provider in AWS IAM and assume a role using the workflow's OIDC token.. OIDC federation lets GitHub Actions exchange a short-lived identity token for temporary AWS credentials through a trusted IAM role. This removes long-lived access keys entirely, which is the only option consistent with the security team's prohibition. Storing static keys in secrets, passing them to actions, or embedding them in images all retain long-lived credentials and expand the attack surface.

Answer

Embed the AWS credentials in the Docker image at build time using build arguments and read them at runtime.

Answer

Use the `aws-actions/configure-aws-credentials` action with `aws-access-key-id` and `aws-secret-access-key` inputs populated from repository secrets.

Answer

Store the AWS secret access key in an encrypted repository secret and reference it in the workflow.

Question 5

A security review of a containerized application finds that the running process has far more privileges than it needs. Which TWO changes reduce the attack surface of the container at runtime? (Choose two.)

Accepted Answer

Run the application process as a non-root user inside the container.. Least privilege for containers is enforced along two axes: the identity the process runs under and the kernel capabilities it retains. Running as a non-root user removes root-owned access inside the container, while dropping unneeded capabilities prevents privileged kernel operations even if the process is compromised. Options that grant daemon access, full privileges, or broader network exposure all move in the opposite direction.

Answer

Add the --privileged flag so the container can access all devices directly.

Answer

Publish the container's port to the host with the -p 0.0.0.0:8080:8080 mapping.

Answer

Mount the host's Docker socket into the container so it can manage sibling containers.

Question 6

A DevOps engineer is deploying a containerized application to a Kubernetes cluster. The application needs to read a database password at runtime, and the team wants the value to be injected as an environment variable without storing it in the container image or the Deployment manifest. Which Kubernetes resource should be used?

Accepted Answer

A Secret referenced by the container's envFrom or valueFrom field.. Kubernetes Secrets are designed to hold sensitive data and can be consumed as environment variables through envFrom or valueFrom, which keeps the password out of the image and the Deployment manifest. ConfigMaps, volumes, and initContainers do not provide the same separation of sensitive data from application artifacts, so they fail the scenario's security and injection requirements.

Answer

An initContainer that writes the password into the main container's filesystem.

Answer

A ConfigMap mounted as a volume and read by the application at startup.

Answer

A PersistentVolumeClaim that stores the password in a file on shared storage.

Question 7

A company is deploying a containerized application to a Kubernetes cluster. The security team requires that the container runs as a non-root user and that the root filesystem is read-only. Which Kubernetes security context settings should be applied to the pod specification to meet these requirements?

Accepted Answer

securityContext: { runAsNonRoot: true, readOnlyRootFilesystem: true }. To enforce that a container runs as a non-root user, the securityContext must include runAsNonRoot: true. To make the root filesystem read-only, readOnlyRootFilesystem: true must be set. These can be combined in a single securityContext block. Other settings like allowPrivilegeEscalation or privileged do not guarantee non-root execution, so they are not sufficient.

Answer

securityContext: { runAsUser: 0, readOnlyRootFilesystem: true }

Answer

securityContext: { privileged: false, readOnlyRootFilesystem: true }

Answer

securityContext: { allowPrivilegeEscalation: false, readOnlyRootFilesystem: true }

Question 8

A developer needs a repeatable, isolated environment that contains Python 3.11, a specific set of pip packages, and the team's application code, so that every engineer and the CI runner execute identical builds. Which artifact should the developer create to meet this requirement?

Accepted Answer

A Dockerfile that specifies the base image, installs the packages, and copies the application code.. A Dockerfile is the declarative recipe that pins the base image, dependency installation, and application code, producing a portable image with consistent behaviour on developer machines and CI runners. Dependency lists and Compose files address parts of the problem but not the full environment definition, and exported VM images are neither lightweight nor reliably reproducible.

Answer

A virtual machine image exported from one engineer's laptop.

Answer

A docker-compose.yml file that runs a single service with the application image.

Answer

A requirements.txt file listing the pip packages.

Question 9

A platform team is hardening a containerized application before production. They want to reduce the attack surface of the running containers themselves. Which two practices directly reduce the privileges available to a compromised container process? (Choose two.)

Accepted Answer

Run the container process as a non-root user via the USER instruction or --user flag. Privilege reduction focuses on what the process is allowed to do at runtime. Running as a non-root user removes the broad powers of uid 0, and dropping Linux capabilities strips specific kernel-level abilities even from processes that retain elevated identity. Read-only filesystems, smaller images, and health checks improve other properties such as immutability, vulnerability count, and availability, but none of them lower the privilege ceiling of a compromised process.

Answer

Set the read-only flag on the container filesystem with --read-only

Answer

Add a HEALTHCHECK instruction to the Dockerfile so the orchestrator can restart unhealthy containers

Answer

Use a smaller base image such as alpine to reduce the image size

Question 10

A developer maintains a Python library that is published to a package index and consumed by other teams. The build pipeline should ensure that a compromised maintainer account cannot publish a malicious version under the project's name. Which control should be configured on the pipeline?

Accepted Answer

Sign release artifacts with a key held in the CI system's trusted identity and have consumers verify the signature.. Preventing a compromised account from publishing malicious code requires a control that does not depend solely on that account's credentials. Artifact signing with a key controlled by the trusted pipeline ties each release to a verifiable identity, and consumers who check the signature will reject anything not signed by that key. Account hardening, dependency pinning, and source analysis improve security elsewhere but cannot stop an authorized-but-malicious publish.

Answer

Pin dependency versions in requirements.txt so downstream installs are reproducible.

Answer

Enable two-factor authentication on the publishing account and use API tokens scoped to the project.

Answer

Run a linter and static analysis over the source before each publish step.

Question 11

A developer is writing a Python application that interacts with a REST API. The API requires authentication using an API key. The developer wants to avoid hardcoding the API key in the source code. Which approach should be used to securely provide the API key to the application?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Read the token from an environment variable that is injected by the deployment platform at runtime.. The token must be provided at runtime and kept out of source control. Environment variables are a standard way to inject secrets into a running application without embedding them in code or configuration files committed to the repository. The other options either commit the secret to the repository or ship it inside the application artifact, both of which expose the token.

Answer

Hardcode the token in a configuration file that is committed to the repository so the application can read it on startup.

Answer

Store the token in a comment at the top of the main application file so it is easy for the developer to find.

Answer

Embed the token in the application's compiled bytecode so it is not visible in the plain source files.

Question 12

A team is hardening a Kubernetes deployment that exposes a web API. They want to reduce the impact of a container compromise and enforce network segmentation. Which TWO configurations should they apply? (Choose two.)

Accepted Answer

Define a NetworkPolicy that allows ingress only from the required client pods and denies all other traffic.. Reducing the impact of a compromise requires limiting the container's privileges and its ability to communicate laterally. Running as a non-root user removes a key privilege, while a default-deny NetworkPolicy with explicit allows enforces segmentation. Image pull policy, external exposure, and resource limits address other concerns and do not satisfy the stated security objectives.

Answer

Expose the API through a Service of type `LoadBalancer` for external access.

Answer

Set `imagePullPolicy: Always` on the container so the newest image is always used.

Answer

Add resource requests and limits for CPU and memory to the container.

Question 13

A developer is reviewing a CI/CD pipeline that builds a Python application and pushes a Docker image to a registry. The pipeline currently runs as a single stage that installs dependencies, runs tests, and pushes the image. The team wants to ensure that the image is not pushed if any test fails. Which change should be made to the pipeline?

Accepted Answer

Split the pipeline into separate build, test, and push stages, and configure the push stage to run only if the test stage succeeds.. A quality gate is enforced by ordering pipeline stages and making the push conditional on test success. Splitting the pipeline into build, test, and push stages with a dependency between test and push ensures that a failed test stops the pipeline before the image is published. Retries, early pushes, or registry-side checks do not provide the same guarantee.

Answer

Add a retry loop around the test command so transient failures do not stop the pipeline.

Answer

Move the image push to the beginning of the pipeline so the registry is updated as early as possible.

Answer

Configure the registry to reject images that do not include a passing test report as a label.

Question 14

A security review of a CI/CD pipeline finds that build jobs run with credentials that have far more privilege than needed, and that the same long-lived token is reused across repositories. Which TWO changes reduce the blast radius if a pipeline credential is compromised? (Choose two.)

Accepted Answer

Grant the pipeline identity the minimum permissions required for its deployment tasks.. Blast radius is governed by how much a credential can do and how long it remains valid. Issuing short-lived, per-job credentials and constraining the pipeline identity to least privilege both directly reduce the impact of theft. Encryption at rest, verbose logging, and runner placement improve hygiene or visibility but leave the credential's power and lifetime intact, so they do not shrink the damage an attacker can inflict.

Answer

Run all pipeline jobs on self-hosted runners located inside the corporate network.

Answer

Store the shared token in the CI platform's encrypted secret store instead of in the repository.

Answer

Enable verbose debug logging for all pipeline jobs so credential usage can be audited after an incident.

Question 15

A developer is writing a Python script that retrieves a device list from a Cisco DNA Center controller. The script must read the controller address and an API token from the environment rather than embedding them in source code. Which practice best supports secure, repeatable execution across developer machines and CI runners?

Accepted Answer

Read the values with os.environ or a library such as python-dotenv that loads a local, git-ignored .env file. Environment-driven configuration separates code from secrets and from environment-specific values. Developers can keep a local file that is excluded from version control, while CI systems inject the same variables from their own protected stores. The script itself remains identical everywhere, and credentials never appear in commits, images, or logs unless explicitly printed. This is the standard twelve-factor approach to configuration.

Answer

Store the values in a public gist and fetch them at runtime over HTTPS

Answer

Hardcode the values in a constants module that is imported by the main script

Answer

Commit a .env file containing the values to the repository so every clone has them