200-901 Application Deployment and Security Practice Test 2 — 15 Questions

Question 1

Which TWO actions are best practices for managing secrets in a CI/CD pipeline?

Accepted Answer

Store secrets as environment variables from a .env file not committed to version control. Environment variables from .env files not committed, and using a secret vault (like HashiCorp Vault) are recommended. Hardcoding in code, storing in config files in git, and using long-lived passwords are insecure.

Answer

Use long-lived static passwords for service accounts

Answer

Hardcode secrets directly in application code for ease of access

Answer

Store secrets in a configuration file stored in the git repository

Question 2

Which TWO Docker network drivers allow a container to communicate with the host's network stack directly?

Accepted Answer

host. Host mode shares the host's network stack directly with the container, allowing it to use the host's IP and ports. Macvlan assigns a MAC address to the container, making it appear as a separate device on the host's network, thus enabling direct communication with the host's network stack. Overlay is for multi-host communication, bridge provides isolation, and none disables networking.

Answer

bridge

Answer

none

Answer

overlay

Question 3

Which THREE options are valid methods to expose a Kubernetes service to external traffic?

Accepted Answer

NodePort. NodePort exposes on each node's IP, LoadBalancer creates external load balancer, Ingress provides HTTP routing. ClusterIP is internal only, ExternalName maps to DNS record.

Answer

ExternalName

Answer

ClusterIP

Question 4

A developer creates a Dockerfile with the following content: FROM python:3.9-slim, COPY app.py /app/, RUN pip install flask, EXPOSE 5000, CMD ["python", "/app/app.py"]. When building the image with 'docker build -t myapp .', what is the purpose of the EXPOSE instruction?

Accepted Answer

It informs Docker that the container listens on port 5000, but the port must be published at runtime.. EXPOSE documents that the container listens on port 5000 at runtime. It does not publish the port; that requires -p flag when running the container.

Answer

It automatically publishes port 5000 to a random host port.

Answer

It installs the Flask framework on port 5000.

Answer

It maps host port 5000 to container port 5000.

Question 5

A CI/CD pipeline for a microservice application includes stages: code commit, build Docker image, push to registry, deploy to staging, run integration tests, and deploy to production. The team wants to ensure that if integration tests fail, the pipeline stops and does not proceed to production. Which CI/CD concept is used to enforce this behavior?

Accepted Answer

Stage gates. Stage gates are conditional checkpoints in a CI/CD pipeline that evaluate predefined criteria before allowing the pipeline to proceed to the next stage. In this scenario, the integration test stage acts as a gate: if the tests fail, the gate blocks the pipeline from advancing to the production deployment stage, ensuring only validated code reaches production.

Answer

Rolling update

Answer

Container orchestration

Answer

Artifact management

Question 6

In a Kubernetes deployment, a developer needs to expose a set of pods internally within the cluster on a stable IP address. The pods are stateless and serve HTTP traffic. Which Service type should be used?

Accepted Answer

ClusterIP. ClusterIP exposes the service on a cluster-internal IP, making it reachable only within the cluster. NodePort and LoadBalancer expose externally. ExternalName maps to an external DNS name.

Answer

LoadBalancer

Answer

ExternalName

Answer

NodePort

Question 7

A developer runs the command: docker run -d -p 8080:80 --name web nginx. Which of the following best describes what happens?

Accepted Answer

The container runs in detached mode, and host port 8080 is mapped to container port 80.. -d runs container detached, -p maps host port 8080 to container port 80, --name assigns name 'web', and nginx is the image.

Answer

The container runs in interactive mode, and port 8080 is exposed but not published.

Answer

The container is removed after stopping, and port mapping is automatic.

Answer

The container runs in the foreground, and port 80 on the host is mapped to port 8080 in the container.

Question 8

A team uses GitHub Actions for CI/CD. Their workflow includes a job that builds a Docker image and pushes it to a private registry. The job needs to authenticate to the registry using secrets stored in GitHub. Which approach is most secure for passing credentials?

Accepted Answer

Use GitHub Secrets and reference them with ${{ secrets.REGISTRY_PASSWORD }}.. GitHub Secrets allow storing sensitive data encrypted. In the workflow, secrets are accessed via ${{ secrets.REGISTRY_PASSWORD }}. This avoids hardcoding credentials.

Answer

Embed the password directly in the workflow YAML file.

Answer

Store the password in a plain text file in the repository and read it during the build.

Answer

Use environment variables set in the runner's local .env file.

Question 9

A developer writes a web application that accepts user input and displays it on a page. To prevent cross-site scripting (XSS), what is the most effective defense?

Accepted Answer

Implement output encoding when rendering user input in HTML.. Output encoding converts special characters (e.g., < >) to HTML entities, so the browser does not interpret them as code. Input validation alone is insufficient for XSS.

Answer

Use parameterized queries for all database access.

Answer

Store user input in a secure cookie.

Answer

Disable JavaScript in the browser.

Question 10

In a Docker Compose file, a service 'web' depends on 'db'. The 'db' service uses a volume to persist data. Which compose key ensures that the database starts before the web service?

Accepted Answer

depends_on. depends_on creates a startup order: Docker Compose starts 'db' before 'web'. It does not wait for 'db' to be ready; that requires healthchecks.

Answer

volumes

Answer

links

Answer

networks

Question 11

A Kubernetes Deployment has replicas: 3. The team updates the container image to a new version. The rollout gets stuck because the new pod fails readiness probes. Which kubectl command will display the rollout status and help diagnose the issue?

Accepted Answer

kubectl rollout status deployment/my-deployment. kubectl rollout status deployment/my-deployment shows the progress. If stuck, it indicates failure. kubectl describe pod can show probe details.

Answer

kubectl get pods -l app=my-deployment

Answer

kubectl logs deployment/my-deployment

Answer

kubectl describe deployment my-deployment

Question 12

A developer needs to share a Docker image with a colleague. They decide to push the image to a registry. Which Docker command pushes an image to a registry?

Accepted Answer

docker push my-image:latest. docker push uploads a local image to a registry. docker pull downloads. docker push requires the image to be tagged with the registry URL.

Answer

docker export my-image:latest

Answer

docker commit my-image:latest

Answer

docker pull my-image:latest

Question 13

A Kubernetes environment has multiple teams sharing the same cluster. One team wants to deploy applications without interfering with other teams' resources. Which Kubernetes resource should be used to isolate the team's resources?

Accepted Answer

Namespace. Namespaces provide logical isolation within a cluster. Each team can have its own namespace with separate policies and resource quotas.

Answer

ServiceAccount

Answer

NodePort

Answer

ConfigMap

Question 14

A developer has a Docker container running a database. They need to inspect the database logs to debug a connection issue. Which command will show the logs in real-time?

Accepted Answer

docker logs -f my-db. The `docker logs -f` command attaches to the container's stdout/stderr streams and follows new output in real-time, which is exactly what is needed to debug a live connection issue. The `-f` flag (short for `--follow`) continuously prints log lines as they are written, allowing the developer to observe database connection attempts and errors as they occur.

Answer

docker exec my-db tail -f /var/log/mysql

Answer

docker logs --tail 100 my-db

Answer

docker logs my-db

Question 15

A CI/CD pipeline for a Python project should run unit tests and check for known vulnerabilities in dependencies. Which tool can be integrated into the pipeline to perform dependency scanning?

Accepted Answer

Snyk. Snyk is a popular dependency scanning tool that integrates with CI/CD pipelines. pip audit and npm audit are similar but for specific ecosystems. Snyk supports multiple languages.

Answer

Docker

Answer

Kubernetes

Answer

Jenkins