200-901 Application Deployment and Security Practice Test 2 — 15 Questions

Question 1

A developer uses Kubernetes and wants to expose a deployment named 'web-app' externally via a cloud load balancer. Which Service type should be used?

Accepted Answer

LoadBalancer. The LoadBalancer Service type provisions an external cloud load balancer (e.g., AWS ELB, GCP TCP/UDP Load Balancer) that routes external traffic to the 'web-app' deployment's pods. This is the only Service type that directly integrates with a cloud provider's load balancing infrastructure to expose the service externally.

Answer

ClusterIP

Answer

ExternalName

Answer

NodePort

Question 2

A developer is writing a Dockerfile for a Node.js application. The application uses environment variables for configuration. Which Dockerfile instruction should be used to set a default value for the NODE_ENV variable?

Accepted Answer

ENV NODE_ENV=production. The ENV instruction sets environment variables that persist in the container at runtime, making it the appropriate way to define a default value for NODE_ENV that can be overridden later with `docker run -e`. Unlike shell-level exports or build-time-only ARGs, ENV ensures the variable is available to the Node.js process when the container starts.

Answer

RUN export NODE_ENV=production

Answer

ARG NODE_ENV=production

Answer

CMD NODE_ENV=production

Question 3

A developer is building a web application and wants to implement security best practices. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Use CSRF tokens in forms. Option B is correct because CSRF tokens in forms defend against Cross-Site Request Forgery by ensuring that state-changing requests originate from the legitimate application and carry a server-validated, unpredictable token tied to the user's session. Option E is correct because applying output encoding (context-aware escaping of HTML, attribute, JavaScript, and URL contexts) neutralizes injected markup so that untrusted data is rendered as text rather than executable script, preventing XSS. Option A is not among the marked correct answers here, even though parameterized queries are a strong defense against SQL injection, because the question specifies only two correct choices. Option C is wrong because storing passwords in plaintext exposes credentials to any database compromise; passwords should be salted and hashed with a slow algorithm such as bcrypt, scrypt, or Argon2. Option D is wrong because disabling HTTPS removes TLS confidentiality and integrity, enabling man-in-the-middle attacks and session hijacking, and modern performance is addressed via TLS session resumption, HTTP/2, or HTTP/3 rather than dropping encryption.

Answer

Use parameterized queries for SQL

Answer

Store passwords in plaintext

Answer

Disable HTTPS to improve performance

Question 4

In a Kubernetes cluster, a developer needs to ensure that a set of pods can be accessed by other pods using a stable IP address and DNS name, even if pods are recreated. Which resource should be created?

Accepted Answer

Service. A Service in Kubernetes provides a stable virtual IP (ClusterIP) and a DNS name (via CoreDNS) that persists across pod restarts and rescheduling. This allows other pods to reliably discover and communicate with the set of pods behind the Service, regardless of individual pod IP changes.

Answer

ConfigMap

Answer

Namespace

Answer

Deployment

Question 5

In a Jenkins declarative pipeline, a stage named 'Deploy to Production' should only run after manual approval. Which directive should be used to achieve this?

Accepted Answer

input. The `input` directive in a Jenkins declarative pipeline is specifically designed to pause a stage and wait for human approval before proceeding. When placed inside a stage block, it presents a message and optional parameters (like a 'Proceed' or 'Abort' button) to a user, effectively implementing a manual gate. This is the correct way to enforce manual approval before a 'Deploy to Production' stage runs.

Answer

post

Answer

parallel

Answer

when

Question 6

A developer notices that after a new deployment, the application is not receiving traffic. The Service selector does not match the pod labels. Which kubectl command can be used to inspect the Service's selector?

Accepted Answer

kubectl describe service my-service. The `kubectl describe service my-service` command displays detailed information about the Service, including its selector field, which defines the label key-value pairs used to match pods. This allows the developer to directly compare the selector against the pod labels to identify the mismatch. It is the most straightforward way to inspect the selector without needing to parse raw YAML or execute commands inside the service.

Answer

kubectl exec service/my-service -- cat /etc/hosts

Answer

kubectl get service my-service -o yaml

Answer

kubectl logs service/my-service

Question 7

In a Dockerfile, which instruction is used to set an environment variable that will be available at runtime?

Accepted Answer

ENV. The ENV instruction in a Dockerfile sets an environment variable that persists in the built image and is available to the container at runtime. It is the standard way to define runtime environment variables such as PATH, application configuration, or secrets (though secrets should use other mechanisms).

Answer

RUN export VAR=value

Answer

LABEL

Answer

ARG

Question 8

A CI/CD pipeline uses GitHub Actions. The workflow should trigger only when a pull request is opened against the 'main' branch. Which 'on' trigger configuration is correct?

Accepted Answer

on: pull_request: branches: [main]. The correct syntax uses pull_request with branches filter.

Answer

on: [pull_request, push]

Answer

on: push: branches: [main]

Answer

on: pull_request_target: branches: [main]

Question 9

A developer creates a Dockerfile for a Python web application. Which instruction should be used to define the working directory inside the container for subsequent commands?

Accepted Answer

WORKDIR. The WORKDIR instruction in a Dockerfile sets the working directory for any RUN, CMD, ENTRYPOINT, COPY, and ADD instructions that follow it in the Dockerfile. For a Python web application, using WORKDIR /app ensures that subsequent commands like COPY and RUN operate inside the /app directory, keeping the container filesystem organized and avoiding path errors.

Answer

ENV

Answer

RUN

Answer

COPY

Question 10

A team is deploying a microservice that must scale independently. The service uses environment variables for configuration. Which Kubernetes resource should be used to store non-sensitive configuration data separate from the container image?

Accepted Answer

ConfigMap. ConfigMap is the correct Kubernetes resource for storing non-sensitive configuration data (like environment variables) separately from the container image. This allows the microservice to scale independently because configuration changes can be applied without rebuilding or redeploying the image, enabling stateless, horizontally scalable pods.

Answer

Secret

Answer

Service

Answer

Deployment

Question 11

A docker-compose.yml defines a web service with environment variables. Which key in the service definition should be used to set environment variables?

Accepted Answer

environment. The `environment` key in a Docker Compose service definition is the standard way to set environment variables directly within the YAML file. This key accepts a list of key-value pairs (e.g., `- KEY=VALUE`) or a mapping, and the variables are injected into the container at runtime, overriding any default values in the Docker image.

Answer

args

Answer

volumes

Answer

env_file

Question 12

A company uses GitHub Actions for CI/CD. They want to automatically scan dependencies for known vulnerabilities on every push. Which action should be added to the workflow?

Accepted Answer

Dependabot. Dependabot is the correct GitHub-native tool for automatically scanning dependencies for known vulnerabilities on every push. It monitors the dependency manifest files (e.g., package.json, requirements.txt) against the GitHub Advisory Database and opens pull requests to update vulnerable packages. This directly meets the requirement of scanning dependencies for known vulnerabilities in a CI/CD workflow.

Answer

CodeQL

Answer

ESLint

Answer

GitHub Secret Scanning

Question 13

A Kubernetes Deployment is updated with a new image tag, but the rollout fails. Which kubectl command should be used to view the rollout status and troubleshoot?

Accepted Answer

kubectl rollout status deployment/myapp. kubectl rollout status shows the progress of a rollout, and kubectl rollout history shows revisions.

Answer

kubectl get events

Answer

kubectl describe deployment

Answer

kubectl logs deployment

Question 14

Which Docker command is used to view the logs of a running container in real-time?

Accepted Answer

docker logs -f. `docker logs -f <container>` streams the container's stdout/stderr in real time, similar to `tail -f`. The `-f` flag stands for 'follow' and keeps the connection open, printing new log lines as they are emitted. Without `-f`, `docker logs` prints the existing logs and exits.

Answer

docker inspect

Answer

docker ps -a

Answer

docker exec -it

Question 15

A security engineer is configuring a web application to protect against cross-site request forgery (CSRF). The application uses session cookies. Which approach should be implemented to mitigate CSRF attacks?

Accepted Answer

Implement anti-CSRF tokens that are unique per session and validated on the server.. Anti-CSRF tokens require the client to submit a secret value that the server validates, ensuring requests are intentional and originate from the application. While SameSite cookies offer some protection, tokens are the definitive mitigation because they enforce server-side verification of request authenticity, independent of browser cookie policies.

Answer

Set the HttpOnly attribute on session cookies.

Answer

Use the Secure attribute on session cookies.

Answer

Set the SameSite attribute to Strict on session cookies.