200-901 Application Deployment and Security Practice Test 3 — 15 Questions

Question 1

A developer is deploying a containerized application with Docker Compose. The application requires environment variables for database credentials that should not be hardcoded in the docker-compose.yml file. Which two methods securely provide these credentials? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an .env file and add it to .gitignore, then reference it with env_file in the service.. Using an `.env` file allows you to externalize sensitive environment variables (like database credentials) from the `docker-compose.yml` file. By adding the `.env` file to `.gitignore`, you prevent it from being committed to version control, thus keeping credentials secure. The `env_file` directive in the service definition loads these variables at runtime without exposing them in the compose file.

Answer

Use a public registry to store the credentials.

Answer

Hardcode the credentials in the docker-compose.yml under environment.

Answer

Store the credentials in the Docker image during build.

Question 2

A Kubernetes cluster has a deployment named 'frontend' that needs to be updated to a new image version. The update should be performed with zero downtime. Which three kubectl commands or approaches can achieve this? (Choose three.)

Accepted Answer

kubectl set image deployment/frontend frontend=myimage:v2. Rolling updates can be done by editing the deployment, applying a new YAML, or using set image. kubectl edit deployment updates the live config. kubectl apply -f update.yaml applies a new manifest. kubectl set image updates the image directly. kubectl delete and create would cause downtime.

Answer

kubectl delete deployment frontend and then create a new deployment.

Answer

kubectl rollout undo deployment/frontend

Question 3

A developer is writing a CI/CD pipeline using Jenkins Declarative Pipeline. They want to ensure that sensitive credentials (e.g., API keys) are never exposed in console logs. Which two security practices should be implemented? (Choose two.)

Accepted Answer

Store the API key in a Jenkins 'Secret text' credential and use the withCredentials step in the pipeline.. Jenkins' `withCredentials` step securely binds a 'Secret text' credential to a variable, masking the value in console logs and preventing exposure. This is the standard practice for handling sensitive data in Declarative Pipeline, as it integrates with Jenkins' credential store and automatically redacts the secret from output.

Answer

Hardcode the API key in the Jenkinsfile and use the sh step to echo it.

Answer

Pass the API key as a command-line argument to the build script.

Answer

Print the API key to the console for debugging.

Question 4

You are writing a Dockerfile. Which instruction should you use to set the working directory for subsequent RUN, CMD, ENTRYPOINT, COPY, and ADD instructions?

Accepted Answer

WORKDIR /app. The WORKDIR instruction in a Dockerfile sets the working directory for any subsequent RUN, CMD, ENTRYPOINT, COPY, and ADD instructions. This ensures that commands execute from that directory and that COPY/ADD paths are resolved relative to it. Option A is correct because WORKDIR is the only Dockerfile instruction designed specifically for this purpose.

Answer

RUN cd /app

Answer

ENV WORKDIR=/app

Question 5

A developer runs 'docker run -d -p 8080:80 --name web nginx:alpine'. The container fails to start. Which command is the most appropriate to investigate the issue?

Accepted Answer

docker logs -f web. `docker logs -f web` streams the container's stdout and stderr output, which typically contains the error message explaining why the container failed to start (e.g., port conflict, missing configuration, or process crash). Since the container is not running, `docker logs` is the primary diagnostic tool to retrieve its exit logs without requiring the container to be active.

Answer

docker inspect web

Answer

docker exec -it web bash

Question 6

In a Kubernetes cluster, you need to expose a set of pods running a web application to external traffic on a specific port. Which Service type should you use to provide a stable external IP address?

Accepted Answer

LoadBalancer. LoadBalancer provisions a cloud load balancer and assigns a stable external IP, making the service accessible from outside the cluster.

Answer

ClusterIP

Answer

NodePort

Question 7

A CI/CD pipeline includes stages for code commit, build, unit test, integration test, staging deploy, and production deploy. Which change would best prevent a faulty build from reaching production?

Accepted Answer

Add a manual approval gate before production deploy.. Adding a manual approval gate before the production deploy stage allows a human to verify the build and prevent faulty code from being deployed.

Answer

Remove the integration test stage to speed up the pipeline.

Answer

Use the same environment for testing and production.

Question 8

You are writing a Dockerfile for a Python application. Which instruction should you use to install the dependencies from a requirements.txt file?

Accepted Answer

RUN pip install -r requirements.txt. The RUN instruction executes commands in a new layer on top of the current image and commits the results. Using RUN pip install -r requirements.txt ensures that the Python dependencies are installed during the image build process, making them part of the final image. This is the correct approach because dependencies should be installed at build time, not at container runtime.

Answer

ENTRYPOINT pip install -r requirements.txt

Answer

CMD pip install -r requirements.txt

Question 9

A developer needs to share a Docker image built from a Dockerfile with team members. Which command correctly builds the image and tags it as 'myapp:v1'?

Accepted Answer

docker build --tag myapp:v1 .. Both the `--tag` flag and the `-t` shorthand are valid options for tagging a Docker image during build. `docker build --tag myapp:v1 .` and `docker build -t myapp:v1 .` are equivalent commands that build the image from the current directory and tag it as myapp:v1.

Answer

docker build . --name myapp:v1

Question 10

A Kubernetes Deployment manages a set of identical pods. You update the container image to a new version. The rollout gets stuck. Which kubectl command should you use to view the rollout status and determine the cause?

Accepted Answer

kubectl rollout status deployment/my-deployment. The `kubectl rollout status deployment/my-deployment` command is specifically designed to track the progress of a rollout and report its current state, including whether it is stuck or progressing. It provides real-time status updates and can surface underlying issues like image pull errors or resource constraints that cause the rollout to hang, making it the correct tool for diagnosing a stuck rollout.

Answer

kubectl get pods

Answer

kubectl describe deployment my-deployment

Question 11

In a Docker Compose file, you want to ensure that the 'web' service starts only after the 'db' service is healthy. Which key should you use under the 'web' service?

Accepted Answer

depends_on. In Docker Compose, the `depends_on` key with the `condition: service_healthy` option ensures that the `web` service starts only after the `db` service has passed its health check. This is defined in the `db` service using a `healthcheck` directive, and Compose waits for the healthy state before starting dependent services.

Answer

networks

Answer

links

Question 12

A developer wants to run a container in the background with port mapping and a named volume. Which command accomplishes this?

Accepted Answer

docker run -d -p 8080:80 -v myvol:/data --name myapp nginx. Options A and C are both correct. Option A uses the `-v` flag to mount a named volume, which is a shorthand for volume mounting. Option C uses the `--mount` flag; when `type=volume` is omitted, it defaults to a volume mount, so `--mount source=myvol,target=/data` is equivalent to `-v myvol:/data`. Both commands create a new container in detached mode (`-d`), map port 8080 on the host to port 80 in the container (`-p 8080:80`), mount the named volume `myvol` to `/data`, and name the container `myapp`. Option B is incorrect because `docker start` only starts an existing container and cannot create a new one or specify port mapping or volumes.

Answer

docker start -d -p 8080:80 -v myvol:/data --name myapp nginx

Question 13

A web application is vulnerable to SQL injection. Which secure coding practice should the developer implement in the code to prevent this?

Accepted Answer

Use parameterised queries for database access.. Using parameterised queries (prepared statements) ensures that user input is treated as data, not executable SQL code, preventing SQL injection.

Answer

Escape all user input with htmlspecialchars.

Answer

Use a CAPTCHA on the login form.

Question 14

In a Kubernetes cluster, you need to store non-sensitive configuration data (e.g., database hostname) that can be consumed by pods as environment variables. Which resource should you use?

Accepted Answer

ConfigMap. A ConfigMap is the correct Kubernetes resource for storing non-sensitive configuration data like a database hostname. It is designed to decouple configuration artifacts from image content, allowing pods to consume this data as environment variables or mounted files without hardcoding values into container images.

Answer

PersistentVolume

Answer

Secret

Question 15

A developer needs to ensure that environment variables containing database credentials are not hardcoded in the application code. Which approach is most secure for managing secrets in a CI/CD pipeline?

Accepted Answer

Use a secrets management tool like Vault to inject secrets during deployment.. Secrets management tools like HashiCorp Vault provide a centralized, encrypted store for sensitive data such as database credentials, and they inject secrets into the CI/CD pipeline at deployment time via secure APIs (e.g., Vault's HTTP API with TLS). This approach avoids storing secrets in version control, eliminates hardcoding, and supports dynamic secrets, rotation, and audit logging, which aligns with security best practices for CI/CD.

Answer

Encrypt the .env file and commit it.

Answer

Store the credentials in a .env file committed to the repository.