200-901 Application Deployment and Security Practice Test 4 — 15 Questions

Question 1

Which TWO commands are used to view information about Docker containers? (Select two.)

Accepted Answer

docker logs -f. docker ps -a lists all containers (including stopped), and docker logs -f shows logs of a container.

Answer

docker build

Answer

docker images

Answer

docker volume ls

Question 2

Which THREE are valid Kubernetes Service types? (Select three.)

Accepted Answer

NodePort. A is correct because NodePort is a standard Kubernetes Service type that exposes a service on a static port (30000-32767) on each node's IP address, allowing external traffic to reach the service by targeting :. It builds on top of ClusterIP and is commonly used for development or direct access scenarios.

Answer

Deployment

Answer

Ingress

Question 3

Which TWO practices help prevent sensitive data exposure in a CI/CD pipeline? (Select two.)

Accepted Answer

Run dependency scanning tools (e.g., Snyk) in the pipeline.. Using environment variables for secrets (not hardcoding) and scanning dependencies for vulnerabilities help prevent exposure.

Answer

Hardcode credentials in the source code for simplicity.

Answer

Commit .env files to the repository with dummy values.

Answer

Disable HTTPS to avoid certificate management overhead.

Question 4

A developer is creating a Dockerfile for a Python Flask application. The application runs on port 5000. Which directive should be used to document that the container listens on this port?

Accepted Answer

EXPOSE 5000. The EXPOSE directive informs Docker that the container listens on specified ports at runtime. It does not actually publish the port but serves as documentation.

Answer

PORT 5000

Answer

PUBLISH 5000

Answer

LISTEN 5000

Question 5

A team uses a Jenkins declarative pipeline to deploy a microservice. The pipeline includes stages: Checkout, Build Docker Image, Run Unit Tests, Push to Registry, Deploy to Staging, and Deploy to Production. Which stage should run immediately after 'Build Docker Image' to ensure code quality before the image is pushed?

Accepted Answer

Run Unit Tests. After building the Docker image, the next logical step is to run unit tests to verify code quality before pushing the image to a registry.

Answer

Deploy to Staging

Answer

Deploy to Production

Answer

Push to Registry

Question 6

A Kubernetes deployment is configured with replicas: 3. During a rolling update, the deployment strategy is set to RollingUpdate with maxSurge: 1 and maxUnavailable: 0. What is the maximum number of pods that will be running during the update?

Accepted Answer

4. With maxSurge=1, one extra pod can be created above the desired 3, and maxUnavailable=0 ensures no pods are taken down before new ones are ready. So the maximum is 4 pods.

Answer

6

Answer

5

Answer

3

Question 7

A developer is writing a web application and needs to prevent SQL injection attacks. Which coding practice is most effective?

Accepted Answer

Use parameterized queries with prepared statements. Parameterized queries separate SQL logic from data, preventing attackers from injecting malicious SQL. Input validation is also important but not a direct prevention of SQL injection.

Answer

Validate input with regex to allow only alphanumeric characters

Answer

Use stored procedures exclusively

Answer

Escape all user input with htmlspecialchars

Question 8

In Docker, which command is used to build an image from a Dockerfile and tag it as 'myapp:v1'?

Accepted Answer

docker build -t myapp:v1 .. The `docker build -t myapp:v1 .` command builds a Docker image from the Dockerfile in the current directory and tags it with the name `myapp` and version tag `v1`. The `-t` flag assigns the tag, and the dot (`.`) specifies the build context (the current directory). This is the standard Docker command for building and tagging images.

Answer

docker run -t myapp:v1 .

Answer

docker create myapp:v1 .

Answer

docker commit myapp:v1 .

Question 9

A DevOps engineer runs a container using 'docker run -d -p 8080:80 nginx'. The host firewall blocks incoming traffic on port 8080 from external networks but allows from the local host. Which command would allow the engineer to test the container's web server from the same machine?

Accepted Answer

curl localhost:8080. Since the host firewall allows local traffic, using curl localhost:8080 will reach the container via the mapped port.

Answer

curl 10.0.0.1:8080

Answer

docker exec -it <container> bash

Answer

docker logs <container>

Question 10

A Kubernetes cluster runs a microservice that needs to read configuration values from a ConfigMap and sensitive database credentials from a Secret. The pod manifest references both resources. How should the Secret be mounted to avoid exposing sensitive data in logs or environment variables?

Accepted Answer

Using a volume mount with a secret volume. Mounting a Secret as a volume stores the data in the tmpfs (RAM-backed filesystem) of the pod, which is not written to disk and is not exposed via environment variables that could be logged or printed by the application. This approach prevents accidental leakage of sensitive data through log outputs or environment variable dumps, as the application must explicitly read the file from the mount point.

Answer

Hardcoding the credentials in the ConfigMap

Answer

Using a sidecar container to fetch secrets via API

Answer

Using envFrom with secretRef

Question 11

In a Docker Compose file, which key is used to define the dependency order between services?

Accepted Answer

depends_on. The depends_on key in Docker Compose allows specifying that one service depends on another, controlling startup order.

Answer

links

Answer

volumes

Answer

networks

Question 12

A developer commits code to a GitHub repository and wants automated tests to run, followed by building a Docker image and pushing it to Docker Hub only if tests pass. Which CI/CD tool can be configured using a YAML file placed in the .github/workflows directory?

Accepted Answer

GitHub Actions. GitHub Actions is the only CI/CD tool among the options that uses a YAML workflow file placed in the `.github/workflows` directory within the repository. This allows developers to define automated triggers (e.g., on push) to run tests, build a Docker image, and push it to Docker Hub only if tests pass, all natively integrated with GitHub.

Answer

Jenkins

Answer

CircleCI

Answer

GitLab CI

Question 13

A developer uses Kubernetes and wants to expose a deployment named 'web-app' externally via a cloud load balancer. Which Service type should be used?

Accepted Answer

LoadBalancer. The LoadBalancer Service type provisions an external cloud load balancer (e.g., AWS ELB, GCP TCP/UDP Load Balancer) that routes external traffic to the 'web-app' deployment's pods. This is the only Service type that directly integrates with a cloud provider's load balancing infrastructure to expose the service externally.

Answer

ClusterIP

Answer

ExternalName

Answer

NodePort

Question 14

A developer is writing a Dockerfile for a Node.js application. The application uses environment variables for configuration. Which Dockerfile instruction should be used to set a default value for the NODE_ENV variable?

Accepted Answer

ENV NODE_ENV=production. The ENV instruction sets environment variables that persist in the container at runtime, making it the appropriate way to define a default value for NODE_ENV that can be overridden later with `docker run -e`. Unlike shell-level exports or build-time-only ARGs, ENV ensures the variable is available to the Node.js process when the container starts.

Answer

RUN export NODE_ENV=production

Answer

ARG NODE_ENV=production

Answer

CMD NODE_ENV=production

Question 15

Which Docker networking mode provides the most isolation by not connecting the container to any network?

Accepted Answer

none. The `none` networking mode in Docker creates a container with no network interfaces except the loopback device, providing the highest level of network isolation. This means the container cannot send or receive any external traffic, making it ideal for security-sensitive workloads that require complete network disconnection.

Answer

overlay

Answer

bridge

Answer

host