200-901 Application Deployment and Security Practice Test 5 — 15 Questions

Question 1

A CI/CD pipeline uses GitLab CI. The pipeline must build a Docker image and then run security scans on the image before pushing. Which GitLab CI keyword allows defining a sequence of jobs that must run in order?

Accepted Answer

stages. The 'stages' keyword defines the order of jobs. Jobs are grouped by stage, and stages run sequentially.

Answer

before_script

Answer

only

Answer

image

Question 2

A developer wants to ensure that a containerized application restarts automatically if it exits with a non-zero code. The application is run using Docker. Which flag should be used?

Accepted Answer

--restart on-failure. The --restart flag with 'on-failure' restarts the container only if it exits with a non-zero code, which indicates an error.

Answer

--restart always

Answer

--restart unless-stopped

Answer

--restart no

Question 3

A Kubernetes pod runs two containers that need to share a filesystem. Which volume type should be used to enable file sharing between the containers within the same pod?

Accepted Answer

emptyDir. An emptyDir volume is created empty when a pod is scheduled and can be mounted by multiple containers in the same pod, allowing them to share files.

Answer

configMap

Answer

hostPath

Answer

persistentVolumeClaim

Question 4

A developer is building a web application and wants to implement security best practices. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Use CSRF tokens in forms. B is correct because CSRF tokens are a standard defense against Cross-Site Request Forgery attacks. By embedding a unique, unpredictable token in each form and validating it on the server, the application ensures that requests originate from the legitimate user session, not from a malicious third-party site. This is a fundamental security best practice for web applications handling state-changing requests.

Answer

Use parameterized queries for SQL

Answer

Store passwords in plaintext

Answer

Disable HTTPS to improve performance

Question 5

A developer is using Docker Compose to run a multi-service application. Which THREE keys are valid top-level keys in a docker-compose.yml file? (Choose three.)

Accepted Answer

volumes. Services, networks, and volumes are top-level keys in Docker Compose. Ports is a key within a service definition, not top-level.

Answer

environment

Answer

ports

Question 6

A Kubernetes administrator wants to use kubectl to troubleshoot a pod named 'my-pod' that is not starting. Which TWO commands are useful? (Choose two.)

Accepted Answer

kubectl describe pod my-pod. kubectl describe pod my-pod shows detailed information including events and container statuses. kubectl logs my-pod shows container logs. The other commands are for different resources or abstract actions.

Answer

kubectl get deployment my-deployment

Answer

kubectl rollout status deployment my-deployment

Answer

kubectl delete pod my-pod

Question 7

A developer wants to create a Docker image that runs a Python application. Which instruction should be placed at the end of the Dockerfile to specify the command that runs when the container starts?

Accepted Answer

CMD. CMD specifies the default command to run when the container starts, and it can be overridden by providing a command at runtime. ENTRYPOINT is similar but not easily overridden. RUN executes during build. COPY copies files during build.

Answer

RUN

Answer

ENTRYPOINT

Answer

COPY

Question 8

A Docker container running a web application needs to be accessible on the host's port 8080. The application inside the container listens on port 80. Which docker run command achieves this?

Accepted Answer

docker run -d -p 8080:80 myapp. The -p flag maps host ports to container ports. The correct syntax is -p :.

Answer

docker run -d --expose 80 -p 8080 myapp

Answer

docker run -d -p 80:8080 myapp

Answer

docker run -d -P 8080:80 myapp

Question 9

In a Kubernetes cluster, a developer needs to ensure that a set of pods can be accessed by other pods using a stable IP address and DNS name, even if pods are recreated. Which resource should be created?

Accepted Answer

Service. A Service in Kubernetes provides a stable virtual IP (ClusterIP) and a DNS name (via CoreDNS) that persists across pod restarts and rescheduling. This allows other pods to reliably discover and communicate with the set of pods behind the Service, regardless of individual pod IP changes.

Answer

ConfigMap

Answer

Namespace

Answer

Deployment

Question 10

A CI/CD pipeline is configured to build a Docker image, run unit tests, and push the image to a registry. To ensure that only successfully tested images are pushed, which stage order is correct?

Accepted Answer

Build image -> Run tests -> Push image. The correct order is: build the image, run tests, then push only if tests pass. Pushing before tests could push a broken image.

Answer

Run tests -> Build image -> Push image

Answer

Build image -> Push image -> Run tests

Answer

Push image -> Build image -> Run tests

Question 11

A developer needs to store a database password securely in a Kubernetes cluster. Which resource should be used?

Accepted Answer

Secret. Secrets are designed to store sensitive information like passwords, encoded in base64 but intended for secrets. ConfigMaps are for non-sensitive data.

Answer

PersistentVolume

Answer

ConfigMap

Answer

ServiceAccount

Question 12

Which Docker network driver allows a container to share the host's network stack, giving it direct access to host interfaces?

Accepted Answer

host. The 'host' network driver in Docker removes network isolation between the container and the host, allowing the container to use the host's network stack directly. This means the container binds to host interfaces and ports without NAT or port mapping, giving it direct access to the host's IP address and network configuration.

Answer

none

Answer

overlay

Answer

bridge

Question 13

A developer is writing a web application and wants to prevent SQL injection attacks. Which coding practice should be followed when constructing SQL queries?

Accepted Answer

Use parameterized queries with prepared statements. Using parameterized queries ensures that user input is treated as data, not executable code, preventing SQL injection.

Answer

Use stored procedures exclusively

Answer

Encode user input with base64 before inserting into SQL

Answer

Concatenate user input directly into SQL statements

Question 14

In a Jenkins declarative pipeline, a stage named 'Deploy to Production' should only run after manual approval. Which directive should be used to achieve this?

Accepted Answer

input. The `input` directive in a Jenkins declarative pipeline is specifically designed to pause a stage and wait for human approval before proceeding. When placed inside a stage block, it presents a message and optional parameters (like a 'Proceed' or 'Abort' button) to a user, effectively implementing a manual gate. This is the correct way to enforce manual approval before a 'Deploy to Production' stage runs.

Answer

post

Answer

parallel

Answer

when

Question 15

A developer runs 'docker-compose up -d' for a multi-service application. What does the '-d' flag do?

Accepted Answer

It runs containers in detached mode (background). The `-d` flag in `docker-compose up -d` stands for 'detached mode', which instructs Docker Compose to run the containers in the background, freeing the terminal for other commands. This is analogous to the `-d` flag in `docker run -d` and is essential for long-running services that should not block the command-line session.

Answer

It enables debugging output

Answer

It pulls the latest images before starting

Answer

It deletes the containers after they stop