200-901 Application Deployment and Security Practice Test 5 — 15 Questions

Question 1

A CI/CD pipeline includes stages for code commit, build, unit test, integration test, staging deploy, and production deploy. Which change would best prevent a faulty build from reaching production?

Accepted Answer

Add a manual approval gate before production deploy.. Adding a manual approval gate before the production deploy stage allows a human to verify the build and prevent faulty code from being deployed.

Answer

Remove the integration test stage to speed up the pipeline.

Answer

Use the same environment for testing and production.

Question 2

In a Docker Compose file, you want to ensure that the 'web' service starts only after the 'db' service is healthy. Which key should you use under the 'web' service?

Accepted Answer

depends_on. In Docker Compose, the `depends_on` key with the `condition: service_healthy` option ensures that the `web` service starts only after the `db` service has passed its health check. This is defined in the `db` service using a `healthcheck` directive, and Compose waits for the healthy state before starting dependent services.

Answer

networks

Answer

links

Question 3

A web application is vulnerable to SQL injection. Which secure coding practice should the developer implement in the code to prevent this?

Accepted Answer

Use parameterised queries for database access.. Using parameterised queries (prepared statements) ensures that user input is treated as data, not executable SQL code, preventing SQL injection.

Answer

Escape all user input with htmlspecialchars.

Answer

Use a CAPTCHA on the login form.

Question 4

A developer needs to ensure that environment variables containing database credentials are not hardcoded in the application code. Which approach is most secure for managing secrets in a CI/CD pipeline?

Accepted Answer

Use a secrets management tool like Vault to inject secrets during deployment.. Secrets management tools like HashiCorp Vault provide a centralized, encrypted store for sensitive data such as database credentials, and they inject secrets into the CI/CD pipeline at deployment time via secure APIs (e.g., Vault's HTTP API with TLS). This approach avoids storing secrets in version control, eliminates hardcoding, and supports dynamic secrets, rotation, and audit logging, which aligns with security best practices for CI/CD.

Answer

Encrypt the .env file and commit it.

Answer

Store the credentials in a .env file committed to the repository.

Question 5

Which TWO commands are used to view information about Docker containers? (Select two.)

Accepted Answer

docker logs -f. Option B, `docker logs -f`, is correct because it retrieves and follows the stdout/stderr log output of a running (or stopped) container, which is information about that container's runtime behavior. Option E, `docker ps -a`, is correct because it lists all containers, including stopped ones, showing container IDs, images, status, ports, and names. Option A, `docker build`, is wrong because it builds a new image from a Dockerfile rather than viewing container information. Option C, `docker images`, is wrong because it lists locally stored images, not containers. Option D, `docker volume ls`, is wrong because it lists Docker volumes, which are separate storage resources, not containers.

Answer

docker build

Answer

docker images

Answer

docker volume ls

Question 6

Which THREE are valid Kubernetes Service types? (Select three.)

Accepted Answer

NodePort. A is correct because NodePort is a standard Kubernetes Service type that exposes a service on a static port (30000-32767) on each node's IP address, allowing external traffic to reach the service by targeting :. It builds on top of ClusterIP and is commonly used for development or direct access scenarios.

Answer

Deployment

Answer

Ingress

Question 7

A developer is creating a Dockerfile for a Python Flask application. The application runs on port 5000. Which directive should be used to document that the container listens on this port?

Accepted Answer

EXPOSE 5000. The EXPOSE directive informs Docker that the container listens on specified ports at runtime. It does not actually publish the port but serves as documentation.

Answer

PORT 5000

Answer

PUBLISH 5000

Answer

LISTEN 5000

Question 8

A team uses a Jenkins declarative pipeline to deploy a microservice. The pipeline includes stages: Checkout, Build Docker Image, Run Unit Tests, Push to Registry, Deploy to Staging, and Deploy to Production. Which stage should run immediately after 'Build Docker Image' to ensure code quality before the image is pushed?

Accepted Answer

Run Unit Tests. After building the Docker image, the next logical step is to run unit tests to verify code quality before pushing the image to a registry.

Answer

Deploy to Staging

Answer

Deploy to Production

Answer

Push to Registry

Question 9

A Kubernetes deployment is configured with replicas: 3. During a rolling update, the deployment strategy is set to RollingUpdate with maxSurge: 1 and maxUnavailable: 0. What is the maximum number of pods that will be running during the update?

Accepted Answer

4. With maxSurge=1, one extra pod can be created above the desired 3, and maxUnavailable=0 ensures no pods are taken down before new ones are ready. So the maximum is 4 pods.

Answer

6

Answer

5

Answer

3

Question 10

A developer is writing a web application and needs to prevent SQL injection attacks. Which coding practice is most effective?

Accepted Answer

Use parameterized queries with prepared statements. Parameterized queries with prepared statements separate SQL code from user-supplied data, so the database treats input as data rather than executable SQL. This prevents attackers from injecting SQL syntax regardless of the input's content. It is the most robust and recommended defense against SQL injection.

Answer

Validate input with regex to allow only alphanumeric characters

Answer

Use stored procedures exclusively

Answer

Escape all user input with htmlspecialchars

Question 11

In Docker, which command is used to build an image from a Dockerfile and tag it as 'myapp:v1'?

Accepted Answer

docker build -t myapp:v1 .. The `docker build -t myapp:v1 .` command builds a Docker image from the Dockerfile in the current directory and tags it with the name `myapp` and version tag `v1`. The `-t` flag assigns the tag, and the dot (`.`) specifies the build context (the current directory). This is the standard Docker command for building and tagging images.

Answer

docker run -t myapp:v1 .

Answer

docker create myapp:v1 .

Answer

docker commit myapp:v1 .

Question 12

A DevOps engineer runs a container using 'docker run -d -p 8080:80 nginx'. The host firewall blocks incoming traffic on port 8080 from external networks but allows from the local host. Which command would allow the engineer to test the container's web server from the same machine?

Accepted Answer

curl localhost:8080. Since the host firewall allows local traffic, using curl localhost:8080 will reach the container via the mapped port.

Answer

curl 10.0.0.1:8080

Answer

docker exec -it <container> bash

Answer

docker logs <container>

Question 13

In a Docker Compose file, which key is used to define the dependency order between services?

Accepted Answer

depends_on. The depends_on key in Docker Compose allows specifying that one service depends on another, controlling startup order.

Answer

links

Answer

volumes

Answer

networks

Question 14

A developer commits code to a GitHub repository and wants automated tests to run, followed by building a Docker image and pushing it to Docker Hub only if tests pass. Which CI/CD tool can be configured using a YAML file placed in the .github/workflows directory?

Accepted Answer

GitHub Actions. GitHub Actions is the only CI/CD tool among the options that uses a YAML workflow file placed in the `.github/workflows` directory within the repository. This allows developers to define automated triggers (e.g., on push) to run tests, build a Docker image, and push it to Docker Hub only if tests pass, all natively integrated with GitHub.

Answer

Jenkins

Answer

CircleCI

Answer

GitLab CI

Question 15

Which Docker networking mode provides the most isolation by not connecting the container to any network?

Accepted Answer

none. The `none` networking mode in Docker creates a container with no network interfaces except the loopback device, providing the highest level of network isolation. This means the container cannot send or receive any external traffic, making it ideal for security-sensitive workloads that require complete network disconnection.

Answer

overlay

Answer

bridge

Answer

host