200-901 Application Deployment and Security Practice Test 6 — 15 Questions

Question 1

A Kubernetes pod contains two containers that need to share a local filesystem. Which volume type should be used to enable this?

Accepted Answer

emptyDir. An emptyDir volume is created empty when a pod is assigned to a node and exists as long as the pod runs; it can be mounted by multiple containers within the same pod.

Answer

hostPath

Answer

configMap

Answer

persistentVolumeClaim

Question 2

A developer notices that after a new deployment, the application is not receiving traffic. The Service selector does not match the pod labels. Which kubectl command can be used to inspect the Service's selector?

Accepted Answer

kubectl describe service my-service. The `kubectl describe service my-service` command displays detailed information about the Service, including its selector field, which defines the label key-value pairs used to match pods. This allows the developer to directly compare the selector against the pod labels to identify the mismatch. It is the most straightforward way to inspect the selector without needing to parse raw YAML or execute commands inside the service.

Answer

kubectl exec service/my-service -- cat /etc/hosts

Answer

kubectl get service my-service -o yaml

Answer

kubectl logs service/my-service

Question 3

Which Docker command is used to view the logs of a running container in real-time?

Accepted Answer

docker logs -f <container>. docker logs -f follows the log output, similar to tail -f.

Answer

docker exec -it <container> tail -f /var/log/app.log

Answer

docker attach <container>

Answer

docker logs <container>

Question 4

In a Dockerfile, which instruction is used to set an environment variable that will be available at runtime?

Accepted Answer

ENV. ENV sets environment variables in the image that persist when the container runs.

Answer

RUN export VAR=value

Answer

LABEL

Answer

ARG

Question 5

A developer wants to perform a rolling update of a Kubernetes Deployment. Which command will update the image and initiate the rollout?

Accepted Answer

kubectl set image deployment/myapp myapp=myapp:v2. kubectl set image deployment updates the container image and triggers a rolling update if the deployment strategy is RollingUpdate (default).

Answer

kubectl update deployment myapp --image=myapp:v2

Answer

kubectl edit deployment myapp --image=myapp:v2

Answer

kubectl apply -f deployment.yaml --image=myapp:v2

Question 6

A CI/CD pipeline uses GitHub Actions. The workflow should trigger only when a pull request is opened against the 'main' branch. Which 'on' trigger configuration is correct?

Accepted Answer

on: pull_request: branches: [main]. The correct syntax uses pull_request with branches filter.

Answer

on: [pull_request, push]

Answer

on: push: branches: [main]

Answer

on: pull_request_target: branches: [main]

Question 7

Which TWO practices help prevent hardcoded credentials in application code? (Choose TWO.)

Accepted Answer

Use a secrets management tool like HashiCorp Vault to retrieve credentials at runtime. Using environment variables (from .env or secret managers) and using a dedicated secrets management tool like Vault are best practices. Committing .env files exposes secrets.

Answer

Share secrets via email and paste them into the code during deployment

Answer

Commit a .env file with placeholder values to the repository

Answer

Embed secrets directly in the source code with comments

Question 8

Which THREE steps are essential in a typical CI/CD pipeline for a containerized application? (Choose THREE.)

Accepted Answer

Build the Docker image. Building the Docker image is essential because it packages the application code, dependencies, and runtime into a portable container. Without this step, there is no deployable artifact for the CI/CD pipeline to promote through stages.

Answer

Perform code review

Answer

Deploy directly to production without testing

Question 9

Which TWO Kubernetes resources are used to provide configuration data to pods? (Choose TWO.)

Accepted Answer

Secret. ConfigMap for non-sensitive data and Secret for sensitive data are both used to inject configuration into pods.

Answer

PersistentVolumeClaim

Answer

Deployment

Answer

Service

Question 10

A developer creates a Dockerfile for a Python web application. Which instruction should be used to define the working directory inside the container for subsequent commands?

Accepted Answer

WORKDIR. The WORKDIR instruction in a Dockerfile sets the working directory for any RUN, CMD, ENTRYPOINT, COPY, and ADD instructions that follow it in the Dockerfile. For a Python web application, using WORKDIR /app ensures that subsequent commands like COPY and RUN operate inside the /app directory, keeping the container filesystem organized and avoiding path errors.

Answer

ENV

Answer

RUN

Answer

COPY

Question 11

A team is deploying a microservice that must scale independently. The service uses environment variables for configuration. Which Kubernetes resource should be used to store non-sensitive configuration data separate from the container image?

Accepted Answer

ConfigMap. ConfigMap is the correct Kubernetes resource for storing non-sensitive configuration data (like environment variables) separately from the container image. This allows the microservice to scale independently because configuration changes can be applied without rebuilding or redeploying the image, enabling stateless, horizontally scalable pods.

Answer

Secret

Answer

Service

Answer

Deployment

Question 12

A developer wants to run a Docker container in detached mode, mapping host port 8080 to container port 80, and mounting a host directory for persistent data. Which command accomplishes this?

Accepted Answer

docker run -d -p 8080:80 -v /host/data:/container/data myapp. The -d flag runs detached, -p maps ports, and -v mounts a volume from host to container.

Answer

docker run -it -p 8080:80 -v /host/data:/container/data myapp

Answer

docker start -d -p 8080:80 -v /host/data:/container/data myapp

Answer

docker compose up -d -p 8080:80 -v /host/data:/container/data myapp

Question 13

In a CI/CD pipeline using Jenkins, which stage is typically executed immediately after the build stage to ensure code quality before deployment?

Accepted Answer

Unit test. In a Jenkins CI/CD pipeline, the build stage compiles the code and produces artifacts. Immediately after the build, unit tests are executed to validate individual components in isolation, catching defects early before proceeding to integration or deployment stages. This aligns with the principle of 'shift-left' testing, where quality gates are applied as early as possible.

Answer

Deploy to production

Answer

Integration test

Answer

Artifact publication

Question 14

A Kubernetes pod has two containers: a main application and a sidecar proxy. They need to communicate via localhost. Which pod networking model allows this?

Accepted Answer

Pod network (containers share the same IP). Containers in the same pod share the same network namespace, so they can communicate via localhost.

Answer

Host network

Answer

Bridge network

Answer

Overlay network

Question 15

A developer needs to enforce HTTPS for a web application. Which security measure should be implemented in the application or reverse proxy?

Accepted Answer

SSL/TLS termination and HTTP redirect. Enforcing HTTPS requires the reverse proxy or application to terminate incoming SSL/TLS connections (decrypting traffic at the proxy) and then redirect any HTTP requests to HTTPS using a 301 or 302 redirect. This ensures all client traffic is encrypted in transit, meeting security best practices and compliance requirements like PCI DSS.

Answer

Parameterized queries

Answer

CORS configuration

Answer

Input validation