200-901 Application Deployment and Security Practice Test 8 — 15 Questions

Question 1

A developer is building a container image for a Node.js API. The Dockerfile currently starts with FROM node:18, copies source code, and runs npm install. Builds are slow because dependencies are reinstalled on every code change. The developer wants to leverage Docker layer caching so that npm install runs only when package.json changes. Which change should be made to the Dockerfile?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place COPY package*.json ./ and RUN npm install before COPY . .. Docker builds images layer by layer, and a layer is rebuilt only when its instruction or the content it depends on changes. Copying only the dependency manifests and running npm install before copying application source keeps the install layer stable across code edits. This ordering minimizes rebuild time and is the recommended pattern for Node.js images.

Answer

Use a multi-stage build with a builder stage that runs npm install

Answer

Add a .dockerignore file that excludes the node_modules directory

Answer

Add RUN npm cache clean --force before npm install

Question 2

A developer is writing a Python script that calls a REST API protected by OAuth 2.0. The script runs unattended on a server and must obtain an access token without any user interaction. The authorization server supports the client credentials grant. Which flow should the developer implement?

Accepted Answer

Client credentials grant. When an application authenticates as itself rather than on behalf of a user, the client credentials grant is the correct OAuth 2.0 flow. The server script presents its client ID and secret to the token endpoint and receives an access token, with no browser redirect or user consent step. Flows requiring a user, such as authorization code with PKCE or implicit, and flows requiring user passwords do not match unattended machine-to-machine access.

Answer

Implicit grant

Answer

Authorization code grant with PKCE

Answer

Resource owner password credentials grant

Question 3

A security team requires that a web application's API calls to an internal service use mutual TLS. The application runs in a Kubernetes pod and the team wants the certificate and private key mounted as files without embedding them in the container image. Which Kubernetes resource should be used to provide the certificate and key to the pod?

Accepted Answer

A Secret of type kubernetes.io/tls mounted as a volume. Kubernetes Secrets are designed for sensitive data and the kubernetes.io/tls type specifically holds a certificate and key. Mounting the Secret as a volume projects the data into files inside the pod, allowing the application to load them for mutual TLS without baking credentials into the image. This satisfies both the security and file-mount requirements.

Answer

A ConfigMap containing the certificate and key in data fields

Answer

An environment variable defined in the pod spec referencing a Secret

Answer

A PersistentVolumeClaim bound to a network file share

Question 4

A developer is building a container image for a Node.js API. The Dockerfile currently starts with FROM node:18, copies source code, and runs npm install. Builds are slow because dependencies are reinstalled on every code change. The developer wants to leverage Docker layer caching so that npm install runs only when package.json changes. Which change should be made to the Dockerfile?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a single RUN instruction with commands chained using && and clean up temporary files in the same RUN.. Combining commands into a single RUN instruction with && and cleaning up temporary files in the same layer minimizes the number of layers and prevents leftover files from persisting in the image. This approach directly reduces image size and improves build cache utilization by keeping related operations together.

Answer

Use the COPY instruction to copy a pre-built virtual environment into the image.

Answer

Use multiple RUN instructions, one for each command, to make the Dockerfile more readable.

Answer

Use the ADD instruction to download and extract dependencies automatically.

Question 5

A developer is writing a Python script that must call a Cisco DNA Center REST API. The script must authenticate with a username and password over HTTPS and receive a token that is valid for subsequent API calls. The developer wants to avoid embedding the credentials in the script. Which approach should be used?

Accepted Answer

Read the username and password from environment variables and POST them to the DNA Center authentication endpoint to obtain a token.. DNA Center issues a time-limited token when valid credentials are POSTed to its authentication endpoint. Supplying those credentials through environment variables keeps them out of source control and supports rotation across environments. The token is then supplied on subsequent requests, which is exactly the behavior the scenario requires without embedding secrets in the script.

Answer

Hardcode the credentials in a configuration file and commit the file to the Git repository so the script can read it at runtime.

Answer

Use an OAuth 2.0 authorization code flow with a browser-based redirect to obtain an access token for the DNA Center API.

Answer

Send the username and password as query parameters on every API call instead of obtaining a token first.

Question 6

A developer is writing a Python script that calls a REST API. The script currently contains the API key as a string literal. The team wants to move the key out of source control and inject it at runtime in a CI/CD pipeline. Which approach best meets this requirement?

Accepted Answer

Read the API key from an environment variable populated by the pipeline's secret store. Injecting secrets through environment variables supplied by the pipeline's secret store keeps credentials out of the codebase and version history. The application reads the value at runtime, and the CI/CD system can mask it in logs and restrict access. This is the recommended pattern for automated deployments.

Answer

Store the API key in a configuration file committed to the repository

Answer

Base64-encode the API key and place it in the script as a constant

Answer

Have the script prompt the user for the API key on each execution

Question 7

A development team is using Cisco Intersight to manage their on-premises and cloud infrastructure. They want to ensure that API access to Intersight is secure and follows best practices. Which TWO measures should they implement to protect their Intersight API credentials and access? (Choose two.)

Accepted Answer

Use API keys with restricted permissions and rotate them regularly.. Restricting API key permissions and rotating them regularly, combined with storing keys in a secure vault and retrieving them at runtime, significantly reduces the risk of credential compromise. These practices ensure least privilege and prevent secrets from being exposed in code or configuration files.

Answer

Embed API keys directly in application source code for easy access.

Answer

Disable multi-factor authentication for API access to streamline automation.

Answer

Use a single API key for all applications and environments to simplify management.

Question 8

A developer is building a container image for a Node.js API. The Dockerfile currently starts with FROM node:18, copies source code, and runs npm install. Builds are slow because dependencies are reinstalled on every code change. The developer wants to leverage Docker layer caching so that npm install runs only when package.json changes. Which change should be made to the Dockerfile?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

USER. The USER instruction changes the identity used for the container process and for later build steps. Creating a dedicated unprivileged account and switching to it before the final CMD or ENTRYPOINT ensures the application does not run as root. Other instructions affect networking, working directory, or the startup command, but none of them alter process privileges.

Answer

EXPOSE

Answer

ENTRYPOINT

Answer

WORKDIR

Question 9

An engineer is troubleshooting an application running in a Docker container. The container is running but the application is not responding. The Dockerfile EXPOSE instruction lists port 8080, and the container was started with the command: docker run -d -p 8080:80 myapp. Which command should the engineer use to verify the application's actual listening port inside the container?

Accepted Answer

docker exec <container_id> netstat -tuln. The application's actual listening port can differ from the EXPOSE instruction in the Dockerfile. EXPOSE is metadata and does not publish the port or dictate where the app listens. To see the real listening ports inside the container, one must execute a network inspection command inside the container's namespace, such as netstat or ss. This reveals whether the app is bound to the expected port, helping diagnose connectivity issues.

Answer

docker inspect <container_id>

Answer

docker port <container_id>

Answer

docker logs <container_id>

Question 10

A DevOps engineer is deploying a containerized application to a Kubernetes cluster. The application requires a configuration file that contains non-sensitive settings, such as the application's log level and API endpoint. The engineer wants to manage this configuration separately from the container image and make it easily updatable without rebuilding the image. Which Kubernetes resource should be used?

Accepted Answer

ConfigMap. ConfigMap is the Kubernetes resource specifically for storing non-sensitive configuration data. It decouples configuration from the container image, allowing updates without rebuilding. Secrets are for sensitive data, while PersistentVolume and Deployment serve different purposes.

Answer

Secret

Answer

Deployment

Answer

PersistentVolume

Question 11

A development team is adopting container security practices for their Docker-based microservices. They want to reduce the attack surface of their running containers. Which TWO practices should they implement? (Choose two.)

Accepted Answer

Use minimal base images such as distroless or Alpine to reduce installed packages. Running as a non-root user and using minimal base images both reduce what an attacker can do inside a compromised container and how many components could contain vulnerabilities. Together they shrink the attack surface without breaking normal application function. The other listed practices either grant excessive privileges or weaken supply chain verification.

Answer

Mount the Docker socket into every container to simplify orchestration

Answer

Disable the Docker content trust feature to allow unsigned images

Answer

Set the container to privileged mode so it can access all host devices

Question 12

A DevNet engineer is building a Python script that calls the Cisco Webex Teams API to post a message. The script currently stores the access token in a plain text variable at the top of the file, which is committed to a Git repository. The team wants to keep the token out of source control while still allowing the script to authenticate. Which approach should be used?

Accepted Answer

Move the token to a .env file and add that file to .gitignore, then load it with python-dotenv.. Keeping secrets out of source control requires storing them in an environment-specific location that is excluded from version control and loading them at runtime. A .env file ignored by Git, combined with python-dotenv, achieves this for local development while allowing the Webex Teams API call to authenticate normally. Encoding or hiding the token in the same file does not remove it from the repository.

Answer

Base64-encode the token and assign it to the variable so it is not readable as plain text.

Answer

Encrypt the token with a symmetric key stored in the same Python file and decode it at runtime.

Answer

Store the token in a comment above the function that uses it so only developers reading the code can see it.

Question 13

A developer is building a Python microservice that will run in a Docker container on a shared host. The application must read its database connection string and API token from environment variables at runtime, and the developer wants to avoid baking those secrets into the image. Which approach best satisfies this requirement?

Accepted Answer

Pass the values at runtime with docker run --env or --env-file so the process reads them from the container environment.. Secrets that must not persist in a distributed image should be supplied from outside the image at container start. Runtime environment injection keeps the image portable and secret-free, while Dockerfile instructions and source files permanently record whatever they contain. The requirement is about where the value lives, so the mechanism that never writes it into the image is the only one that satisfies it.

Answer

Copy a .env file containing the secrets into the image with the COPY instruction.

Answer

Use the ENV instruction in the Dockerfile to set the connection string and token as defaults.

Answer

Commit the secrets into the application's settings.py module so they load at import time.

Question 14

A development team is using Docker Compose to run a multi-container application. They need to ensure that the web service can resolve the hostname 'db' to the database container's IP address. Which network configuration in the docker-compose.yml file achieves this?

Accepted Answer

Define both services under the same custom network.. Docker Compose automatically creates a default network for the application, and all services join it unless configured otherwise. On a user-defined bridge network, Docker provides automatic DNS resolution so that service names become valid hostnames. Therefore, ensuring both the web and db services are on the same custom network allows the web service to connect to 'db' by its service name, which is the cleanest and most reliable method.

Answer

Use the 'links' directive to link the web service to the db service.

Answer

Publish the database port on the host and use 'host.docker.internal' as the hostname.

Answer

Set the 'network_mode' of the web service to 'service:db'.

Question 15

A developer is using Docker Compose to define a multi-container application. The application requires a database container and a web server container that must communicate with each other. Which Docker Compose file section defines the individual containers and their configurations?

Accepted Answer

services. In Docker Compose, the services top-level element is where each container is defined with its image, ports, environment, and other settings. Networking, volumes, and configs are separate sections that support those services but do not define the containers themselves. Therefore, services is the correct section for specifying the database and web server containers.

Answer

networks

Answer

configs

Answer

volumes