200-901 Application Deployment and Security Practice Test 9 — 15 Questions

Question 1

A developer is deploying an application to a Kubernetes cluster and must ensure that the application's configuration values, such as a database hostname and port, are injected as environment variables without storing them in the container image. Which Kubernetes resource should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ConfigMap. A ConfigMap is designed for non-sensitive configuration data and can be referenced by a pod to populate environment variables. This decouples configuration from the image and allows the same image to run in different environments. Secrets are for confidential values, while storage and identity resources serve entirely different purposes.

Answer

ServiceAccount

Answer

Secret

Answer

PersistentVolumeClaim

Question 2

A developer is designing a CI/CD pipeline that deploys to production. The team wants to ensure that a failed security scan blocks the deployment automatically. Which pipeline design element should be implemented?

Accepted Answer

Make the security scan stage a required dependency of the deploy stage and fail the pipeline on non-zero exit. A security gate must be part of the pipeline flow and able to fail the build. Making the deploy stage depend on a successful scan, with the scanner exiting non-zero on violations, ensures vulnerable artifacts never reach production. Parallel or advisory scans cannot enforce this requirement.

Answer

Schedule the security scan as a nightly job separate from the pipeline

Answer

Run the security scan in parallel with deployment to save time

Answer

Configure the scan to only warn and continue on findings

Question 3

A developer is writing a unit test for a Python function that calls the Cisco Meraki Dashboard API to retrieve a list of organizations. The test must run without making real HTTP requests to the Meraki cloud. Which technique should be used to isolate the function under test?

Accepted Answer

Use the unittest.mock library to patch the requests.get call and return a canned JSON response.. Unit tests for API clients should isolate the code under test from external services. Patching the HTTP call with unittest.mock lets the test supply a fixed JSON payload and verify how the function handles it, including success and error paths. This keeps the test fast, repeatable, and independent of the Meraki Dashboard API's availability or rate limits.

Answer

Run the test only on a developer workstation that has a valid Meraki API key configured.

Answer

Replace the API call with a print statement that outputs the expected organization list.

Answer

Increase the test timeout to 60 seconds so the real Meraki API call has time to complete.

Question 4

A team deploys a containerized web application and wants to verify that the image running in production was built from the reviewed source and has not been altered since. Which practice directly provides this guarantee?

Accepted Answer

Reference the image by an immutable digest and enable Docker Content Trust so only signed images are pulled.. Verifying that a running container corresponds to reviewed, unmodified source requires two properties: immutability and authenticity. Pinning by digest makes the image reference immutable, and content trust verifies the signature of the publisher. Mutable tags and build-hygiene practices cannot demonstrate either property, so only the combination of digest pinning and signing answers the question.

Answer

Store the Dockerfile in the same repository as the application source code.

Answer

Tag the image with the string latest so every deployment uses the newest build.

Answer

Run docker image prune on the production host before each deployment.

Question 5

A developer is reviewing a CI/CD pipeline that builds and deploys a containerized application. The team wants to protect sensitive values such as API keys and registry passwords used during the pipeline. Which TWO practices should be used? (Choose two.)

Accepted Answer

Store secrets in the CI/CD platform's encrypted secret store and reference them as masked variables in pipeline steps.. Protecting pipeline secrets requires both keeping them out of source and pipeline definitions and retrieving them from controlled stores at the moment they are needed. Encrypted secret stores with masking prevent accidental disclosure in logs, while runtime retrieval from a secrets manager limits exposure and supports rotation. Practices that persist secrets in repositories or logs defeat these protections.

Answer

Commit the secrets to a private repository branch so only team members can read them.

Answer

Reuse the same secret value across all environments and rotate it only when a team member leaves.

Answer

Print the decrypted secrets to the build log so the team can verify they are correct.

Question 6

A developer is building a CI/CD pipeline that must securely manage secrets such as API keys and database passwords. Which two practices should be implemented to protect these secrets throughout the pipeline? (Choose two.)

Accepted Answer

Store secrets in a dedicated secrets manager and inject them at runtime.. To protect secrets in a CI/CD pipeline, they should be stored in a dedicated secrets manager and injected at runtime, avoiding persistent storage in code or configuration. Additionally, using environment variables with masking ensures secrets are not exposed in logs. These practices minimize the attack surface and align with the principle of least privilege. Encrypting and committing secrets or hardcoding them are insecure, and disabling all logging is impractical.

Answer

Encrypt secrets and commit them to the repository for versioning.

Answer

Disable logging for all pipeline stages to prevent secret leakage.

Answer

Hardcode secrets in the pipeline configuration file for simplicity.

Question 7

A development team is implementing security controls for a containerized application deployed on Kubernetes. They need to ensure that containers run with least privilege and that sensitive information is protected. Which TWO measures should be implemented? (Choose two.)

Accepted Answer

Use Kubernetes Secrets to store sensitive data and mount them as volumes.. Running containers as non-root and using Kubernetes Secrets mounted as volumes are two key measures for least privilege and sensitive data protection. Non-root execution limits the impact of a breach, while Secrets avoid exposing confidential data in environment variables or images. The other options either weaken security or are insecure practices.

Answer

Disable read-only root filesystem to allow applications to write logs.

Answer

Store sensitive data in environment variables within the pod specification.

Answer

Set the privileged flag to true in the container security context.

Question 8

A developer pushes a container image to Docker Hub and then discovers that the image layers contain an .env file with production API keys. The team wants future builds to fail automatically in the CI pipeline when secrets are detected in the image before any push occurs. Which approach best addresses this requirement?

Accepted Answer

Run a container image scanning tool against the built image in the pipeline and fail the stage when secret findings are reported.. The requirement is detection with an automatic pipeline failure before pushing. Scanning the built image examines the exact artifacts destined for the registry, so secrets leaked through any path are found. Wiring the scanner to exit non-zero on findings turns that detection into a hard gate. Preventive measures like .dockerignore or signing policies reduce risk but cannot guarantee that no secret exists in the image.

Answer

Enable Docker Content Trust so that only signed images can be pushed to Docker Hub.

Answer

Store the API keys in Docker Hub repository secrets and reference them from the Dockerfile at build time.

Answer

Add a .dockerignore entry for .env and rely on developers to never commit secrets.

Question 9

A developer has built a container image locally and needs to push it to Docker Hub so a CI runner can pull it. The image is currently tagged only as `webapp:latest`. The Docker Hub repository is `devopsuser/webapp`. Which command sequence correctly prepares and uploads the image?

Accepted Answer

docker tag webapp:latest devopsuser/webapp:latest followed by docker push devopsuser/webapp:latest. Publishing to a namespaced registry repository requires the local image reference to include that namespace and repository name. Retagging the existing artifact preserves the exact image that was built and tested, then push uploads it to the matching remote path. Creating a new image through commit, save, or a fresh build either fails outright or changes the artifact unnecessarily.

Answer

docker commit webapp:latest devopsuser/webapp:latest followed by docker push devopsuser/webapp:latest

Answer

docker build -t devopsuser/webapp:latest . followed by docker push devopsuser/webapp:latest

Answer

docker save webapp:latest -o devopsuser/webapp:latest followed by docker push devopsuser/webapp:latest

Question 10

A developer is writing a REST API client in Python that authenticates to a controller using HTTP Basic authentication over the network. The developer wants to ensure credentials are never exposed on the wire in readable form. Which implementation detail is required?

Accepted Answer

Send the request only over HTTPS so the TLS session encrypts the Authorization header in transit.. HTTP Basic authentication provides no confidentiality of its own; it merely encodes the credentials. Protecting them requires an encrypted transport, which TLS provides for the whole request and response. Encoding, relocating, or hashing the credential on the client changes its representation without hiding it from an observer, so only a TLS-protected connection keeps credentials unreadable in transit.

Answer

Send the credentials in a custom request header that the server is configured to read.

Answer

Hash the password with SHA-256 and send the digest in place of the password.

Answer

Base64-encode the username and password and place the result in the Authorization header.

Question 11

A security team is reviewing a Python application that integrates with Cisco DNA Center. The application authenticates with a username and password and stores them in a configuration file that is deployed to multiple servers. The team wants to reduce the risk of credential exposure while keeping the application functional. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Store the configuration file with restrictive file permissions and exclude it from version control.. Reducing credential exposure involves both limiting how long secrets live and limiting who can read them. Short-lived tokens from the Cisco DNA Center authentication API shrink the useful lifetime of a stolen secret, while restrictive file permissions and exclusion from version control protect the configuration file itself. Together these controls address the risk without breaking the integration.

Answer

Disable TLS verification for Cisco DNA Center API calls to simplify certificate management.

Answer

Embed the credentials in the Python source code so the configuration file can be deleted.

Answer

Log the credentials at startup so operators can confirm the configuration is correct.

Question 12

A developer is using the Cisco Meraki Dashboard API to retrieve the list of organizations associated with an API key. The script must handle the response and avoid exposing the API key. Which HTTP header should be used to supply the API key?

Accepted Answer

X-Cisco-Meraki-API-Key: <API_KEY>. The Meraki Dashboard API authenticates each request with the X-Cisco-Meraki-API-Key header. Placing the key in a header rather than a URL keeps it out of server logs and browser history. Other header names belong to different Cisco platforms or authentication schemes and would not authenticate against Meraki.

Answer

Cookie: meraki_api_key=<API_KEY>

Answer

Authorization: Bearer <API_KEY>

Answer

X-Auth-Token: <API_KEY>

Question 13

A development team is building a container image for a Node.js API. The Dockerfile currently uses the instruction `COPY . /app` before `RUN npm install`. A security review flags that the image contains local `.env` files and `.git` history. Which approach best prevents these files from entering the build context while keeping the Dockerfile functional?

Accepted Answer

Add a `.dockerignore` file listing `.env` and `.git`, then rebuild the image.. The build context is everything sent to the Docker daemon, and `COPY . /app` transfers all of it. A `.dockerignore` file filters that context before the build starts, so excluded files never reach any layer. Deleting files later, changing ownership, or relocating them outside the project root does not prevent inclusion and leaves recoverable data in earlier layers.

Answer

Move the `.env` and `.git` directories outside the project root and reference them with an absolute path in the Dockerfile.

Answer

Add `RUN rm -rf /app/.env /app/.git` immediately after the `COPY` instruction.

Answer

Change the instruction to `COPY --chown=node:node . /app` so only Node.js-owned files are copied.

Question 14

A developer is writing a Python script that interacts with a REST API. The API requires authentication using a token. Which HTTP header should the developer include in the request to pass the token?

Accepted Answer

Authorization: Bearer <token>. For REST API authentication using a token, the standard method is to include the token in the Authorization header with the Bearer scheme. This is defined in RFC 6750 for OAuth 2.0 Bearer Tokens. Other headers like X-API-Key or custom headers may be used for API keys, but when the requirement is a token, Bearer is the correct choice. Cookies are for browser sessions.

Answer

Cookie: session=<token>

Answer

X-API-Key: <token>

Answer

Authentication: Token <token>

Question 15

A development team runs a Python Flask API in a Docker container. The image was built with the Flask development server bound to 0.0.0.0:5000, and the container is started with the published port mapping 8080:5000. Users report that requests to the host on port 5000 are refused, while port 8080 works. Which statement explains this behaviour?

Accepted Answer

The published mapping forwards host port 8080 to container port 5000, so nothing is listening on host port 5000.. Port publishing follows the host:container form, so 8080:5000 binds the host to 8080 and forwards into the container's 5000. Host port 5000 is not bound at all, which is why connections there are refused while 8080 succeeds. EXPOSE is purely informational, and the in-container bind address determines which interfaces inside the container accept the forwarded packets.

Answer

The host firewall is dropping traffic on port 5000 because Docker only opens ports that are declared with EXPOSE.

Answer

The Dockerfile EXPOSE instruction must match the host port, so EXPOSE 8080 is required for host port 5000 to work.

Answer

Binding Flask to 0.0.0.0 inside the container prevents Docker from forwarding traffic, so the app must bind to localhost instead.