200-901 Application Deployment and Security Practice Question
A developer is deploying a containerized application with Docker Compose. The application requires environment variables for database credentials that should not be hardcoded in the docker-compose.yml file. Which two methods securely provide these credentials? (Choose two.)
⚠ Common exam trap
Cisco often tests the distinction between compile-time (build) and runtime injection of secrets, and the trap here is that candidates may think storing credentials in the Docker image (Option E) is acceptable, not realizing that image layers are persistent and can be inspected by anyone with access to the image.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an .env file and add it to .gitignore, then reference it with env_file in the service.
Using an `.env` file allows you to externalize sensitive environment variables (like database credentials) from the `docker-compose.yml` file. By adding the `.env` file to `.gitignore`, you prevent it from being committed to version control, thus keeping credentials secure. The `env_file` directive in the service definition loads these variables at runtime without exposing them in the compose file.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a public registry to store the credentials.
Why it's wrong here
Public registry exposes secrets.
- ✗
Hardcode the credentials in the docker-compose.yml under environment.
Why it's wrong here
Hardcoding exposes secrets in the file.
- ✓
Use an .env file and add it to .gitignore, then reference it with env_file in the service.
Why this is correct
.env file with env_file keeps secrets out of version control.
- ✓
Define the variables in the environment block of docker-compose.yml, with values from shell variables using ${VAR} syntax.
Why this is correct
This allows passing secrets at runtime without hardcoding.
- ✗
Store the credentials in the Docker image during build.
Why it's wrong here
Embedding in image is insecure and not easily changeable.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-901 question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.