200-901 Application Deployment and Security Practice Question
This 200-901 practice question tests your understanding of application deployment and security. Read the scenario carefully and evaluate each option against the stated constraints before committing to an answer. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A developer wants to ensure that a Docker container running a web application can only accept incoming traffic on port 443. Which Docker run option should be used?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
docker run -p 443:443 myapp
Option C is correct because the `-p 443:443` flag publishes container port 443 to the host port 443, mapping incoming traffic on the host's port 443 to the container's port 443. This ensures the web application inside the container only accepts incoming traffic on port 443, as the host firewall and Docker's port mapping restrict access to that specific port.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
docker run --port 443 myapp
Why it's wrong here
There is no --port flag; the correct flag is -p or --publish.
✗
docker run --net host myapp
Why it's wrong here
--net host shares the host network stack, exposing all host ports, which is too permissive.
✓
docker run -p 443:443 myapp
Why this is correct
-p 443:443 publishes container port 443 to host port 443, allowing external access only on that port.
Related concept
Read the scenario before looking for a memorised answer.
✗
docker run --expose 443 myapp
Why it's wrong here
--expose only documents ports but does not publish them; the port is still not accessible from outside.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Cisco often tests the distinction between `--expose` (documentation only) and `-p` (actual port publishing), and the trap here is that candidates confuse `--expose` with making a port externally accessible, when in fact it only informs Docker that the container uses that port internally.
Detailed technical explanation
How to think about this question
Under the hood, `-p 443:443` creates an iptables DNAT rule in the host's NAT table that redirects incoming TCP traffic on host port 443 to the container's IP and port 443. This is part of Docker's bridge network driver, which provides network isolation and port mapping; without publishing, the container is only reachable from other containers on the same bridge network. In a real-world scenario, using `--expose` alone is insufficient for production because external clients cannot reach the container, while `--net host` would violate security best practices by exposing all host ports.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the 200-901 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Application Deployment and Security — This question tests Application Deployment and Security — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: docker run -p 443:443 myapp — Option C is correct because the `-p 443:443` flag publishes container port 443 to the host port 443, mapping incoming traffic on the host's port 443 to the container's port 443. This ensures the web application inside the container only accepts incoming traffic on port 443, as the host firewall and Docker's port mapping restrict access to that specific port.
What should I do if I get this 200-901 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.