200-901 Application Deployment and Security Practice Question
A development team runs a Python Flask API in a Docker container. The image was built with the Flask development server bound to 0.0.0.0:5000, and the container is started with the published port mapping 8080:5000. Users report that requests to the host on port 5000 are refused, while port 8080 works. Which statement explains this behaviour?
⚠ Common exam trap
The trap here is reading the published port mapping as container:host instead of host:container.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The published mapping forwards host port 8080 to container port 5000, so nothing is listening on host port 5000.
Port publishing follows the host:container form, so 8080:5000 binds the host to 8080 and forwards into the container's 5000. Host port 5000 is not bound at all, which is why connections there are refused while 8080 succeeds. EXPOSE is purely informational, and the in-container bind address determines which interfaces inside the container accept the forwarded packets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The host firewall is dropping traffic on port 5000 because Docker only opens ports that are declared with EXPOSE.
Why it's wrong here
Docker does not open host firewall ports based on EXPOSE; published ports are handled by the Docker networking and NAT rules regardless of EXPOSE. In this scenario the mapping simply never binds host port 5000, so there is no listener there to accept the connection, independent of any firewall configuration.
- ✗
The Dockerfile EXPOSE instruction must match the host port, so EXPOSE 8080 is required for host port 5000 to work.
Why it's wrong here
EXPOSE is documentation of the port the container listens on and does not publish or remap anything. Changing EXPOSE to 8080 would not make host port 5000 reach the the container, and it would misdescribe the application, which actually listens on 5000 inside the container. The real mapping is controlled by the port publish flag.
- ✓
The published mapping forwards host port 8080 to container port 5000, so nothing is listening on host port 5000.
Why this is correct
Publishing with 8080:5000 means the host listens on 8080 and forwards to port 5000 inside the container. The application is reachable only through 8080 on the host; host port 5000 is never bound by Docker, so a connection attempt there is refused. To reach the app on host port 5000 the mapping would need to be 5000:5000.
- ✗
Binding Flask to 0.0.0.0 inside the container prevents Docker from forwarding traffic, so the app must bind to localhost instead.
Why it's wrong here
Binding to 0.0.0.0 is what allows the container's network namespace to accept forwarded traffic on all interfaces; binding to localhost would restrict the listener to the loopback interface inside the container and typically make it unreachable through the published port. The refusal is on the host side, not caused by the in-container bind address.
Go deeper
Related to this question
About these practice questions
One of 975 original 200-901 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.