hardMultiple SelectObjective-mapped
200-901 Practice Question: A DevOps team is securing a CI/CD pipeline that…
A DevOps team is securing a CI/CD pipeline that deploys containerized applications to Kubernetes. Which THREE practices enhance security?
⚠ Common exam trap
Cisco often tests the misconception that 'containers are inherently isolated'—candidates may think privileges or root access are safe because containers are 'lightweight VMs,' but in reality, they share the host kernel, making privilege escalation a critical risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implementing network policies to restrict pod communication.
Network policies in Kubernetes act as a firewall for pods, restricting ingress and egress traffic based on labels, namespaces, or IP blocks. This implements a zero-trust model by default, preventing lateral movement if a container is compromised. Option A is correct because it directly reduces the attack surface within the cluster.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implementing network policies to restrict pod communication.
Why this is correct
Limits lateral movement in the cluster.
- ✗
Allowing containers to run with privileges.
Why it's wrong here
Grants unnecessary permissions.
- ✓
Scanning container images for vulnerabilities before deployment.
Why this is correct
Identifies and mitigates known vulnerabilities.
- ✗
Running containers as root.
Why it's wrong here
Increases risk of container breakout.
- ✓
Using Kubernetes Secrets for sensitive environment variables.
Why this is correct
Secures sensitive data like passwords.
Go deeper
Related to this question
About these practice questions
This 200-901 question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.