easyMultiple ChoiceObjective-mapped
200-901 Practice Question: A team is deploying a new microservice on Cisco…
A team is deploying a new microservice on Cisco Container Platform. The microservice needs to access a database hosted on a separate VM. The security policy requires that only the microservice can communicate with the database, and all traffic must be encrypted. The team is using Kubernetes network policies and mutual TLS. During testing, the microservice cannot reach the database. The database team reports that the database is reachable from other services. What is the most likely cause?
⚠ Common exam trap
Cisco often tests the default-deny behavior of Kubernetes NetworkPolicy, where candidates mistakenly assume that no policy means all traffic is allowed, but the trap is that once a policy selects a pod, all unallowed traffic is implicitly denied, including egress to external IPs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Kubernetes NetworkPolicy is blocking egress from the microservice pod to the database IP
The most likely cause is that a Kubernetes NetworkPolicy is blocking egress from the microservice pod to the database IP. Since the database is reachable from other services, the issue is specific to the microservice pod's network access. A NetworkPolicy that does not explicitly allow egress traffic to the database IP will default to denying that traffic, preventing the microservice from reaching the database even though the database itself is operational.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A Kubernetes NetworkPolicy is blocking egress from the microservice pod to the database IP
Why this is correct
Network policies can restrict traffic; a default deny or misconfigured policy could block the connection.
- ✗
The database server is not listening on the expected port
Why it's wrong here
Since other services can reach the database, the listener is working.
- ✗
The mutual TLS certificates are expired or not trusted
Why it's wrong here
If mTLS were the issue, other services attempting to connect would also likely fail.
- ✗
The Istio sidecar proxy is misconfigured and rejecting traffic due to a missing ServiceEntry
Why it's wrong here
Without a ServiceEntry, traffic might be blocked by mutual TLS, but the symptom is unreachability, and other services work.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-901 question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.