hardMultiple ChoiceObjective-mapped
200-901 Uses a private Docker registry with TLS Practice Question
An organization uses a private Docker registry with TLS. A developer attempts to pull an image and receives the error: "x509: certificate signed by unknown authority". What is the most likely cause and solution?
⚠ Common exam trap
Candidates often confuse a certificate trust issue with a hostname mismatch or think disabling TLS is an acceptable workaround, but Cisco specifically tests the understanding that the correct enterprise-grade fix is to trust the CA, not to weaken security.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add the CA certificate to the client's trust store
The error 'x509: certificate signed by unknown authority' occurs because the Docker client does not recognize the certificate authority (CA) that signed the registry's TLS certificate. The correct solution is to add the CA certificate to the client's trust store, typically by placing it in /etc/docker/certs.d/<registry_hostname>:<port>/ca.crt on Linux or the equivalent Docker certs directory on other platforms. This allows the Docker daemon to validate the registry's certificate during the TLS handshake.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Add the CA certificate to the client's trust store
Why this is correct
This establishes trust in the registry's certificate.
- ✗
Use the registry's IP address instead of hostname
Why it's wrong here
This does not resolve certificate trust issues.
- ✗
Disable TLS verification on the client
Why it's wrong here
This is insecure and not recommended.
- ✗
Use HTTP instead of HTTPS
Why it's wrong here
This exposes traffic to eavesdropping.
Go deeper
Related to this question
About these practice questions
One of 989 original 200-901 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.