Courseiva
← 200-901
Full test
mediumMultiple SelectObjective-mapped

Dockerfile Best Practices for Cisco DevNet Associate

Which TWO statements about Dockerfile best practices are correct? (Choose two.)

Quick Answer

The correct answer is that you should prefer official base images from trusted registries, as this ensures a secure, stable foundation for your containerized applications. This is a core Dockerfile best practice because official images are maintained by the software vendor or the Docker team, receive regular security patches, and are verified to be free of malware, reducing your attack surface significantly. On the Cisco DevNet Associate 200-901 exam, this concept tests your understanding of secure software supply chains and efficient image layering, often appearing alongside questions about minimizing build context with a .dockerignore file—a common trap is forgetting that a .dockerignore prevents sensitive files like .git or logs from reaching the daemon, which also speeds up builds. To remember this, think of the mnemonic “O-F-F” for Official, From trusted, and Filter with .dockerignore.

⚠ Common exam trap

Cisco often tests the misconception that EXPOSE actually secures or opens ports, when in reality it is only documentation and has no effect on container network security.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use a .dockerignore file to exclude unnecessary files from the build context.

A .dockerignore file prevents unnecessary files (e.g., node_modules, .git, logs) from being sent to the Docker daemon as part of the build context. This reduces build time, minimizes the risk of including sensitive data, and ensures a cleaner, more efficient image build.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Use the ADD instruction instead of COPY to copy local files into the image.

    Why it's wrong here

    COPY is preferred over ADD for local files because ADD has additional features (like tar extraction) that can be unexpected.

  • ✗

    Combine multiple RUN commands into a single RUN statement to reduce image layers.

    Why it's wrong here

    While reducing layers can be beneficial, combining commands into one RUN is not always best; it can reduce cacheability. The recommended practice is to minimize layers but not at the expense of readability.

  • ✓

    Use a .dockerignore file to exclude unnecessary files from the build context.

    Why this is correct

    .dockerignore reduces build context size and improves security by excluding sensitive files.

  • ✗

    Use the EXPOSE instruction to secure the container by limiting exposed ports.

    Why it's wrong here

    EXPOSE is documentation only; it does not actually open or secure ports. Security is achieved via -p flag or network policies.

  • ✓

    Prefer official base images from trusted registries.

    Why this is correct

    Official images are maintained and scanned for vulnerabilities, reducing security risks.

About these practice questions

Courseiva writes every 200-901 question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

2 more ways this is tested on 200-901

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. Refer to the exhibit. A developer is building a Docker image for a Node.js application. The Dockerfile contains: ``` FROM node:14 WORKDIR /usr/src/app COPY package*.json ./ RUN npm install COPY . . CMD ["node", "app.js"] ``` When building, the error shown occurs. What is the most likely cause?

hard
  • A.The Dockerfile should use the root user for running npm install.
  • B.The npm install command should be run with the --unsafe-perm flag.
  • C.The base image node:14 is outdated and contains a bug.
  • ✓ D.The application is running as a non-root user (e.g., node) that lacks write permission to the working directory.

Why D: The error occurs because the official Node.js Docker image (node:14) runs as a non-root user named 'node' by default. The WORKDIR /usr/src/app is owned by root, so the 'node' user lacks write permission to that directory. When npm install tries to create node_modules or write package-lock.json, it fails with a permission error. Option D correctly identifies this user-permission mismatch.

Variation 2. A developer wants to ensure that a Docker container running a web application can only accept incoming traffic on port 443. Which Docker run option should be used?

easy
  • A.docker run --port 443 myapp
  • B.docker run --net host myapp
  • ✓ C.docker run -p 443:443 myapp
  • D.docker run --expose 443 myapp

Why C: The `-p 443:443` flag publishes container port 443 to the host port 443, mapping incoming traffic on the host's port 443 to the container's port 443. This ensures the web application inside the container only accepts incoming traffic on port 443, as the host firewall and Docker's port mapping restrict access to that specific port.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.