mediumMultiple ChoiceObjective-mapped
200-901 Practice Question: In a Kubernetes deployment, the container image…
In a Kubernetes deployment, the container image pull policy is set to "Always". This causes performance issues during rollouts because the image registry is slow. What is the best practice to reduce pull time while maintaining security?
⚠ Common exam trap
Cisco often tests the misconception that `:latest` is a safe, always-fresh choice, but the trap here is that `:latest` combined with `Always` causes unnecessary pulls and version ambiguity, whereas immutable tags with `IfNotPresent` balance performance and security.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set pullPolicy to "IfNotPresent" for stable releases and use image tags like v1.2.3.
Setting `pullPolicy` to `IfNotPresent` for stable releases (using immutable tags like `v1.2.3`) avoids unnecessary image pulls from a slow registry when the image already exists on the node. This reduces rollout time while maintaining security by ensuring that only explicitly versioned, verified images are used, preventing accidental use of stale or untagged images.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set pullPolicy to "IfNotPresent" for stable releases and use image tags like v1.2.3.
Why this is correct
Optimizes pulls and uses versioned tags for consistency.
- ✗
Use the ":latest" tag to ensure always fresh images.
Why it's wrong here
Unpredictable and can cause version mismatches.
- ✗
Set pullPolicy to "Never" and pre-pull images on nodes.
Why it's wrong here
Can lead to outdated images without automatic updates.
- ✗
Disable image verification to speed up pulls.
Why it's wrong here
Compromises security.
Go deeper
Related to this question
About these practice questions
This 200-901 question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.