How should I use these Application Deployment and Security practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

200-901 · topic practice

Application Deployment and Security practice questions

Q: Can I practise just Application Deployment and Security questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Application Deployment and Security domain.

Practise Cisco DevNet Associate 200-901 Application Deployment and Security practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Application Deployment and Security

Practice 10 questions Browse domain →

What the exam tests

What to know about Application Deployment and Security

Application Deployment and Security questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Application Deployment and Security exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Application Deployment and Security questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full Application Deployment and Security explanation →

A developer wants to ensure that a Docker container running a web application can only accept incoming traffic on port 443. Which Docker run option should be used?

Trap 1: docker run --port 443 myapp

There is no --port flag; the correct flag is -p or --publish.

Trap 2: docker run --net host myapp

--net host shares the host network stack, exposing all host ports, which is too permissive.

Trap 3: docker run --expose 443 myapp

--expose only documents ports but does not publish them; the port is still not accessible from outside.

Study all Application Deployment and Security common traps →

A
docker run --port 443 myapp
Why wrong: There is no --port flag; the correct flag is -p or --publish.
B
docker run --net host myapp
Why wrong: --net host shares the host network stack, exposing all host ports, which is too permissive.
C
docker run -p 443:443 myapp
-p 443:443 publishes container port 443 to host port 443, allowing external access only on that port.
D
docker run --expose 443 myapp
Why wrong: --expose only documents ports but does not publish them; the port is still not accessible from outside.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full Application Deployment and Security explanation →

During a security audit, an engineer discovers that a CI/CD pipeline is storing API keys in plain text in environment variables. Which best practice should be implemented to mitigate this risk?

Trap 1: Store secrets in a .env file and add it to the repository with…

Storing secrets in version control is a security risk even with restricted access; the file may be leaked.

Trap 2: Encrypt the environment variables using a tool like openssl and…

Encrypting environment variables still requires managing decryption keys and does not eliminate exposure in logs or process listings.

Trap 3: Remove the API keys from the pipeline and require manual entry each…

Manual entry is error-prone and breaks automation; it does not address secure storage.

Study all Application Deployment and Security common traps →

A
Store secrets in a .env file and add it to the repository with restricted access.
Why wrong: Storing secrets in version control is a security risk even with restricted access; the file may be leaked.
B
Encrypt the environment variables using a tool like openssl and store the key elsewhere.
Why wrong: Encrypting environment variables still requires managing decryption keys and does not eliminate exposure in logs or process listings.
C
Use a dedicated secrets management service like HashiCorp Vault or AWS Secrets Manager and retrieve secrets at runtime.
Secrets managers provide secure storage, rotation, and audit capabilities, preventing exposure in plaintext.
D
Remove the API keys from the pipeline and require manual entry each time a build runs.
Why wrong: Manual entry is error-prone and breaks automation; it does not address secure storage.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full Application Deployment and Security explanation →

A network engineer is troubleshooting a Kubernetes deployment where pods are failing to start with the error 'CrashLoopBackOff'. The pod log shows 'bind: address already in use'. The deployment runs multiple replicas of a container that listens on port 8080. What is the most likely cause?

Trap 1: The container is attempting to bind to a privileged port without…

Port 8080 is not privileged (privileged ports are below 1024).

Trap 2: The service is using NodePort and the node port is already in use.

NodePort is a service type; the error occurs at the container level, not the service level.

Trap 3: Multiple containers in the same pod are trying to bind to the same…

Containers in a pod share the same network namespace; they cannot bind to the same port, but the error would occur at pod creation, not as CrashLoopBackOff after start.

Study all Application Deployment and Security common traps →

A
The container is attempting to bind to a privileged port without the necessary capabilities.
Why wrong: Port 8080 is not privileged (privileged ports are below 1024).
B
The deployment has hostPort: 8080 specified, causing port conflict when multiple replicas are scheduled on the same node.
hostPort reserves the port on the host node, so only one pod per node can use it. With multiple replicas, subsequent pods fail with address in use.
C
The service is using NodePort and the node port is already in use.
Why wrong: NodePort is a service type; the error occurs at the container level, not the service level.
D
Multiple containers in the same pod are trying to bind to the same port.
Why wrong: Containers in a pod share the same network namespace; they cannot bind to the same port, but the error would occur at pod creation, not as CrashLoopBackOff after start.

Full breakdown with real-world context →

Question 4easymultiple choice

Read the full Application Deployment and Security explanation →

A developer needs to ensure that microservice A can securely communicate with microservice B over HTTPS within a Kubernetes cluster. What is the simplest approach?

Trap 1: Use a Kubernetes Ingress resource with TLS termination for…

Ingress is for external traffic; internal service-to-service communication does not need Ingress.

Trap 2: Expose microservice B via a LoadBalancer Service and use HTTPS from…

LoadBalancer services expose the service externally, which is unnecessary for internal communication and adds complexity.

Trap 3: Connect directly using the pod IP of microservice B over HTTP.

Direct pod IPs are ephemeral and HTTP is insecure; this breaks if pods restart.

Study all Application Deployment and Security common traps →

A
Use a Kubernetes Ingress resource with TLS termination for microservice B.
Why wrong: Ingress is for external traffic; internal service-to-service communication does not need Ingress.
B
Expose microservice B via a LoadBalancer Service and use HTTPS from microservice A.
Why wrong: LoadBalancer services expose the service externally, which is unnecessary for internal communication and adds complexity.
C
Connect directly using the pod IP of microservice B over HTTP.
Why wrong: Direct pod IPs are ephemeral and HTTP is insecure; this breaks if pods restart.
D
Create a Kubernetes Service of type ClusterIP for microservice B and configure microservice A to use HTTPS with the service DNS name.
ClusterIP services are internal and can be used with TLS termination within the cluster for secure communication.

Full breakdown with real-world context →

Question 5mediummultiple choice

Study the full Python automation breakdown →

An engineer is designing a CI/CD pipeline for a Python application. The pipeline should automatically run unit tests, build a Docker image, push it to a private registry, and deploy to a Kubernetes cluster. Which sequence of stages is correct?

Trap 1: Build -> Test -> Push -> Deploy

Building before testing wastes time if tests fail; tests should run first.

Trap 2: Test -> Push -> Deploy

This sequence omits the build stage; the image must be built from the code.

Trap 3: Test -> Deploy -> Build -> Push

Deploying before building and pushing is impossible; the image must exist.

Study all Application Deployment and Security common traps →

A
Build -> Test -> Push -> Deploy
Why wrong: Building before testing wastes time if tests fail; tests should run first.
B
Test -> Push -> Deploy
Why wrong: This sequence omits the build stage; the image must be built from the code.
C
Test -> Deploy -> Build -> Push
Why wrong: Deploying before building and pushing is impossible; the image must exist.
D
Test -> Build -> Push -> Deploy
Tests run first; if they pass, the image is built, pushed to registry, then deployed.

Full breakdown with real-world context →

Question 6hardmultiple choice

Read the full Application Deployment and Security explanation →

A security policy requires that all container images in a registry are scanned for vulnerabilities before deployment. Which approach best integrates this into a CI/CD pipeline without slowing down the pipeline?

Trap 1: Build the image, push it, then scan it, and if vulnerabilities are…

This doubles build time and registry usage; scanning should occur before push.

Trap 2: Run the vulnerability scan on the image after pushing to the…

Post-push scanning delays the pipeline; the image is already in the registry.

Trap 3: Scan the source code dependencies before building the image, and…

Source scanning does not cover vulnerabilities introduced in the base image or during build.

Study all Application Deployment and Security common traps →

A
Build the image, push it, then scan it, and if vulnerabilities are found, rebuild and repush.
Why wrong: This doubles build time and registry usage; scanning should occur before push.
B
Run the vulnerability scan on the image after pushing to the registry and block deployment if critical vulnerabilities are found.
Why wrong: Post-push scanning delays the pipeline; the image is already in the registry.
C
Build the image, scan it locally, and if it passes, push it to the registry; run scans in parallel with the build if possible.
Local scanning before push catches vulnerabilities early and does not delay the pipeline if done in parallel.
D
Scan the source code dependencies before building the image, and skip image scanning.
Why wrong: Source scanning does not cover vulnerabilities introduced in the base image or during build.

Full breakdown with real-world context →

Question 7easymultiple choice

Read the full Ansible explanation →

A DevOps engineer wants to automate the configuration of network devices using Ansible. Which file format is commonly used for Ansible playbooks?

Trap 1: INI

INI files are used for Ansible inventory, not playbooks.

Trap 2: XML

XML is verbose and not used for Ansible playbooks.

Trap 3: JSON

JSON is not natively used for Ansible playbooks; YAML is the standard.

Study all Application Deployment and Security common traps →

A
INI
Why wrong: INI files are used for Ansible inventory, not playbooks.
B
YAML
Ansible playbooks are written in YAML, which is human-readable and easy to parse.
C
XML
Why wrong: XML is verbose and not used for Ansible playbooks.
D
JSON
Why wrong: JSON is not natively used for Ansible playbooks; YAML is the standard.

Full breakdown with real-world context →

Question 8mediummultiple choice

Read the full Application Deployment and Security explanation →

In a Cisco DNA Center environment, an application needs to retrieve the network device list using REST API. Which authentication method is required?

Trap 1: OAuth 2.0 client credentials grant with client ID and secret

OAuth 2.0 is not used; DNA Center uses a custom token endpoint.

Trap 2: Basic authentication with username and password in the header

Basic auth is not recommended; the API expects a token.

Trap 3: API key passed in a query parameter

API keys are not used; the token is passed in the header.

Study all Application Deployment and Security common traps →

A
OAuth 2.0 client credentials grant with client ID and secret
Why wrong: OAuth 2.0 is not used; DNA Center uses a custom token endpoint.
B
Obtain an API token by POSTing credentials to /dna/system/api/v1/auth/token, then use the token in subsequent requests
DNA Center uses a token-based authentication; the token is passed in the X-Auth-Token header.
C
Basic authentication with username and password in the header
Why wrong: Basic auth is not recommended; the API expects a token.
D
API key passed in a query parameter
Why wrong: API keys are not used; the token is passed in the header.

Full breakdown with real-world context →

Question 9mediummulti select

Read the full Application Deployment and Security explanation →

Which TWO statements about Dockerfile best practices are correct? (Choose two.)

Trap 1: Use the ADD instruction instead of COPY to copy local files into…

COPY is preferred over ADD for local files because ADD has additional features (like tar extraction) that can be unexpected.

Trap 2: Combine multiple RUN commands into a single RUN statement to reduce…

While reducing layers can be beneficial, combining commands into one RUN is not always best; it can reduce cacheability. The recommended practice is to minimize layers but not at the expense of readability.

Trap 3: Use the EXPOSE instruction to secure the container by limiting…

EXPOSE is documentation only; it does not actually open or secure ports. Security is achieved via -p flag or network policies.

Study all Application Deployment and Security common traps →

A
Use the ADD instruction instead of COPY to copy local files into the image.
Why wrong: COPY is preferred over ADD for local files because ADD has additional features (like tar extraction) that can be unexpected.
B
Combine multiple RUN commands into a single RUN statement to reduce image layers.
Why wrong: While reducing layers can be beneficial, combining commands into one RUN is not always best; it can reduce cacheability. The recommended practice is to minimize layers but not at the expense of readability.
C
Use a .dockerignore file to exclude unnecessary files from the build context.
.dockerignore reduces build context size and improves security by excluding sensitive files.
D
Use the EXPOSE instruction to secure the container by limiting exposed ports.
Why wrong: EXPOSE is documentation only; it does not actually open or secure ports. Security is achieved via -p flag or network policies.
E
Prefer official base images from trusted registries.
Official images are maintained and scanned for vulnerabilities, reducing security risks.

Full breakdown with real-world context →

Question 10hardmulti select

Read the full Application Deployment and Security explanation →

Which THREE security measures should be implemented in a CI/CD pipeline to protect against supply chain attacks? (Choose three.)

Trap 1: Enable verbose logging for all build steps to detect anomalies.

Verbose logging may expose sensitive information and does not directly prevent supply chain attacks.

Trap 2: Sign all build artifacts with a GPG key.

Signing verifies the integrity of the artifact itself but does not protect against compromised dependencies.

Study all Application Deployment and Security common traps →

A
Enable verbose logging for all build steps to detect anomalies.
Why wrong: Verbose logging may expose sensitive information and does not directly prevent supply chain attacks.
B
Pin dependency versions to specific hashes.
Version pinning prevents accidental introduction of malicious updates.
C
Sign all build artifacts with a GPG key.
Why wrong: Signing verifies the integrity of the artifact itself but does not protect against compromised dependencies.
D
Verify checksums of downloaded dependencies.
Checksum verification ensures that dependencies have not been tampered with.
E
Use a private registry for container images with vulnerability scanning.
Private registries control which images are used and scanning identifies known vulnerabilities.

Full breakdown with real-world context →

Question 11easymulti select

Read the full Application Deployment and Security explanation →

Which TWO are valid methods to secure a REST API? (Choose two.)

Trap 1: Use HTTP with basic authentication.

HTTP transmits credentials in plaintext; HTTPS is required for security.

Trap 2: Embed API keys in the URL query string.

API keys in URLs are exposed in logs and browser history; they should be sent in headers over HTTPS.

Trap 3: Implement rate limiting to prevent abuse.

Rate limiting is a control for availability, not a security mechanism for authentication or confidentiality.

Study all Application Deployment and Security common traps →

A
Use HTTPS to encrypt data in transit.
HTTPS encrypts the communication, preventing eavesdropping and tampering.
B
Use HTTP with basic authentication.
Why wrong: HTTP transmits credentials in plaintext; HTTPS is required for security.
C
Embed API keys in the URL query string.
Why wrong: API keys in URLs are exposed in logs and browser history; they should be sent in headers over HTTPS.
D
Implement rate limiting to prevent abuse.
Why wrong: Rate limiting is a control for availability, not a security mechanism for authentication or confidentiality.
E
Implement OAuth 2.0 for token-based access control.
OAuth 2.0 provides delegated access with scoped tokens, a standard for API security.

Full breakdown with real-world context →

Question 12mediummultiple choice

Study the full Python automation breakdown →

Refer to the exhibit. A Python script uses the Cisco IOS-XE RESTCONF API to retrieve the device configuration. The returned JSON is shown. What must be done to enable the GigabitEthernet0/1 interface using the API?

Exhibit

Refer to the exhibit.
```
{
  "hostname": "Router1",
  "interfaces": [
    {
      "name": "GigabitEthernet0/0",
      "ip": "10.1.1.1",
      "mask": "255.255.255.0",
      "enabled": true
    },
    {
      "name": "GigabitEthernet0/1",
      "ip": "192.168.1.1",
      "mask": "255.255.255.0",
      "enabled": false
    }
  ]
}
```

Trap 1: Send a DELETE request to the interface resource.

DELETE removes the interface, not what is needed.

Trap 2: Send a GET request to the interface resource and parse the response.

GET retrieves data but does not modify the configuration.

Trap 3: Send a PUT request to the interface resource with the entire JSON…

PUT replaces the entire resource; it can be used but is heavy-handed; the exhibit only requires changing one field.

Study all Application Deployment and Security common traps →

A
Send a PATCH request to the interface resource with the JSON payload {"enabled": true}.
PATCH partially updates the resource; changing enabled to true will enable the interface.
B
Send a DELETE request to the interface resource.
Why wrong: DELETE removes the interface, not what is needed.
C
Send a GET request to the interface resource and parse the response.
Why wrong: GET retrieves data but does not modify the configuration.
D
Send a PUT request to the interface resource with the entire JSON payload.
Why wrong: PUT replaces the entire resource; it can be used but is heavy-handed; the exhibit only requires changing one field.

Full breakdown with real-world context →

Question 13hardmultiple choice

Read the full Application Deployment and Security explanation →

Refer to the exhibit. A developer is building a Docker image for a Node.js application. The Dockerfile contains: ``` FROM node:14 WORKDIR /usr/src/app COPY package*.json ./ RUN npm install COPY . . CMD ["node", "app.js"] ``` When building, the error shown occurs. What is the most likely cause?

Exhibit

Refer to the exhibit.
```
Error: EACCES: permission denied, mkdir '/usr/src/app/node_modules/.cache'
    at Object.mkdirSync (fs.js:753:3)
    at ...
```

Trap 1: The Dockerfile should use the root user for running npm install.

Running as root is a security risk; the issue is about file permissions, not user.

Trap 2: The npm install command should be run with the --unsafe-perm flag.

The --unsafe-perm flag allows npm to run as root, but that is not the recommended solution; the proper fix is to set directory permissions.

Trap 3: The base image node:14 is outdated and contains a bug.

The error is permission-related, not a bug in the base image.

Study all Application Deployment and Security common traps →

A
The Dockerfile should use the root user for running npm install.
Why wrong: Running as root is a security risk; the issue is about file permissions, not user.
B
The npm install command should be run with the --unsafe-perm flag.
Why wrong: The --unsafe-perm flag allows npm to run as root, but that is not the recommended solution; the proper fix is to set directory permissions.
C
The base image node:14 is outdated and contains a bug.
Why wrong: The error is permission-related, not a bug in the base image.
D
The application is running as a non-root user (e.g., node) that lacks write permission to the working directory.
The node image often uses the node user; if the WORKDIR is owned by root, the node user cannot write to it. The fix is to ensure proper ownership.

Full breakdown with real-world context →

Question 14hardmultiple choice

Read the full Application Deployment and Security explanation →

A company runs a microservices application on a Kubernetes cluster with 10 worker nodes. The application consists of 3 services: frontend, backend, and database. The database service is stateful and uses persistent volumes. Recently, the operations team noticed that the backend service is experiencing intermittent failures with 'Connection refused' errors when trying to connect to the database. The database service is exposed via a ClusterIP service named 'database-service'. The backend service uses environment variable DB_HOST=database-service to connect. The pod logs show that the connection is attempted to an IP address that does not correspond to any database pod. Further investigation reveals that the database pod has been restarted multiple times due to OOMKilled errors. The backend service is configured with a liveness probe that checks the health endpoint every 10 seconds, and a readiness probe that checks the same endpoint every 5 seconds. The database pod has resource limits set to 512Mi memory and 500m CPU. The node running the database pod has 4Gi memory and 2 CPU cores. What is the most likely cause of the intermittent connection failures?

Trap 1: The backend service is using a hardcoded IP address instead of the…

The stem states the backend uses DB_HOST=database-service, so it uses DNS, not a hardcoded IP.

Trap 2: The backend service's readiness probe is failing, so it is not…

If the backend readiness probe fails, the backend pod would be removed from service endpoints, but the error is on the backend trying to connect to the database, not the backend itself.

Trap 3: The DNS entry for database-service is cached and pointing to the…

ClusterIP services use a virtual IP that does not change; pod restarts do not affect the ClusterIP. DNS caching is not the issue.

Study all Application Deployment and Security common traps →

A
The backend service is using a hardcoded IP address instead of the service DNS name.
Why wrong: The stem states the backend uses DB_HOST=database-service, so it uses DNS, not a hardcoded IP.
B
The backend service's readiness probe is failing, so it is not receiving traffic, but the backend still tries to connect.
Why wrong: If the backend readiness probe fails, the backend pod would be removed from service endpoints, but the error is on the backend trying to connect to the database, not the backend itself.
C
The database pod is being killed due to memory limits, causing frequent restarts and temporary unavailability; the backend's connection attempts fail during the restart window.
The OOMKilled errors indicate the database pod exceeds memory limits. When it restarts, there is a brief period of unavailability, causing 'Connection refused' errors.
D
The DNS entry for database-service is cached and pointing to the old pod IP after the database pod restarts.
Why wrong: ClusterIP services use a virtual IP that does not change; pod restarts do not affect the ClusterIP. DNS caching is not the issue.

Full breakdown with real-world context →

Question 15mediummultiple choice

Open the full VLAN trunking answer →

A network engineer is automating the deployment of a new VLAN across multiple Cisco switches using Ansible. The engineer has written a playbook that uses the ios_vlan module to create VLAN 100 with name 'Users'. The playbook runs successfully on the first switch but fails on the second switch with the error message: 'VLAN name is already in use'. The engineer checks the second switch and confirms that VLAN 100 does not exist, but a different VLAN with the name 'Users' exists. The engineer wants to ensure that the playbook creates VLAN 100 with the exact name 'Users' only if it does not already exist, and without conflicting with existing VLANs. Which approach should the engineer take?

Trap 1: First use the ios_command module to run 'show vlan name Users' and…

This approach is more complex and error-prone; the ios_vlan module handles idempotency.

Trap 2: Use the ios_config module to directly apply the configuration 'vlan…

Using ios_config is lower-level and may not handle idempotency as gracefully as ios_vlan.

Trap 3: Use the ios_vlan module with vlan_id=100 and state=present, but…

Omitting the name may cause the VLAN to be created with a default name, but does not address the name conflict.

Study all Application Deployment and Security common traps →

A
Use the ios_vlan module with parameters vlan_id=100 and name='Users' and set state=present. The module will create the VLAN if it does not exist or update the name if it exists with a different name.
The ios_vlan module idempotently creates or updates VLAN; it will rename the existing VLAN if needed.
B
First use the ios_command module to run 'show vlan name Users' and then conditionally create VLAN 100 if no output is returned.
Why wrong: This approach is more complex and error-prone; the ios_vlan module handles idempotency.
C
Use the ios_config module to directly apply the configuration 'vlan 100\n name Users' and then use the 'parents' directive to ensure idempotency.
Why wrong: Using ios_config is lower-level and may not handle idempotency as gracefully as ios_vlan.
D
Use the ios_vlan module with vlan_id=100 and state=present, but omit the name parameter.
Why wrong: Omitting the name may cause the VLAN to be created with a default name, but does not address the name conflict.

Full breakdown with real-world context →

Question 16mediummultiple choice

Read the full Application Deployment and Security explanation →

A DevOps team is deploying a microservices application on Cisco UCS using Docker containers. They need to ensure that secrets such as database credentials are securely managed without hardcoding them in the application code or container images. Which approach should they use?

Trap 1: Embed secrets directly in the container image using COPY…

Embedding secrets in the image makes them accessible to anyone with image access and violates principle of least privilege.

Trap 2: Pass secrets as build arguments in the Docker build command.

Build arguments are stored in image layers and can be retrieved using docker history.

Trap 3: Store secrets as environment variables in the Docker Compose file.

Environment variables in Docker Compose can be read during container inspection and may be leaked in logs.

Study all Application Deployment and Security common traps →

A
Embed secrets directly in the container image using COPY instructions.
Why wrong: Embedding secrets in the image makes them accessible to anyone with image access and violates principle of least privilege.
B
Pass secrets as build arguments in the Docker build command.
Why wrong: Build arguments are stored in image layers and can be retrieved using docker history.
C
Use a secure secret store like HashiCorp Vault and retrieve secrets at runtime via API.
A secret store provides dynamic, audited, and encrypted access to secrets without embedding them in code or images.
D
Store secrets as environment variables in the Docker Compose file.
Why wrong: Environment variables in Docker Compose can be read during container inspection and may be leaked in logs.

Full breakdown with real-world context →

Question 17hardmulti select

Read the full Application Deployment and Security explanation →

Which TWO of the following are valid security considerations when deploying an application to a Kubernetes cluster managed by Cisco Intersight? (Choose two.)

Trap 1: Store secrets in ConfigMaps for easy retrieval.

Secrets should be stored in Kubernetes Secrets, not ConfigMaps, and encrypted at rest.

Trap 2: Disable RBAC to simplify management and reduce overhead.

Disabling RBAC removes access control, making the cluster vulnerable to unauthorized actions.

Trap 3: Use default service accounts for all pods to avoid misconfiguration.

Default service accounts often have excessive permissions; custom accounts with least privilege are recommended.

Study all Application Deployment and Security common traps →

A
Store secrets in ConfigMaps for easy retrieval.
Why wrong: Secrets should be stored in Kubernetes Secrets, not ConfigMaps, and encrypted at rest.
B
Define Network Policies to isolate pods and control traffic flow.
Network policies enforce micro-segmentation and limit lateral movement.
C
Disable RBAC to simplify management and reduce overhead.
Why wrong: Disabling RBAC removes access control, making the cluster vulnerable to unauthorized actions.
D
Use default service accounts for all pods to avoid misconfiguration.
Why wrong: Default service accounts often have excessive permissions; custom accounts with least privilege are recommended.
E
Implement Pod Security Policies to restrict privileged containers.
PSPs prevent containers from running with unnecessary privileges.

Full breakdown with real-world context →

Question 18easymultiple choice

Read the full Application Deployment and Security explanation →

Refer to the exhibit. An engineer applied this configuration to a Cisco switch port connected to an application server. The server runs a critical business application that should not be disrupted. However, after applying the configuration, the port goes into errdisable state. What is the most likely cause?

Exhibit

Refer to the exhibit.
```
interface GigabitEthernet1/0/1
 description CONNECTION TO APP SERVER
 switchport access vlan 10
 switchport mode access
 spanning-tree portfast
 spanning-tree bpduguard enable
```

Trap 1: The VLAN 10 does not exist on the switch.

A missing VLAN would result in the port being inactive, not errdisable.

Trap 2: The spanning-tree portfast command is incompatible with access…

Portfast is typically used on access ports to speed up transition to forwarding state; it does not cause errdisable.

Trap 3: The switchport mode access command is incorrect for a server…

Access mode is appropriate for connecting a single server.

Study all Application Deployment and Security common traps →

A
The VLAN 10 does not exist on the switch.
Why wrong: A missing VLAN would result in the port being inactive, not errdisable.
B
The spanning-tree portfast command is incompatible with access ports.
Why wrong: Portfast is typically used on access ports to speed up transition to forwarding state; it does not cause errdisable.
C
The switchport mode access command is incorrect for a server connection.
Why wrong: Access mode is appropriate for connecting a single server.
D
The server is generating BPDU frames, triggering BPDU guard.
BPDU guard errdisables a port if it receives a BPDU, which can happen if the server runs STP or is connected to another switch.

Full breakdown with real-world context →

Question 19mediumdrag order

Read the full DHCP explanation →

Drag and drop the steps to set up a basic DHCP server on a Cisco router into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 20mediumdrag order

Read the full REST/YANG explanation →

Drag and drop the steps to configure a Cisco IOS device for NETCONF access into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Application Deployment and Security sessions

Start a Application Deployment and Security only practice session

Every question in these sessions is drawn from the Application Deployment and Security domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Application Deployment and Security questions →Mixed 200-901 session

Frequently asked questions

What does the 200-901 exam test about Application Deployment and Security?: Application Deployment and Security questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Application Deployment and Security questions in a focused session?: Yes — the session launcher on this page draws every question from the Application Deployment and Security domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other 200-901 topics?: Use the topic links above to move to related areas, or go back to the 200-901 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the 200-901 exam covers. They are not copied from any real exam or dump site.

Application Deployment and Security only

10 questions 20 questions 30 questions 50 questions

Mixed 200-901 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All 200-901 questions Application Deployment and Security domain overview 200-901 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Application Deployment and Security practice questions

What to know about Application Deployment and Security

Common Application Deployment and Security exam traps

Application Deployment and Security questions

A developer wants to ensure that a Docker container running a web application can only accept incoming traffic on port 443. Which Docker run option should be used?

During a security audit, an engineer discovers that a CI/CD pipeline is storing API keys in plain text in environment variables. Which best practice should be implemented to mitigate this risk?

A network engineer is troubleshooting a Kubernetes deployment where pods are failing to start with the error 'CrashLoopBackOff'. The pod log shows 'bind: address already in use'. The deployment runs multiple replicas of a container that listens on port 8080. What is the most likely cause?

A developer needs to ensure that microservice A can securely communicate with microservice B over HTTPS within a Kubernetes cluster. What is the simplest approach?

An engineer is designing a CI/CD pipeline for a Python application. The pipeline should automatically run unit tests, build a Docker image, push it to a private registry, and deploy to a Kubernetes cluster. Which sequence of stages is correct?

A security policy requires that all container images in a registry are scanned for vulnerabilities before deployment. Which approach best integrates this into a CI/CD pipeline without slowing down the pipeline?

A DevOps engineer wants to automate the configuration of network devices using Ansible. Which file format is commonly used for Ansible playbooks?

In a Cisco DNA Center environment, an application needs to retrieve the network device list using REST API. Which authentication method is required?

Which TWO statements about Dockerfile best practices are correct? (Choose two.)

Which THREE security measures should be implemented in a CI/CD pipeline to protect against supply chain attacks? (Choose three.)

Which TWO are valid methods to secure a REST API? (Choose two.)

Refer to the exhibit. A Python script uses the Cisco IOS-XE RESTCONF API to retrieve the device configuration. The returned JSON is shown. What must be done to enable the GigabitEthernet0/1 interface using the API?

Exhibit

Refer to the exhibit. A developer is building a Docker image for a Node.js application. The Dockerfile contains: ``` FROM node:14 WORKDIR /usr/src/app COPY package*.json ./ RUN npm install COPY . . CMD ["node", "app.js"] ``` When building, the error shown occurs. What is the most likely cause?

Exhibit

A DevOps team is deploying a microservices application on Cisco UCS using Docker containers. They need to ensure that secrets such as database credentials are securely managed without hardcoding them in the application code or container images. Which approach should they use?

Which TWO of the following are valid security considerations when deploying an application to a Kubernetes cluster managed by Cisco Intersight? (Choose two.)

Exhibit

Drag and drop the steps to set up a basic DHCP server on a Cisco router into the correct order.

Drag and drop the steps to configure a Cisco IOS device for NETCONF access into the correct order.

Track your progress over time

Start a Application Deployment and Security only practice session

Related 200-901 topic practice pages

Software Development and Design practice questions

Understanding and Using APIs practice questions

Cisco Platforms and Development practice questions