CCNA Devnet App Deployment Questions

Using environment variables (from .env or secret managers) and using a dedicated secrets management tool like Vault are best practices. Committing .env files exposes secrets.

pip audit checks Python packages for vulnerabilities. npm audit is for Node.js, Snyk is a third-party tool, Dependabot automates dependency updates.

Containers in the same pod share the same network namespace, so they can communicate via localhost.

The RUN instruction executes commands in a new layer on top of the current image and commits the results. Using RUN pip install -r requirements.txt ensures that the Python dependencies are installed during the image build process, making them part of the final image. This is the correct approach because dependencies should be installed at build time, not at container runtime.

docker push uploads a local image to a registry. docker pull downloads. docker push requires the image to be tagged with the registry URL.

The 'host' network driver in Docker removes network isolation between the container and the host, allowing the container to use the host's network stack directly. This means the container binds to host interfaces and ports without NAT or port mapping, giving it direct access to the host's IP address and network configuration.

Building the Docker image is essential because it packages the application code, dependencies, and runtime into a portable container. Without this step, there is no deployable artifact for the CI/CD pipeline to promote through stages.

The correct syntax uses pull_request with branches filter.

The -p flag maps host ports to container ports. The correct syntax is -p <host-port>:<container-port>.

The -d flag runs detached, -p maps ports, and -v mounts a volume from host to container.

ClusterIP exposes the service on a cluster-internal IP, making it reachable only within the cluster. NodePort and LoadBalancer expose externally. ExternalName maps to an external DNS name.

LoadBalancer exposes the service externally using a cloud provider's load balancer. ClusterIP is internal only, NodePort exposes on each node's IP, ExternalName maps to external DNS.

With maxSurge=1, one extra pod can be created above the desired 3, and maxUnavailable=0 ensures no pods are taken down before new ones are ready. So the maximum is 4 pods.

ConfigMap is the correct Kubernetes resource for storing non-sensitive configuration data (like environment variables) separately from the container image. This allows the microservice to scale independently because configuration changes can be applied without rebuilding or redeploying the image, enabling stateless, horizontally scalable pods.

A ConfigMap is the correct Kubernetes resource for storing non-sensitive configuration data like a database hostname. It is designed to decouple configuration artifacts from image content, allowing pods to consume this data as environment variables or mounted files without hardcoding values into container images.

Snyk is a popular dependency scanning tool that integrates with CI/CD pipelines. pip audit and npm audit are similar but for specific ecosystems. Snyk supports multiple languages.

The WORKDIR instruction in a Dockerfile sets the working directory for any RUN, CMD, ENTRYPOINT, COPY, and ADD instructions that follow it in the Dockerfile. For a Python web application, using WORKDIR /app ensures that subsequent commands like COPY and RUN operate inside the /app directory, keeping the container filesystem organized and avoiding path errors.

LoadBalancer provisions a cloud load balancer and assigns a stable external IP, making the service accessible from outside the cluster.

kubectl describe pod my-pod shows detailed information including events and container statuses. kubectl logs my-pod shows container logs. The other commands are for different resources or abstract actions.

An emptyDir volume is created empty when a pod is scheduled and can be mounted by multiple containers in the same pod, allowing them to share files.

Parameterized queries separate SQL logic from data, preventing attackers from injecting malicious SQL. Input validation is also important but not a direct prevention of SQL injection.

Dependabot is the correct GitHub-native tool for automatically scanning dependencies for known vulnerabilities on every push. It monitors the dependency manifest files (e.g., package.json, requirements.txt) against the GitHub Advisory Database and opens pull requests to update vulnerable packages. This directly meets the requirement of scanning dependencies for known vulnerabilities in a CI/CD workflow.

The correct order is: build the image, run tests, then push only if tests pass. Pushing before tests could push a broken image.

Using parameterised queries (prepared statements) ensures that user input is treated as data, not executable SQL code, preventing SQL injection.

The `none` networking mode in Docker creates a container with no network interfaces except the loopback device, providing the highest level of network isolation. This means the container cannot send or receive any external traffic, making it ideal for security-sensitive workloads that require complete network disconnection.

Option D is correct because mounting a Secret as a volume stores the data in the tmpfs (RAM-backed filesystem) of the pod, which is not written to disk and is not exposed via environment variables that could be logged or printed by the application. This approach prevents accidental leakage of sensitive data through log outputs or environment variable dumps, as the application must explicitly read the file from the mount point.

The `docker logs -f` command attaches to the container's stdout/stderr streams and follows new output in real-time, which is exactly what is needed to debug a live connection issue. The `-f` flag (short for `--follow`) continuously prints log lines as they are written, allowing the developer to observe database connection attempts and errors as they occur.

The EXPOSE directive informs Docker that the container listens on specified ports at runtime. It does not actually publish the port but serves as documentation.

The -d flag runs container in detached mode, -p maps host port to container port.

NodePort exposes on each node's IP, LoadBalancer creates external load balancer, Ingress provides HTTP routing. ClusterIP is internal only, ExternalName maps to DNS record.

The CMD instruction in a Dockerfile provides default arguments for the container's entrypoint or defines the command to execute when the container starts. For a Node.js application, CMD is commonly used to specify the startup command, such as `CMD ["node", "app.js"]`, which runs the Node.js process. This instruction can be overridden at runtime by providing a command after `docker run`.

docker logs -f follows the log output of a container, similar to tail -f.

Using environment variables for secrets (not hardcoding) and scanning dependencies for vulnerabilities help prevent exposure.

ClusterIP exposes the service on a cluster-internal IP, making it accessible only within the cluster.

-d runs container detached, -p maps host port 8080 to container port 80, --name assigns name 'web', and nginx is the image.

Stage gates are conditional checkpoints in a CI/CD pipeline that evaluate predefined criteria before allowing the pipeline to proceed to the next stage. In this scenario, the integration test stage acts as a gate: if the tests fail, the gate blocks the pipeline from advancing to the production deployment stage, ensuring only validated code reaches production.

ConfigMap stores non-sensitive configuration data. Secret stores sensitive data. Deployment and Service are for workload and networking.

In Docker Compose, the `depends_on` key with the `condition: service_healthy` option ensures that the `web` service starts only after the `db` service has passed its health check. This is defined in the `db` service using a `healthcheck` directive, and Compose waits for the healthy state before starting dependent services.

docker ps -a lists all containers (including stopped), and docker logs -f shows logs of a container.

The 'build' key specifies the path to the Dockerfile context; 'image' specifies a pre-built image from a registry.

ENV sets environment variables in the image that persist when the container runs.

The `kubectl rollout status deployment/my-deployment` command is specifically designed to track the progress of a rollout and report its current state, including whether it is stuck or progressing. It provides real-time status updates and can surface underlying issues like image pull errors or resource constraints that cause the rollout to hang, making it the correct tool for diagnosing a stuck rollout.

Output encoding converts special characters (e.g., < >) to HTML entities, so the browser does not interpret them as code. Input validation alone is insufficient for XSS.

Option A is correct because enforcing HTTPS requires the reverse proxy or application to terminate incoming SSL/TLS connections (decrypting traffic at the proxy) and then redirect any HTTP requests to HTTPS using a 301 or 302 redirect. This ensures all client traffic is encrypted in transit, meeting security best practices and compliance requirements like PCI DSS.

Snyk is a dedicated security tool that integrates into CI/CD pipelines to scan dependencies for known vulnerabilities using databases like the National Vulnerability Database (NVD) and its own proprietary intelligence. It continuously monitors open-source libraries and container images, providing automated fix pull requests and blocking builds when critical vulnerabilities are found.

Namespaces provide logical isolation within a cluster. Each team can have its own namespace with separate policies and resource quotas.

depends_on in Docker Compose controls startup order. 'links' is legacy, 'networks' defines networks, 'volumes' mounts volumes.

The LoadBalancer Service type provisions an external cloud load balancer (e.g., AWS ELB, GCP TCP/UDP Load Balancer) that routes external traffic to the 'web-app' deployment's pods. This is the only Service type that directly integrates with a cloud provider's load balancing infrastructure to expose the service externally.

A Service in Kubernetes provides a stable virtual IP (ClusterIP) and a DNS name (via CoreDNS) that persists across pod restarts and rescheduling. This allows other pods to reliably discover and communicate with the set of pods behind the Service, regardless of individual pod IP changes.

Option A is correct because `docker run` creates and starts a new container, `-d` runs it in detached (background) mode, `-p 8080:80` maps host port 8080 to container port 80, `-v myvol:/data` creates or uses a named volume `myvol` mounted at `/data`, and `--name myapp` assigns a custom name. This combination fulfills all requirements: background execution, port mapping, and a named volume.

PersistentVolumeClaim requests persistent storage that survives pod restarts. emptyDir is ephemeral, hostPath ties to a node, configMap is for configuration.

Option C is correct because the ENV instruction sets environment variables that persist in the container at runtime, making it the appropriate way to define a default value for NODE_ENV that can be overridden later with `docker run -e`. Unlike shell-level exports or build-time-only ARGs, ENV ensures the variable is available to the Node.js process when the container starts.

Secrets are designed to store sensitive information like passwords, encoded in base64 but intended for secrets. ConfigMaps are for non-sensitive data.

An emptyDir volume is created empty when a pod is assigned to a node and exists as long as the pod runs; it can be mounted by multiple containers within the same pod.

The 'stages' keyword defines the order of jobs. Jobs are grouped by stage, and stages run sequentially.

The COPY instruction copies files or directories from the build context into the container filesystem. RUN executes commands, EXPOSE documents ports, and CMD sets default command.

Rolling updates can be done by editing the deployment, applying a new YAML, or using set image. kubectl edit deployment updates the live config. kubectl apply -f update.yaml applies a new manifest. kubectl set image updates the image directly. kubectl delete and create would cause downtime.

depends_on creates a startup order: Docker Compose starts 'db' before 'web'. It does not wait for 'db' to be ready; that requires healthchecks.

docker logs -f follows the log output. docker exec runs a command inside container, docker attach attaches to a running container's I/O, docker inspect shows detailed info.

B is correct because CSRF tokens are a standard defense against Cross-Site Request Forgery attacks. By embedding a unique, unpredictable token in each form and validating it on the server, the application ensures that requests originate from the legitimate user session, not from a malicious third-party site. This is a fundamental security best practice for web applications handling state-changing requests.

The `input` directive in a Jenkins declarative pipeline is specifically designed to pause a stage and wait for human approval before proceeding. When placed inside a stage block, it presents a message and optional parameters (like a 'Proceed' or 'Abort' button) to a user, effectively implementing a manual gate. This is the correct way to enforce manual approval before a 'Deploy to Production' stage runs.

Option C is correct because secrets management tools like HashiCorp Vault provide a centralized, encrypted store for sensitive data such as database credentials, and they inject secrets into the CI/CD pipeline at deployment time via secure APIs (e.g., Vault's HTTP API with TLS). This approach avoids storing secrets in version control, eliminates hardcoding, and supports dynamic secrets, rotation, and audit logging, which aligns with security best practices for CI/CD.

The 'push' event with branch filter triggers on pushes to main. 'pull_request' triggers on PRs, 'release' on releases, 'workflow_dispatch' manual trigger.

docker build -t myapp:v1 . builds the Docker image from the current directory and tags it as myapp:v1.

The --restart flag with 'on-failure' restarts the container only if it exits with a non-zero code, which indicates an error.

kubectl rollout pause suspends the rollout. kubectl rollout undo rolls back to previous revision. kubectl rollout status shows status, and kubectl delete does not pause rollout.

kubectl rollout status shows the progress of a rollout, and kubectl rollout history shows revisions.

ARG allows passing build-time variables. ENV sets environment variables that persist in the container. CMD and RUN are not for variable definition.

The `kubectl describe service my-service` command displays detailed information about the Service, including its selector field, which defines the label key-value pairs used to match pods. This allows the developer to directly compare the selector against the pod labels to identify the mismatch. It is the most straightforward way to inspect the selector without needing to parse raw YAML or execute commands inside the service.

After building the Docker image, the next logical step is to run unit tests to verify code quality before pushing the image to a registry.

The WORKDIR instruction in a Dockerfile sets the working directory for any subsequent RUN, CMD, ENTRYPOINT, COPY, and ADD instructions. This ensures that commands execute from that directory and that COPY/ADD paths are resolved relative to it. Option A is correct because WORKDIR is the only Dockerfile instruction designed specifically for this purpose.

Environment variables from .env files not committed, and using a secret vault (like HashiCorp Vault) are recommended. Hardcoding in code, storing in config files in git, and using long-lived passwords are insecure.

Services, networks, and volumes are top-level keys in Docker Compose. Ports is a key within a service definition, not top-level.

kubectl apply -f creates or updates resources from a file. get, describe, and create are not used for applying manifests.