200-901 Application Deployment and Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  docker exec -it <container> tail -f /var/log/app.log

  Why it's wrong here

  This command runs tail inside the container via the exec API, showing only the file's contents and requiring shell access, not Docker's own log stream. It is tempting because exec is familiar, but docker logs -f reads stdout captured by the logging driver.

• ✓

  docker logs -f <container>

  Why this is correct

  The -f (follow) flag streams new log output continuously rather than printing existing logs and exiting, which is exactly the real-time behaviour required. Plain docker logs without -f returns a static snapshot and would not satisfy the live-streaming requirement.

• ✗

  docker attach <container>

  Why it's wrong here

  docker attach connects to the container's stdin/stdout, not its log stream, so it shows live output but cannot replay earlier entries and risks sending input to the process. It suits interactive debugging of a running process, not real-time log viewing.

• ✗

  docker logs <container>

  Why it's wrong here

  Without the -f flag, docker logs prints existing output and exits, so it never streams new entries in real time. It is tempting because docker logs is the standard tool for retrieving container output; adding --follow would make it the correct choice here.

Go deeper

Related to this question