200-901 Application Deployment and Security Practice Question
Which Docker networking mode provides the most isolation by not connecting the container to any network?
⚠ Common exam trap
Cisco often tests the misconception that 'none' means no network at all (including loopback), but the container still has a loopback interface; the trap is that candidates confuse 'none' with 'host' or assume bridge provides stronger isolation than it actually does.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
none
The `none` networking mode in Docker creates a container with no network interfaces except the loopback device, providing the highest level of network isolation. This means the container cannot send or receive any external traffic, making it ideal for security-sensitive workloads that require complete network disconnection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
overlay
Why it's wrong here
Overlay mode connects containers across multiple Docker hosts via a distributed network, providing no isolation at all. It is tempting because overlay networks are used for swarm services and sound contained, but they explicitly enable cross-host communication rather than preventing it.
- ✗
bridge
Why it's wrong here
Bridge mode attaches the container to the default docker0 bridge network, giving it an IP and outbound connectivity, so it does not isolate. It is tempting because bridge is the default mode and is often assumed to be isolated, but true isolation requires the none driver.
- ✓
none
Why this is correct
The none network mode attaches no network interface beyond loopback, so the container cannot reach other containers or external hosts. This delivers the strongest isolation, satisfying the requirement of connecting to no network at all.
- ✗
host
Why it's wrong here
Host mode shares the host's network namespace directly, removing network isolation entirely and exposing all host interfaces. It is tempting because it avoids NAT overhead and is chosen for performance, but it is the opposite of isolation, which requires the none driver.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-901 question from scratch — 975 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.