Application Deployment and Security

350-901 · 60 questions

• A municipal CI job fails during install with “Could not find a version that satisfies the requirement requests==2.31.0” while unit tests never start. What is the correct diagnosis?
• City automation CI reports that package A needs libX>=2 while package B pins libX<2, and the resolver aborts before tests run. What failed?
• After install succeeds, the city’s CI test job prints AssertionError and FAILED testssidtoggle, and the pipeline stays red so the image is not promoted. What is the accurate diagnosis?
• A civic pipeline log shows ModuleNotFoundError: No module named 'meraki' during the install/import phase, with no AssertionError lines. Which failure class does the log show?
• Requirements now list a new DNA Center client library, but CI restores last week’s cached site-packages, reports install success, then fails on import of the new module. Where should diagnosis start?
• A city CI pipeline shows install green, test red with FAILED assertions, then image-build and deploy skipped. An engineer opens the deploy log looking for a down Kubernetes API. What is the correct 4.1 read?
• The city’s prebuilt CD path already builds, pushes, and rolls container images into Kubernetes. How should a new Meraki webhook consumer integrate into that environment?
• During a municipal release, the CD must ship a new image tag for the DNA health API consumer without breaking callers that already use the stable ClusterIP name. What should change?
• The prebuilt CD only shifts traffic to pods that pass the environment’s existing readiness probe on port 8080. A new image listens only on 9000. What happens and what must the app meet?
• A developer must place a Webex ChatOps bot into the city’s already-running Docker and Kubernetes CD path. Which approach matches “integrate into a prebuilt CD environment”?
• The prebuilt Kubernetes path injects Meraki API credentials via Secret-mounted environment variables at deploy time. A teammate proposes baking the key into the image layers. Which choice follows the integration contract?
• On-call staff propose a runbook that SSHes to node-3 and pip installs the DNA dashboard wherever capacity appears. How should Docker and Kubernetes CD integration work instead?
• Which practice best describes the benefit of continuous testing in the city’s CI pipeline for a Meraki automation repo?
• Why does the municipal CI include a static-analysis job before Docker build and promote of the Webex ChatOps service?
• The city’s pipeline policy marks the build red when static analysis reports a high-severity finding so the artifact is not deployed. What benefit does that quality gate provide?
• What professional benefit do continuous testing and static analysis in CI primarily deliver for the civic automation team?
• Which statement correctly places static analysis for DEVCOR task 4.3 versus application security mitigations?
• City platform engineers containerize a Python DNA Center collector. What does using Docker for that application primarily establish?
• During a municipal Docker lab, the team builds and tags dna-collector:1.2, then starts a process from that tag. Which statement is correct?
• What must the Docker build include so the Meraki location consumer is a self-contained containerized application?
• A municipal CD pipeline promotes a civic API that talks to Meraki and DNA Center. Operators need reliable rollback to the last known-good build. Which image naming practice gives CD a stable release identity?
• Public-works developers containerize a Flask helper that queries Intersight inventory for a city NOC. Which practice correctly utilizes Docker for that process?
• A parks department needs a slim image for a Python tool that calls the Webex API. The Dockerfile already has a base image and a COPY of the app. Which single instruction best completes the default startup without authoring an entire recipe from scratch?
• A city automation service must use different DNA Center hostnames and feature flags in lab versus production. Which 12-factor approach keeps that deploy-specific config out of the repository?
• A containerized civic chatbot that posts to Webex must follow the 12-factor logging tenet. How should the process emit log events?
• A permitting portal uses PostgreSQL, a message queue, and a Meraki Dashboard API endpoint. Which design treats those as 12-factor backing services?
• A city scales out replicas of a ticket-intake API behind a load balancer. Which 12-factor process design supports stopping and replacing any instance safely?
• After a failed Webex notification deploy, an engineer SSHes into the live container and edits Python files to hotfix production. Which 12-factor rule did that break?
• A new hire’s laptop runs a UCS inventory script fine, but the CI container fails importing the same modules. Which 12-factor dependency practice prevents that class of failure?
• Operations asks the civic Firepower FDM helper team for an effective application logging strategy. Which emission pattern should the app adopt?
• A citizen portal UI calls a back-end that then invokes the Meraki API. On-call staff cannot join those hops when troubleshooting. Which logging-design choice fixes that?
• While debugging a Meraki integration, a developer enables a ‘log everything’ mode that prints Authorization headers and API keys. What makes that logging strategy unsafe?
• A DNA Center write fails during a scheduled civic sync, but on-call cannot tell what failed amid chatty logs. Which logging practice restores actionable signal?
• The platform team runs containers for a Webex ChatOps bot. Which logging assumption keeps day-2 debug from depending on SSH and tail?
• A parks inventory database stores citizen equipment locations, and a portal sends those records to staff browsers. Which privacy statement is accurate?
• A Meraki-assisted occupancy dashboard for libraries only needs site-level counts. Which storage privacy practice should the app follow?
• A municipal integration ships tenant inventory and limited PII to a partner webhook. The database volume is encrypted. Which transmission practice is still required?
• A ChatOps auditor bot stores Webex message bodies and location observations for troubleshooting. Which storage-privacy control limits long-term blast radius?
• During an outage, an engineer creates an unencrypted debug zip and database backup containing customer payloads from a civic AppDynamics-linked app. Why is that still a privacy concern?
• A developer commits a DNA Center token in a .env file, then deletes the line in a later commit. Which secret-storage approach is the relevant fix going forward?
• In production, a multi-replica civic API must read a Webex bot token at runtime. Which secret storage approach fits that scenario?
• A pipeline builds and pushes an image that deploys a Meraki reporter. Where should the registry password and deploy token live?
• On the city’s Kubernetes cluster, a Catalyst Center sync pod needs an API token. Which store is appropriate for that credential?
• Security mandates rotating the Intersight API secret every 90 days with minimal downtime. Which approach makes that rotation practical?
• Three teams need credentials for the same UCS tooling: a solo developer on a laptop, a shared CI runner, and multi-replica production. Which statement identifies the relevant secret approach?
• A city permitting API must present TLS credentials the ops team can rotate for that service alone. The shared ingress still uses a platform default certificate nobody on the app team can replace. Which configuration choice satisfies an application-specific SSL requirement?
• A municipal container build currently COPYs server.key into the image. Security review requires configuring TLS material at run time. Which change correctly configures the application certificate?
• Citizens call https://permits.city.example for a civic API, but the installed certificate lists only CN/SAN for dev.permits.city.example. Clients reject the handshake. What is wrong with the application certificate configuration?
• A parks reservation API still serves a certificate copied into place years ago and now past its notAfter date. Callers fail trust checks. Beyond the initial install, what must application-specific certificate configuration include?
• A developer is tasked with configuring an application-specific SSL certificate for a civic REST API. Which action stays in scope for that application HTTPS requirement?
• A city services portal echoes webhook and form text into HTML pages. Reviewers flag reflected cross-site scripting risk. Which mitigation correctly addresses XSS?
• A cookie-authenticated civic admin form accepts POST from the browser. Attackers could trick a logged-in clerk’s browser into submitting a cross-origin POST. Which mitigation specifically addresses CSRF?
• A utilities lookup API builds database queries by concatenating citizen-supplied IDs into SQL strings. Which change is the primary SQL injection mitigation?
• A security review lists three findings: reflected XSS in a status page, CSRF on an admin POST, and SQLi in a search endpoint. Which pairing correctly matches each threat to its primary mitigation?
• Developers added maximum-length checks on every form field for a permitting portal and declared XSS, CSRF, and SQLi handled. Why is that incomplete for OWASP threat mitigation?
• An exam-style lab asks which OWASP threat examples DEVCOR highlights for application mitigation strategies. Which set matches the official named trio?
• A civic integration sends tenant identifiers and access tokens to an API over the network. How do end-to-end encryption principles apply to that API hop?
• A reverse proxy terminates TLS for a city API and forwards requests to the application over HTTP on the internal segment. Which statement reflects end-to-end encryption principles for APIs?
• An integration team proposes “encrypting” API JSON by Base64-encoding bodies on HTTP without TLS. Which principle of API encryption does that miss beyond hiding bytes poorly?
• A blueprint asks how end-to-end encryption principles apply to APIs for a municipal microservice. Which focus stays in scope?