200-901 deployment and security explained
Application Deployment and Security is 15% of 200-901. It covers where and how applications run, how code gets from a repository to production, and the basic security knowledge a developer is expected to have. Several objectives start with interpret or utilize, which means Dockerfiles, short Python tests and bash commands do appear.
Deployment models
| Model | Meaning |
|---|---|
| Private cloud | Infrastructure used by one organisation |
| Public cloud | Shared provider infrastructure, pay for use |
| Hybrid cloud | Private and public combined |
| Edge | Compute close to where data is produced |
Edge computing reduces latency, saves bandwidth by processing data locally and can keep working when the link to a central site is poor. A factory sensor system that must react in milliseconds is the textbook scenario.
Virtual machines, bare metal and containers
| Type | Characteristics |
|---|---|
| Bare metal | Application on dedicated hardware; best raw performance, least flexible |
| Virtual machine | Full guest operating system on a hypervisor; strong isolation, heavier |
| Container | Shares the host kernel; starts fast, small, portable |
Containers package an application with its dependencies, which removes the problem of code that works on one machine and fails on another.
Docker
A Dockerfile lists build steps.
| Instruction | Purpose |
|---|---|
FROM | Base image |
WORKDIR | Working directory |
COPY | Copy files into the image |
RUN | Command executed at build time |
EXPOSE | Documents the port the app listens on |
CMD | Default command at container start |
docker build -t myapp . builds an image. docker run -p 8080:5000 myapp maps host port 8080 to container port 5000. docker ps lists running containers and docker images lists images. An image is the template; a container is a running instance.
CI/CD and unit tests
Continuous integration merges and tests every change automatically. Continuous delivery or deployment pushes passing builds to an environment. A typical pipeline runs build, test, then deploy, and stops at the first failure. Tests are the gate.
A Python unit test subclasses unittest.TestCase, defines methods starting with test_ and uses assertions such as assertEqual. Know how to read one and spot a wrong assertion.
Application security
Secrets. Do not store passwords, tokens or keys in source code or in a public repository. Use environment variables or a secrets manager, and rotate leaked credentials.
Encryption. Protect data at rest (storage encryption) and in transit (TLS/HTTPS). Handle personal data minimally and carefully.
Network components. A firewall filters traffic by rules, DNS resolves names to addresses, a load balancer spreads requests across servers, and a reverse proxy sits in front of servers, handling TLS and routing.
OWASP threats.
| Threat | What happens | Defence |
|---|---|---|
| SQL injection | Input becomes part of a database query | Parameterised queries, input validation |
| Cross-site scripting (XSS) | A malicious script runs in a victim’s browser | Output encoding, input validation |
| Cross-site request forgery (CSRF) | A logged-in user’s browser is tricked into sending an unwanted request | Anti-CSRF tokens |
Bash essentials
pwd shows the directory, ls lists, cd changes, mkdir creates, cp and mv copy and move, rm removes, chmod changes permissions, export NAME=value sets an environment variable and echo $NAME prints it.
DevOps principles
DevOps joins development and operations through automation, shared responsibility, short feedback loops and continuous improvement. It is a culture first and a toolset second.
Example questions
Question 1. A web form places user input directly into a database query string, and an attacker enters text that changes the query. Which threat is this, and what is the best defence?
- A. XSS; encode output
- B. CSRF; use anti-CSRF tokens
- C. Brute force; encrypt the database
- D. SQL injection; use parameterised queries
Show answer
Answer: D
Input that alters a database query is SQL injection, and parameterised queries separate data from the query. XSS involves scripts executing in a browser, and the defence is output encoding. CSRF abuses a logged-in session and is countered with anti-CSRF tokens. Encrypting the database does not stop a malicious query from running.
Want more questions like this? Full 200-901 practice tests →
Question 2. A Dockerfile contains the line EXPOSE 5000 and the image is named myapp. Which command makes the app reachable on port 8080 of the host?
- A. docker build -p 8080 myapp
- B. docker run -p 8080:5000 myapp
- C. docker ps -p 5000:8080
- D. docker run myapp, because EXPOSE publishes the port
Show answer
Answer: B
The -p option maps a host port to a container port, so 8080:5000 publishes container port 5000 on host port 8080. EXPOSE alone documents the port but does not publish it. docker build creates an image and does not run it. docker ps only lists running containers.
Want more questions like this? Full 200-901 practice tests →
Question 3. A team stores an API token in a file committed to a public repository. What is the best course of action?
- A. Delete the file in a new commit
- B. Base64-encode the token in the file
- C. Revoke and rotate the token, then store secrets outside the repository
- D. Replace the token with a longer one in the same file
Show answer
Answer: C
Once a secret is public it must be treated as compromised: revoke and rotate it, then keep secrets out of source control using environment variables or a secrets manager. Deleting the file in a later commit leaves the token in the history. Base64 encoding is not protection. Making the token longer does not help once it is exposed.
Want more questions like this? Full 200-901 practice tests →
Next: infrastructure and automation. For where applications meet network paths, see network fundamentals.