I85PREP
⌘ K
Cisco 350-901 DEVCOR/AUTOCOR study materials
Cisco 350-901 DEVCOR/AUTOCOR study resources

Cisco 350-901 DEVCOR/AUTOCOR: Application Deployment and Security

Cisco 350-901 DEVCOR/AUTOCOR · Work through your exam, one topic at a time.

All guide sections

Application Deployment and Security

Domain 4 tests shipping applications repeatably and securing them end to end. Deployment questions focus on artifacts, pipelines, containers, and release patterns; security questions focus on secrets, tokens, TLS, and validation.

Deployment rules

  • Build once and promote the same artifact. Use immutable tags or image digests, not latest.
  • Containers: minimal base images, non-root users, image scanning, and read-only filesystems where possible. Kubernetes Secrets are base64-encoded, not encrypted by default; use an external secret manager or KMS.
  • CI/CD gates: unit and contract tests, SAST, dependency and image scanning, and DAST. Separate build credentials from deploy credentials.
  • Release patterns: rolling, blue-green, and canary. Define rollback before deployment.
  • Infrastructure as code: Terraform state should be remote and locked; Ansible tasks should be idempotent; configuration belongs in environment variables or a secret store.

Security rules

  • Verify TLS certificates; never disable verification to make a client work.
  • OAuth scopes should be least privilege; tokens should be short-lived and rotated.
  • Validate JWTs properly: read the kid, fetch the identity provider's JWKS, verify the signature, then check iss, aud, exp, and nbf. Reject alg: none and unsigned tokens.
  • Authenticate and authorize separately: a valid token does not mean the caller has the required scope or role.
  • Validate input, encode output, parameterize queries, and rate-limit sensitive endpoints.
  • Secrets must not appear in Git, images, logs, or query strings.

Worked example

An API receives Authorization: Bearer <JWT>. Reasoning: decode the header only to find kid; do not trust the payload yet. Fetch the matching JWKS public key, verify the RS256 signature, then check iss, aud, and exp. If verification fails, return 401. If the token is valid but lacks read:devices, return 403. Only then read sub and scopes for authorization.

Traps

  • Decoding a JWT without verifying its signature.
  • Treating Kubernetes Secrets as encrypted at rest by default.
  • Storing credentials in Git, container images, or CI logs.
  • Using cluster-admin or admin credentials for application service accounts.
  • Scanning only after deployment, or tagging images latest in production.