I85PREP
⌘ K
PE Software study materials
PE Software study resources

PE Software practice questions

One question at a time. Build your PE Software understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Software engineering (official domain list not enumerated in source)

In a software engineering context, which statement best describes the purpose of a configuration management plan?

  1. It lists the hardware serial numbers of developer workstations only.
  2. It defines how versions of work products are identified, controlled, and audited across the project lifecycle. Correct answer.
  3. It records the personal vacation schedule of each developer on the team.
  4. It specifies the marketing budget for the product launch campaign.

Explanation

A configuration management plan establishes how configuration items are identified, baselined, change-controlled, and audited so that the team can reconstruct any released version. It is a lifecycle-wide process document, not a schedule or asset inventory.

Question 2Software engineering (official domain list not enumerated in source)

A team wants a review in which one or more colleagues other than the author examine a work product against defined criteria. Which software engineering activity does this describe?

  1. Requirements elicitation with end users
  2. Regression testing of the deployed build
  3. Formal technical review of the codebase architecture
  4. Peer review of a software work product Correct answer.

Explanation

Peer review is the examination of a work product by colleagues of the author to find defects against defined criteria. It is distinct from testing executed builds and from gathering requirements from stakeholders.

Question 3Software engineering (official domain list not enumerated in source)

Which software development life cycle model delivers functionality in short, fixed-length iterations with a potentially shippable increment at the end of each?

  1. V-model
  2. Big-bang deployment model
  3. Agile iterative-incremental approach Correct answer.
  4. Waterfall model

Explanation

Agile approaches use short timeboxed iterations that each produce a potentially releasable increment, allowing feedback and adaptation. Waterfall and V-models sequence phases with later integration, and big-bang is a deployment pattern rather than a lifecycle.

Question 4Software engineering (official domain list not enumerated in source)

In requirements engineering, what distinguishes a functional requirement from a non-functional requirement?

  1. A functional requirement is always mandatory, while a non-functional requirement is always optional.
  2. A functional requirement states a behavior or service the system must provide, while a non-functional requirement states a quality or constraint. Correct answer.
  3. A functional requirement applies only to hardware, while a non-functional requirement applies only to software.
  4. A functional requirement is written by testers, while a non-functional requirement is written by users.

Explanation

Functional requirements describe what the system does, such as services and behaviors, whereas non-functional requirements describe qualities and constraints like performance, security, or usability. Both types are typically mandatory and may be authored by many roles.

Question 5Software engineering (official domain list not enumerated in source)

What is the primary purpose of a software unit test?

  1. To validate the entire system against user acceptance criteria
  2. To document the deployment topology of the production environment
  3. To verify the behavior of an individual component in isolation from the rest of the system Correct answer.
  4. To measure the throughput of the production database under load

Explanation

Unit tests exercise a single component or function in isolation, using stubs or mocks for collaborators, to pinpoint defects early. System-level validation and performance measurement are handled by other test levels.

Question 6Software engineering (official domain list not enumerated in source)

Which activity in software engineering is concerned with identifying the modules, their responsibilities, and the interfaces between them?

  1. Software design Correct answer.
  2. Capacity planning
  3. Project procurement
  4. Incident triage

Explanation

Software design decomposes the system into modules, assigns responsibilities, and defines interfaces and interactions. Procurement, triage, and capacity planning belong to other management or operations disciplines.

Question 7Software engineering (official domain list not enumerated in source)

What does a version control system primarily enable a software team to do?

  1. Replace the need for any testing before release
  2. Guarantee that no defects are introduced into the codebase
  3. Automatically generate user documentation from interviews
  4. Track and manage changes to source files over time with history and branching Correct answer.

Explanation

Version control records the history of changes to files, supports branching and merging, and lets teams recover or compare revisions. It does not generate documentation from interviews, replace testing, or guarantee defect-free code.

Question 8Software engineering (official domain list not enumerated in source)

In software engineering terminology, what is a software baseline?

  1. A temporary branch created only for developer experimentation
  2. A performance benchmark run against production servers
  3. A formally approved and fixed version of a configuration item that serves as a reference for further development Correct answer.
  4. A list of open defects awaiting triage by the team

Explanation

A baseline is a formally reviewed and approved configuration that becomes the reference point for subsequent changes. Changes to a baseline go through change control, distinguishing it from scratch branches, benchmarks, or defect lists.

Question 9Software engineering (official domain list not enumerated in source)

A development team adopts continuous integration. Which practice is most characteristic of this approach?

  1. Integrating code changes into a shared mainline frequently and running automated builds and tests on each integration Correct answer.
  2. Freezing the mainline for months while developers work in isolation
  3. Deploying directly to production without any automated checks
  4. Requiring manual approval for every single source file commit

Explanation

Continuous integration means developers merge to a shared mainline frequently, and each merge triggers automated build and test feedback. Long freezes, unchecked production deploys, and per-file manual gates run counter to the practice.

Question 10Software engineering (official domain list not enumerated in source)

During a code review, a reviewer finds that a function handles user input without validating its length before copying it into a fixed-size buffer. Which defect category best describes this finding?

  1. Missing unit test coverage
  2. Incomplete API documentation
  3. Inconsistent naming convention
  4. Buffer overflow risk Correct answer.

Explanation

Copying unvalidated input into a fixed-size buffer can write beyond the buffer bounds, a classic buffer overflow vulnerability. Naming, documentation, and test coverage concerns are quality issues but not the memory-safety defect described.

Question 11Software engineering (official domain list not enumerated in source)

A team must choose a design pattern so that a family of related algorithms can be selected at runtime without modifying client code. Which pattern most directly fits this need?

  1. Adapter pattern
  2. Singleton pattern
  3. Facade pattern
  4. Strategy pattern Correct answer.

Explanation

The Strategy pattern encapsulates a family of interchangeable algorithms behind a common interface, letting clients switch behavior at runtime. Singleton controls instance count, Facade simplifies a subsystem interface, and Adapter converts interfaces.

Question 12Software engineering (official domain list not enumerated in source)

A product owner asks how much work the team can complete in the next two-week iteration. Which metric is designed to answer that question?

  1. Code coverage measured per module
  2. Defect escape rate measured per release
  3. Mean time to recovery measured per incident
  4. Velocity measured as completed work per iteration Correct answer.

Explanation

Velocity tracks the amount of work completed per iteration and supports short-term forecasting of capacity. Defect escape rate, recovery time, and coverage measure quality or reliability rather than iteration throughput.

Question 13Software engineering (official domain list not enumerated in source)

A requirements specification contains the statement: 'The system shall respond to user queries within 2 seconds for 95 percent of requests.' How should this statement be classified?

  1. A non-functional requirement Correct answer.
  2. A functional requirement
  3. A business constraint
  4. A design constraint

Explanation

The statement specifies a measurable performance quality rather than a behavior or service, making it a non-functional requirement. It is not a business rule or a design decision, though it may influence design.

Question 14Software engineering (official domain list not enumerated in source)

A team uses a test-driven development cycle. Which sequence correctly reflects the TDD workflow?

  1. Write all production code, then write tests afterward, then refactor
  2. Write a failing test, write the minimal code to pass it, then refactor Correct answer.
  3. Write documentation, then write tests, then delete the documentation
  4. Run the full system test suite, then write unit tests, then deploy

Explanation

TDD is a red-green-refactor cycle: a test is written first and fails, minimal code makes it pass, and then the code is refactored with the test as a safety net. Writing code before tests is a test-after approach.

Question 15Software engineering (official domain list not enumerated in source)

In a system with a microservices architecture, which approach most directly reduces the impact of a single service failure on the whole system?

  1. Increasing the deployment frequency of all services equally
  2. Removing health checks from each service to reduce overhead
  3. Applying a circuit breaker that stops calls to a failing dependency and returns a fallback Correct answer.
  4. Sharing a single database schema across every service

Explanation

A circuit breaker detects repeated failures in a dependency and short-circuits calls, returning a fallback until the dependency recovers, which contains failure propagation. Shared schemas and removed health checks tend to increase coupling and reduce detection.

Question 16Software engineering (official domain list not enumerated in source)

A software engineer is asked to estimate a task using three-point estimation. Which inputs does this technique require?

  1. Optimistic, most likely, and pessimistic estimates Correct answer.
  2. Story points, velocity, and sprint length
  3. Defect count, severity, and priority
  4. Lines of code, cyclomatic complexity, and coverage

Explanation

Three-point estimation combines optimistic, most likely, and pessimistic values, often via a weighted average, to reflect uncertainty. The other option sets describe different metrics and do not form the technique's inputs.

Question 17Software engineering (official domain list not enumerated in source)

A code review identifies duplicate logic across three modules that compute the same tax rule. Which refactoring most directly addresses this?

  1. Increase the cyclomatic complexity threshold in the static analysis tool
  2. Extract the duplicated logic into a single shared function and call it from each module Correct answer.
  3. Add comments in each module explaining that the logic is duplicated
  4. Rename the three modules so that their names are more similar

Explanation

Extracting the duplicated logic into one shared function removes the duplication and creates a single point of change. Renaming, commenting, or loosening thresholds leave the duplication in place.

Question 18Software engineering (official domain list not enumerated in source)

A team is selecting a testing level to verify that individually tested modules interact correctly through their interfaces. Which level applies?

  1. Integration testing Correct answer.
  2. Acceptance testing
  3. Unit testing
  4. Static analysis

Explanation

Integration testing focuses on the interfaces and interactions between combined components after unit testing. Unit testing covers individual components, acceptance testing validates user needs, and static analysis inspects code without executing it.

Question 19Software engineering (official domain list not enumerated in source)

In a risk-driven software process, what is the main reason to prioritize architectural prototyping early?

  1. It guarantees that no requirements will change later
  2. It removes the need for any integration testing
  3. It exposes high-impact technical risks while changes are still inexpensive Correct answer.
  4. It allows the team to skip the design phase entirely

Explanation

Early architectural prototypes address the highest technical risks when design changes are cheap, informing decisions before large investments are made. They cannot freeze requirements, replace integration testing, or eliminate design work.

Question 20Software engineering (official domain list not enumerated in source)

A team wants to ensure that a build is reproducible from source at any time. Which practice contributes most directly?

  1. Building only from developers' local working copies
  2. Tagging each release in version control and building from that tagged revision with pinned dependencies Correct answer.
  3. Allowing dependency versions to float to the latest available release
  4. Storing build outputs only on one developer's laptop

Explanation

Reproducible builds require a known source revision, such as a release tag, together with pinned dependency versions so that the same inputs yield the same outputs. Local-only builds and floating dependencies introduce variability.

Question 21Software engineering (official domain list not enumerated in source)

An engineer notices that a function has a cyclomatic complexity of 45 and contains deeply nested conditionals. Which action best follows established software engineering guidance?

  1. Remove the existing tests so that refactoring is faster
  2. Leave the function unchanged because high complexity indicates thorough logic
  3. Decompose the function into smaller functions with clearer control flow and add tests around each Correct answer.
  4. Increase the function length to consolidate all related branches

Explanation

Very high cyclomatic complexity makes code hard to test and maintain, so decomposing it into smaller units with focused tests improves comprehension and defect detection. Adding branches or removing tests worsens the situation.

Question 22Software engineering (official domain list not enumerated in source)

A team observes that defects found in production are rarely caught by their automated tests. Which root-cause analysis is most consistent with this observation?

  1. The version control system records too much history
  2. The deployment pipeline uses too many environments
  3. The tests emphasize happy-path unit cases and lack coverage of boundary and integration scenarios Correct answer.
  4. The team runs too many tests during continuous integration

Explanation

When production defects escape automated tests, a common cause is test suites that exercise only nominal paths and omit boundary conditions and integration behavior. Excessive testing, version history, and environment count do not explain missed defects.

Question 23Software engineering (official domain list not enumerated in source)

A system must remain available during rolling upgrades of its services. Which design property most directly supports this requirement?

  1. Manual deployment windows requiring full system shutdown
  2. Stateless service instances that can be replaced independently behind a load balancer Correct answer.
  3. A single monolithic process holding all session state in memory
  4. Hard-coded service addresses in every client

Explanation

Stateless instances can be drained and replaced one at a time behind a load balancer, allowing continuous availability during upgrades. Monolithic in-memory state, full shutdowns, and hard-coded addresses all impede rolling replacement.

Question 24Software engineering (official domain list not enumerated in source)

A team is deciding between a heavyweight formal inspection and a lightweight pull-request review for a safety-critical module. Which consideration most strongly favors formal inspection?

  1. The desire to reduce the number of reviewers involved
  2. The preference for reviewing only after deployment
  3. The need for documented, structured defect detection with defined roles and recorded findings Correct answer.
  4. The goal of eliminating all documentation from the process

Explanation

Formal inspections provide structured, documented defect detection with defined roles, entry criteria, and recorded results, which supports safety-critical assurance. Reducing reviewers, deferring review, or removing documentation works against that goal.

Question 25Software engineering (official domain list not enumerated in source)

During requirements analysis, two stakeholders state conflicting expectations about how the system should handle duplicate submissions. Which action is most appropriate for the requirements engineer?

  1. Document both conflicting statements without resolution and proceed to design
  2. Silently choose the interpretation preferred by the more senior stakeholder
  3. Facilitate negotiation to reach an agreed resolution and record the decision with its rationale Correct answer.
  4. Defer the conflict to the testing phase for resolution

Explanation

Conflicting requirements should be surfaced and resolved through stakeholder negotiation, with the agreed decision and rationale recorded for traceability. Silent selection, unresolved documentation, or deferral to testing leaves ambiguity that propagates downstream.

Question 26Software engineering (official domain list not enumerated in source)

Which software process model is characterized by delivering the product in short, time-boxed iterations with continuous stakeholder feedback?

  1. V-Model
  2. Agile Correct answer.
  3. Big Design Up Front
  4. Waterfall

Explanation

Agile processes deliver working software in short, fixed-length iterations and rely on frequent stakeholder feedback to adapt requirements. Waterfall, the V-Model, and Big Design Up Front all emphasize extensive upfront specification before development begins.

Question 27Software engineering (official domain list not enumerated in source)

In software configuration management, what does a change control board (CCB) primarily do?

  1. Negotiate contract terms with the customer
  2. Run the automated regression test suite
  3. Write the source code for approved change requests
  4. Review and approve or reject proposed changes to baselined items Correct answer.

Explanation

A change control board is a group that evaluates proposed changes to baselined configuration items and decides whether they are approved, deferred, or rejected. It governs change; it does not implement code or execute tests itself.

Question 28Software engineering (official domain list not enumerated in source)

Which document type specifies what the software must do without prescribing how it will be implemented?

  1. Software requirements specification Correct answer.
  2. Source code listing
  3. Test log
  4. Software design description

Explanation

A software requirements specification captures the required behavior and constraints of the system, staying implementation-independent. Design descriptions and code describe the how, not the what.

Question 29Software engineering (official domain list not enumerated in source)

Which metric measures the proportion of statements executed by a test suite?

  1. Defect density
  2. Function points
  3. Mean time between failures
  4. Statement coverage Correct answer.

Explanation

Statement coverage counts how many executable statements a test suite exercises, expressed as a percentage of the total. Defect density and mean time between failures measure quality over time, and function points measure size.

Question 30Software engineering (official domain list not enumerated in source)

Which versioning convention conveys that a change may break existing API consumers?

  1. A major-level increment Correct answer.
  2. A patch-level increment
  3. A minor-level increment
  4. A build metadata suffix

Explanation

Under semantic versioning, the major number increments when backward-incompatible changes are introduced. Patch and minor increments signal compatible fixes or additions, and build metadata carries no compatibility meaning.

Question 31Software engineering (official domain list not enumerated in source)

In a Git-based workflow, what is the primary purpose of a feature branch?

  1. To permanently store release binaries
  2. To replace the need for code review
  3. To isolate work in progress so it does not destabilize the mainline Correct answer.
  4. To run production traffic

Explanation

A feature branch isolates development work so unfinished or experimental changes do not affect the shared mainline until they are reviewed and merged. It does not eliminate review and is not a runtime or artifact store.

Question 32Software engineering (official domain list not enumerated in source)

Which design principle states that a class should have only one reason to change?

  1. Interface segregation principle
  2. Liskov substitution principle
  3. Open-closed principle
  4. Single responsibility principle Correct answer.

Explanation

The single responsibility principle holds that a module should have one reason to change, meaning one cohesive responsibility. The other principles address extensibility, substitutability, and interface granularity.

Question 33Software engineering (official domain list not enumerated in source)

What does a software build pipeline typically produce from source code?

  1. A compiled and packaged artifact Correct answer.
  2. A requirements specification
  3. A project schedule
  4. A risk register

Explanation

A build pipeline compiles, tests, and packages source code into an artifact such as a binary or container image. Specifications, risk registers, and schedules are project artifacts, not build outputs.

Question 34Software engineering (official domain list not enumerated in source)

A team must guarantee that a critical transaction either fully commits or leaves no partial state. Which property of ACID transactions provides this guarantee?

  1. Durability
  2. Atomicity Correct answer.
  3. Consistency
  4. Isolation

Explanation

Atomicity ensures a transaction is treated as an indivisible unit: either all its effects are applied or none are. Durability concerns persistence after commit, isolation concerns concurrent visibility, and consistency concerns invariant preservation.

Question 35Software engineering (official domain list not enumerated in source)

An engineer applies the Strategy pattern to a payment module. Which outcome most directly indicates the pattern was applied correctly?

  1. A new payment provider can be added by implementing the interface without editing existing client code Correct answer.
  2. Payment logic is duplicated in each provider class
  3. The client contains a large switch statement over provider types
  4. All providers share a single mutable global configuration object

Explanation

The Strategy pattern encapsulates interchangeable algorithms behind a common interface so new strategies can be added without modifying the client. A large conditional in the client or duplicated logic indicates the pattern was not applied properly.

Question 36Software engineering (official domain list not enumerated in source)

A team estimates a story at 5 story points, and their average velocity is 30 points per two-week iteration. How many stories of this size can they roughly plan for one iteration?

  1. 6 Correct answer.
  2. 15
  3. 3
  4. 30

Explanation

Dividing the velocity of 30 points by the 5-point story size yields about 6 stories per iteration. This assumes the story size is representative and the velocity estimate is stable.

Question 37Software engineering (official domain list not enumerated in source)

A team wants to detect integration defects early. Which practice most directly achieves this?

  1. Running automated integration tests in the pipeline on every commit Correct answer.
  2. Increasing the length of the release cycle
  3. Deferring all integration testing to the acceptance phase
  4. Reducing the number of test environments

Explanation

Continuous automated integration testing on every commit exposes interface mismatches soon after they are introduced. Longer cycles, fewer environments, and deferred testing all delay detection.

Question 38Software engineering (official domain list not enumerated in source)

A distributed service must tolerate the loss of one node without losing data. Which technique most directly provides this?

  1. Replicating data across multiple nodes with a consensus protocol Correct answer.
  2. Adding a single point of failure in the load balancer
  3. Caching responses at the client
  4. Compressing the data on disk

Explanation

Replication combined with a consensus protocol lets the system keep serving and preserve data when a node fails. Client caching, compression, and introducing a single point of failure do not provide fault tolerance for node loss.

Question 39Software engineering (official domain list not enumerated in source)

A legacy module has no automated tests. Before refactoring it, which step best reduces regression risk?

  1. Increase the code coverage threshold without adding tests
  2. Rewrite it from scratch immediately
  3. Delete the module and observe what breaks
  4. Characterize its current behavior with tests that capture observed outputs Correct answer.

Explanation

Writing characterization tests that pin down the current behavior creates a safety net so refactoring can proceed without silently changing observable results. A rewrite or deletion loses that safety net, and raising a threshold without tests changes nothing.

Question 40Software engineering (official domain list not enumerated in source)

An interface is exposed to external clients and must evolve without breaking them. Which approach best supports this?

  1. Removing fields immediately when internal code no longer uses them
  2. Silently changing the response format
  3. Reusing an existing field name for a different meaning
  4. Additive changes with a documented deprecation period for removed fields Correct answer.

Explanation

Backward-compatible evolution favors additive changes and a documented deprecation window before removals so clients can adapt. Immediate removal, field reuse, and silent format changes break existing consumers.

Question 41Software engineering (official domain list not enumerated in source)

A team adopts trunk-based development. Which practice is most consistent with it?

  1. Long-lived feature branches merged only at release
  2. A separate branch per environment
  3. Short-lived branches merged frequently into a shared mainline Correct answer.
  4. One branch per developer kept indefinitely

Explanation

Trunk-based development keeps branches short-lived and integrates frequently into a shared mainline to reduce merge pain and integration risk. Long-lived or per-environment branches contradict the model.

Question 42Software engineering (official domain list not enumerated in source)

A team wants to reduce the blast radius of a faulty deployment. Which technique most directly achieves this?

  1. A single all-at-once deployment to all users
  2. Disabling rollback capability
  3. Canary release to a small subset of traffic Correct answer.
  4. Removing monitoring from the new release

Explanation

A canary release exposes the new version to a small fraction of traffic so problems are detected before full rollout, limiting impact. All-at-once deployment, reduced monitoring, and disabled rollback all increase the blast radius.

Question 43Software engineering (official domain list not enumerated in source)

A team must estimate a novel task with high uncertainty. Which approach best captures that uncertainty?

  1. A single deterministic estimate
  2. Ignoring the task in the plan
  3. Estimating only the optimistic case
  4. A three-point estimate covering optimistic, most likely, and pessimistic values Correct answer.

Explanation

Three-point estimation uses optimistic, most likely, and pessimistic values to model uncertainty and produce an expected value with a spread. A single value hides uncertainty, and using only the optimistic case systematically underestimates.

Question 44Software engineering (official domain list not enumerated in source)

A reviewer notices that a method takes five boolean parameters controlling its behavior. Which refactoring most directly improves clarity?

  1. Rename the method to a longer name
  2. Replace the boolean parameters with an explicit parameter object or separate methods Correct answer.
  3. Inline the method into its callers
  4. Add more boolean parameters to cover remaining cases

Explanation

Boolean parameters obscure intent and multiply the method's behavior space; replacing them with an explicit parameter object or dedicated methods makes each call self-describing. Adding more flags worsens the problem, and inlining or renaming does not address it.

Question 45Software engineering (official domain list not enumerated in source)

A team debates whether to adopt a static analysis tool. Which benefit most directly justifies it?

  1. Detecting certain defect patterns before code is executed Correct answer.
  2. Guaranteeing the absence of all defects
  3. Eliminating the need for testing
  4. Replacing the need for human code review

Explanation

Static analysis inspects source code without executing it and can flag patterns such as null dereferences or unused variables early. It cannot prove the absence of all defects, nor does it replace review or testing.

Question 46Software engineering (official domain list not enumerated in source)

A team must choose a testing level to verify that a single class behaves correctly in isolation. Which level applies?

  1. Integration testing
  2. Unit testing Correct answer.
  3. System testing
  4. Acceptance testing

Explanation

Unit testing verifies individual components such as a class or function in isolation, often with dependencies stubbed. System and acceptance testing exercise the whole product, and integration testing focuses on interactions between components.

Question 47Software engineering (official domain list not enumerated in source)

A team observes that their automated tests pass but production incidents keep occurring due to untested configuration paths. Which action best addresses the root cause?

  1. Increase the number of unit tests for pure functions
  2. Remove configuration from the deployment process
  3. Shorten the test suite runtime
  4. Add tests that exercise configuration variations in a production-like environment Correct answer.

Explanation

The gap is in configuration coverage, so tests must exercise configuration variations under production-like conditions. Adding more pure-function unit tests or shortening the suite does not cover the untested paths, and removing configuration is not feasible.

Question 48Software engineering (official domain list not enumerated in source)

A system must remain correct when two services update shared data concurrently. Which mechanism most directly prevents lost updates?

  1. Logging every update without checking versions
  2. Caching the data in each service
  3. Increasing the request timeout
  4. Optimistic concurrency control with version checks Correct answer.

Explanation

Optimistic concurrency control compares a version or timestamp before committing, so a concurrent modification causes the stale update to fail rather than overwrite newer data. Caching, logging alone, and timeouts do not prevent lost updates.

Question 49Software engineering (official domain list not enumerated in source)

A safety-critical project requires the most rigorous defect detection for a key module. Which review approach is most appropriate?

  1. An informal desk check by the author alone
  2. Skipping review because the module is small
  3. A formal inspection with defined roles, entry criteria, and recorded findings Correct answer.
  4. A quick read-through during a stand-up meeting

Explanation

Formal inspection uses defined roles, checklists, entry criteria, and recorded findings, making it the most rigorous review technique. Informal desk checks and cursory reads lack the structure needed for safety-critical assurance.

Question 50Software engineering (official domain list not enumerated in source)

A team must ensure that a container image deployed to production is exactly the one that passed testing. Which practice most directly provides this?

  1. Rebuilding the image separately in each environment
  2. Promoting the same immutable image digest through each environment Correct answer.
  3. Copying source code to production servers and compiling there
  4. Tagging images with the mutable 'latest' tag

Explanation

Promoting an immutable image identified by digest guarantees the tested artifact is the one deployed. Rebuilding per environment, mutable tags, and compiling in production all introduce drift between what was tested and what runs.