Docker Certified Associate DCA Exam Questions

Answer : B

Creating a Dockerfile for each environment, specifying ports and Docker secrets for certificates is not a way to provision configuration to containers at runtime.A Dockerfile is a text document that contains all the commands a user could call on the command line to assemble an image1. A Dockerfile is used to build an image, not to run a container. Once an image is built, the configuration specified in the Dockerfile cannot be changed at runtime.To provision configuration to containers at runtime, you need to use a different mechanism, such as environment variables, command-line arguments, or config maps234.Reference:

Dockerfile reference | Docker Docs

Environment variables in Compose | Docker Docs

Override the default command | Docker Docs

Configuration management with Containers | Kubernetes

Answer : B

Docker Content Trust (DCT) is a feature that allows users to verify the integrity and publisher of container images they pull or deploy from a registry server, signed on a Notary server12. DCT does not verify or encrypt the Docker registry TLS, which is a separate mechanism for securing the communication between the Docker client and the registry server.The purpose of DCT is to ensure that the images are not tampered with or maliciously modified by anyone other than the original publisher3.Reference:

Content trust in Docker | Docker Docs

Docker Content Trust: What It Is and How It Secures Container Images

Automation with content trust | Docker Docs

Answer : B

Resource reservation is a feature that allows you to specify the amount of CPU and memory resources that a service or a container needs. This helps the scheduler to place the service or the container on a node that has enough available resources. However, resource reservation does not control which node the service or the container runs on, nor does it enforce any separation or isolation between different services or containers. Therefore, resource reservation cannot be used to schedule containers to meet the security policy requirements.

[Reserve compute resources for containers]

[Docker Certified Associate (DCA) Study Guide]

: https://docs.docker.com/config/containers/resource_constraints/

: https://success.docker.com/certification/study-guides/dca-study-guide

Answer : B

The statement doesnotdescribe a node in the context of a swarm mode cluster.A node is a physical or virtual machine running Docker Engine 1.12 or later in swarm mode1.An instance of the Docker CLI connected to the swarm is not a node, but a client that can interact with the swarm through the Docker API2.The Docker CLI can be used to create a swarm, join nodes to a swarm, deploy services to a swarm, and manage swarm behavior3.Reference:How nodes work),Docker CLI),Swarm mode overview)

Answer : B

Creating one pod and adding all the resources needed for each application is not a good way to accomplish the goal of grouping Kubernetes-specific resources for each application.This is because pods are the smallest unit of a Kubernetes application, and they are designed to run a single container or a set of tightly coupled containers that share the same network and storage resources1. Pods are ephemeral and can be created and destroyed by the Kubernetes system at any time. Therefore, putting multiple applications in one pod would make them harder to manage, scale, and update independently.A better way to accomplish the goal is to use namespaces, which are logical clusters within a physical cluster that can isolate resources, policies, and configurationsfor different applications2.Namespaces can also help organize secrets, which are Kubernetes objects that store sensitive information such as passwords, tokens, and keys3.Reference:

Pods | Kubernetes

Namespaces | Kubernetes

Secrets | Kubernetes

Answer : B

While creating a Dockerfile for each environment is a possible solution, it is not the most efficient or scalable way to provision configuration to containers at runtime. Docker provides several mechanisms to inject configuration into containers at runtime, such as environment variables, command line arguments, Docker secrets for sensitive data, or even configuration files mounted as volumes. These methods allow the same Docker image to be used across multipleenvironments, promoting immutability and consistency across your deployments. Creating a separate Dockerfile for each environment would mean maintaining multiple versions of the Dockerfile, which could lead to inconsistencies and is generally not a recommended practice.

Answer : B

The commanddocker container logs nginx --volumeswillnotdisplay a list of volumes for a specific container.Thedocker container logscommand shows the logs of a container, which are usually the standard output and standard error of the main process running in thecontainer1.The--volumesflag is not a valid option for this command, and will result in an error message2.To display a list of volumes for a specific container, you can use thedocker inspectcommand with a filter option, such asdocker inspect -f '{{ .Mounts }}' nginx3.This will show the source, destination, mode, type, and propagation of each volumemounted in the container4.Reference:docker container logs,docker container logs nginx --volumes,docker inspect,docker inspect -f '{{ .Mounts }}' nginx