Docker DCA Docker Certified Associate Exam Practice Test

Page: 1 / 14
Total 183 questions
Question 1

The Kubernetes yaml shown below describes a networkPolicy.

Will the networkPolicy BLOCK this trafftc?

Solution. a request issued from a pod bearing the tier: api label, to a pod bearing the tier: backend label



Answer : B

The provided Kubernetes NetworkPolicy YAML configuration indicates that the policy applies to pods with the label tier: backend in the default namespace1. The ingress rule allows traffic from pods with the label tier: api1. Therefore, a request issued from a pod bearing the tier: api label to a pod bearing the tier: backend label will not be blocked by this networkPolicy1. This is because the networkPolicy explicitly allows ingress from pods with the tier: api label1. For more information on Kubernetes Network


Question 2

An application image runs in multiple environments, with each environment using different certificates and ports.

Is this a way to provision configuration to containers at runtime?

Solution: Create images that contain the specific configuration for every environment.



Answer : B

= Creating images that contain the specific configuration for every environment is not a way to provision configuration to containers at runtime.This approach violates the principle of separating application code from configuration, and makes the images less portable and reusable across different environments1.It also increases the maintenance overhead and the risk of configuration drift, as any change in the configuration would require rebuilding and redeploying the images2.To provision configuration to containers at runtime, you should use a different mechanism, such as environment variables, command-line arguments, or config maps345.Reference:

Configuration management with Containers | Kubernetes

Environment variables in Compose | Docker Docs

Override the default command | Docker Docs

Configuration management with Containers | Kubernetes


Question 3

Is this a type of Linux kernel namespace that provides container isolation?

Solution. Host



Answer : B

= Host is not a type of Linux kernel namespace that provides container isolation.Linux namespaces are a feature of the Linux kernel that partitions kernel resources such that one set of processes sees one set of resources while another set of processes sees a different set of resources1.There are eight kinds of namespaces available: Mount, Process, User, Network, UTS, IPC, Cgroup, and Time1.Host is a parameter that can be used to run a container in the host's network namespace, which means the container shares the same network interfaces and configuration as the host2.Reference:

Linux namespaces - Wikipedia

Network settings | Docker Documentation


Question 4

You configure a local Docker engine to enforce content trust by setting the environment variable

DOCKER_CONTENT_TRUST=1.

If myorg/myimage: 1.0 is unsigned, does Docker block this command?

Solution: docker container run myorg/myimage:1.0



Answer : A

Docker will block the commanddocker container run myorg/myimage:1.0if the image tagmyorg/myimage:1.0is unsigned and the environment variableDOCKER_CONTENT_TRUST=1is set.The reason is that settingDOCKER_CONTENT_TRUST=1enables Docker Content Trust (DCT), which is a feature that allows users to verify the integrity and publisher of Docker images using digital signatures1. When DCT is enabled, Docker will only pull, run, or build images that have valid signatures.If an image tag is unsigned or has an invalid signature, Docker will reject the operation and display an error message2.Therefore, to run an unsigned image with DCT enabled, you need to either disable DCT by settingDOCKER_CONTENT_TRUST=0or use the--disable-content-trustflag, or sign the image tag with a valid key3.Reference:

Content trust in Docker

Determine if Docker image is signed or unsigned

Signing Images and Enabling Docker Content Trust


Question 5

You configure a local Docker engine to enforce content trust by setting the environment variable

DOCKER_CONTENT_TRUST=1.

If myorg/myimage: 1.0 is unsigned, does Docker block this command?

Solution: docker image inspect myorg/myimage: 1.0



Answer : A

= Docker will block the commanddocker image inspect myorg/myimage: 1.0if the image tag is unsigned and the environment variable DOCKER_CONTENT_TRUST is set to 1.This is because Docker Content Trust (DCT) enables the verification of the integrity and publisher of Docker images using digital signatures1.When DCT is enabled, Docker will only pull, run, or inspect images that have a valid signature2.If the image tag is not signed, Docker will reject the command and display an error message, such asNo valid trust data for 1.03. To inspect an unsigned image, you need to either disable DCT by setting DOCKER_CONTENT_TRUST to 0, or use the--disable-content-trustflag with the command.Reference:

Content trust in Docker | Docker Docs

Enable and disable content trust in Docker | Docker Docs

Docker Content Trust: What It Is and How It Secures Container Images

[docker image inspect | Docker Docs]


Question 6

Is this an advantage of multi-stage builds?

Solution: simultaneously creates and tags multiple images



Answer : B


Question 7

Are these conditions sufficient for Kubernetes to dynamically provision a persistentVolume, assuming there are no limitations on the amount and type of available external storage?

Solution: A persistentVolumeClaim is created that specifies a pre-defined storageClass.



Answer : A

= The conditions are sufficient for Kubernetes to dynamically provision a persistentVolume, because a storageClass defines the provisioner and parameters for creating a volume on-demand. A persistentVolumeClaim that specifies a storageClass triggers the dynamic provisioning process, and Kubernetes will automatically create and bind a persistentVolume that matches the request. This eliminates the need for manual intervention by cluster administrators to provision storage volumes.Reference:

Dynamic Volume Provisioning | Kubernetes

Persistent volumes and dynamic provisioning | Google Kubernetes Engine ...

Dynamic Provisioning and Storage Classes in Kubernetes


Page:    1 / 14   
Total 183 questions