Docker DCA Online Practice Questions and Exam Preparation

Docker DCA Online Questions & Answers

• Question 1:

  When an application being managed by UCP fails, you would like a summary of all requests made to the UCP API in the hours leading up to the failure. What must be configured correctly beforehand for this to be possible?

  A. UCP audit logs must be set to the metadata' or request' level.
  B. UCP logging levels must be set to the info' or debug' level.
  C. All engines in the cluster must have their log driver set to the metadata' or request' level.
  D. Set the logging level in theconfig object for the ucp-kube-api-server container to warning or higher.
  A. UCP audit logs must be set to the metadata' or request' level.

• Question 2:

  Two development teams in your organization use Kubernetes and want to deploy their applications while ensuring that Kubernetes-specific resources, such as secrets, are grouped together for each application.

  Is this a way to accomplish this?

  Solution: Create one pod and add all the resources needed for each application

  A. Yes
  B. No
  B. No

  ---

  Explanation/Reference:

  his is not a way to accomplish this, because creating one pod and adding all the resources needed for each application is not a good practice for deploying applications in Kubernetes. According to the official documentation, pods are not intended to run multiple instances of an application or different applications that are tightly coupled. Pods are also not meant to hold resources that are shared across applications, such as secrets or configMaps.

• Question 3:

  Will this command list all nodes in a swarm cluster from the command line? Solution: `docker Is -a'

  A. Yes
  B. No
  B. No

  ---

  Explanation/Reference:

  Using `docker ls -a' does not list all nodes in a swarm cluster from the command line. The docker ls command is not a valid command. To list containers, you need to use `docker container ls' or `docker ps'. To list images, you need to use `docker image ls' or `docker images'. To list nodes in a swarm cluster, you need to use `docker node ls'.

• Question 4:

  What is the purpose of a client bundle in the Universal Control Plane?

  A. Authenticate a user using client certificates to the Universal Control Plane
  B. Provide a new user instructions for how to login to the Universal Control Plane
  C. Provide a user with a Docker client binary compatible with the Universal Control Plane
  D. Group multiple users in a team in the Universal Control Plane
  A. Authenticate a user using client certificates to the Universal Control Plane

• Question 5:

  A service 'wordpress' is running using a password string to connect to a non-Dockerized database service. The password string is passed into the 'wordpress' service as a Docker secret. Per security policy, the password on the database was changed. Identity the correct sequence of steps to rotate the secret from the old password to the new password.

  A. Create a new docker secret with the new password. Trigger a rolling secret update by using the 'docker secret update' command
  B. Trigger an update to the service by using 'docker service update --secret='
  C. Create a new docker secret with the new password. Remove the existing service using 'docker service rm'. Start a new service with the new secret using "--secret="
  D. Create a new docker secret with a new password. Trigger a rolling update of the "wordpress" service, by using "--secret-rm" and "--secret-add" to remove the old secret and add the updated secret.
  D. Create a new docker secret with a new password. Trigger a rolling update of the "wordpress" service, by using "--secret-rm" and "--secret-add" to remove the old secret and add the updated secret.

• Question 6:

  During development of an application meant to be orchestrated by Kubemetes, you want to mount the /data directory on your laptop into a container.

  Will this strategy successfully accomplish this?

  Solution: Create a Persistent VolumeClaim requesting storageClass:"" (which defaults to local storage) and hostPath and use this to populate a volume in a pod.

  A. Yes
  B. No
  A. Yes

  ---

  Explanation/Reference:

  This strategy does successfully mount the /data directory on your laptop into a container. Creating a persistentVolumeClaim requesting storageClass:"" (which defaults to local storage) and hostPath and using this to populate a volume in a pod is a valid way to mount a host directory into a container in Kubernetes. A persistentVolumeClaim is a request for storage by a user or an application. A persistentVolume is an abstraction that represents a piece of storage in the cluster. A storageClass is a type of storage with a specific provisioner and parameters. A hostPath volume allows you to mount a file or directory from the host node's filesystem into your pod. A local volume allows you to mount local storage devices such as disks or partitions into your pod. By creating a persistentVolumeClaim with storageClass:"" and hostPath, you are requesting a piece of storage that is backed by a hostPath volume on the node where the pod is scheduled. By using this persistentVolumeClaim to populate a volume in a pod, you are mounting the host directory into the container in the pod.

• Question 7:

  Two pods bear the same label, app: dev.

  Will a label selector matching app: dev match both of these pods?

  A. Yes, as long as all the containers in those pods are passing their livenessProbes and readinessProbes.
  B. Yes, if both pods were pre-existing when the label selector was declared.
  C. Yes, if the pods are in the same Kubernetes namespace as the object bearing the label selector
  D. Yes, if the pods are in the same Kubernetes namespace as the object bearing the label selector and both pods were preexisting when the label selector was declared.
  D. Yes, if the pods are in the same Kubernetes namespace as the object bearing the label selector and both pods were preexisting when the label selector was declared.

• Question 8:

  A company's security policy specifies that development and production containers must run on separate nodes in a given Swarm cluster.

  Can this be used to schedule containers to meet the security policy requirements?

  Solution: label contraints

  A. Yes
  B. No
  A. Yes

  ---

  Explanation/Reference:

  Label constraints can be used to schedule containers to meet the security policy requirements. Label constraints are expressions that match node labels to service labels. Node labels are key-value pairs that can be attached to nodes to identify them by certain characteristics, such as role, environment, region, etc. Service labels are key-value pairs that can be attached to services to specify scheduling preferences or requirements, such as node.role == manager or environment != production. Label constraints can be used with the --constraint flag when creating or updating a service to ensure that the service's containers are scheduled on nodes that match the specified criteria.

• Question 9:

  During development of an application meant to be orchestrated by Kubernetes, you want to mount the /data directory on your laptop into a container.

  Will this strategy successfully accomplish this?

  Solution: Add a volume to the pod that sets hostPath.path: /data, and then mount this volume into the pod's containers as desired.

  A. Yes
  B. No
  A. Yes

  ---

  Explanation/Reference:

  Adding a volume to the pod that sets hostPath.path: /data, and then mounting this volume into the pod's containers as desired is a strategy that successfully accomplishes this. A hostPath volume mounts a file or directory from the host node's

  filesystem into a pod. It can be used to access files on the host from a container, such as configuration files, logs, binaries, etc. However, this type of volume is not portable across nodes and should be used with caution. References:

  https://kubernetes.io/docs/concepts/storage/volumes/#hostpath,

  https://kubernetes.io/docs/tasks/configure-pod-container/configure-volume-storage/

• Question 10:

  Is this a way to configure the Docker engine to use a registry without a trusted TLS certificate?

  Solution: Set and export the IGNORE_TLS environment variable on the command line.

  A. Yes
  B. No
  B. No

  ---

  Explanation/Reference:

  Setting and exporting the IGNORE_TLS environment variable on the command line is not a way to configure the Docker engine to use a registry without a trusted TLS certificate. The IGNORE_TLS environment variable is not recognized by Docker and has no effect on its behavior. To configure the Docker engine to use a registry without a trusted TLS certificate, you need to either set INSECURE_REGISTRY in the /etc/docker/default configuration file or add --insecure-registry flag to the dockerd command.