Docker DCA Online Practice Questions and Exam Preparation

Docker DCA Online Questions & Answers

• Question 101:

  You are running only Kubernetes workloads on a worker node that requires maintenance, such as installing patches or an OS upgrade Which command must be run on the node to gracefully terminate all pods on the node, while marking the node as unschedulable?

  A. 'docker node update --availability drain '
  B. 'docker swarm leave'
  C. 'kubectl drain '
  D. 'kubectl cordon '
  D. 'kubectl cordon '

• Question 102:

  What is the docker command to find the current logging driver for a running container?

  A. docker stats
  B. docker info
  C. docker config
  D. docker inspect
  D. docker inspect

• Question 103:

  When using the Docker client to push an image to a registry, what environment variable is used to instruct the client to perform signing of the image?

  A. DOCKER_CONTENT_TRUST=1
  B. DOCKER_IMAGE_SIGN=1
  C. DOCKER_PUSH_SIGN=1
  D. NOTARY_ENABLE=1
  A. DOCKER_CONTENT_TRUST=1

• Question 104:

  Which of the following namespaces is disabled by default and must be enabled at Docker engine runtime in order to be used?

  A. user
  B. pid
  C. net
  D. mnt
  A. user

• Question 105:

  The following Docker Compose file is deployed as a stack:

  

  Is this statement correct about this health check definition?

  Solution: Health checks test for app health ten seconds apart. If the test fails, the container will be restarted three times before it gets rescheduled.

  A. Yes
  B. No
  A. Yes

• Question 106:

  A company's security policy specifies that development and production containers must run on separate nodes in a given Swarm cluster.

  Can this be used to schedule containers to meet the security policy requirements?

  Solution: node taints

  A. Yes
  B. No
  B. No

  ---

  Explanation/Reference:

  Node taints cannot be used to schedule containers to meet the security policy requirements, because node taints are a Kubernetes concept and not a Swarm concept. According to the official documentation, node taints are used to mark nodes with certain attributes that prevent pods from being scheduled on them unless they have matching tolerations.

• Question 107:

  Following the principle of least privilege, which of the following methods can be used to securely grnt access to the specific user to communicate to a Docker engine? (Choose two.)

  A. Utilize the '--host 0.0.0.0:2375' option to the Docker daemon to listen on port 2375 over TCP on all interfaces
  B. Utilize openssl to create TLS client and server certificates, configuring the Docker engine to use with mutual TLS over TCP.
  C. Utilize the '--host 127.0.0.1:2375' option to the Docker daemon to listen on port 2375 over TCP on localhost
  D. Give the user root access to the server to allow them to run Docker commands as root.
  B. Utilize openssl to create TLS client and server certificates, configuring the Docker engine to use with mutual TLS over TCP.

• Question 108:

  Wha is the purpose of Docker Content Trust?

  A. Signing and verification of image tags
  B. Enabling mutual TLS between the Docker client and server
  C. Docker registry TLS verification and encryption
  D. Indicating an image on Docker Hub is an official image
  A. Signing and verification of image tags

• Question 109:

  A Kubernetes node is allocated a /26 CIDR block (64 unique IPs) for its address space.

  If every pod on this node has exactly two containers in it, how many pods can this address space support on this node?

  A. 32
  B. 32 In every Kubernetes namespace
  C. 64 for every service routing to pods on this node
  D. 64
  C. 64 for every service routing to pods on this node

• Question 110:

  Which of the following constitutes a production-ready devicemapper configuration for the Docker engine?

  A. Create a volume group in devicemapper and utilize the '--dm.thinpooldev' Docker daemon option, specifying the volume group
  B. Format a partition with xfs and mount it at '/var/lib/docker'
  C. Utilize the '--storage-opt dm.directlvm_device' Docker daemon option, specifying a block device
  D. Nothing, devicemapper comes ready for production usage out of the box
  C. Utilize the '--storage-opt dm.directlvm_device' Docker daemon option, specifying a block device