Mirantis Mirantis Certifications DCA Questions & Answers

• Question 101:

  Will this Linux kernel facility limit a Docker container's access to host resources, such as CPU or memory? Solution: namespaces

  A. Yes

  B. No

  Correct Answer: B

  Using namespaces does not limit a Docker container's access to host resources, such as CPU or memory. Namespaces are a Linux kernel feature that provide isolation and virtualization of system resources for processes. They can be used to create isolated environments for containers that have their own view of system resources, such as process IDs, user IDs, network interfaces, etc. However, they do not control how much resources a container can use or access.

• Question 102:

  Is this a function of UCP?

  Solution: enforces the deployment of signed images to the cluster

  A. Yes

  B. No

  Correct Answer: A

  Enforcing the deployment of signed images to the cluster is a function of UCP. UCP supports image signing and verification using Docker Content Trust, which is a feature that provides the ability to use digital signatures for data sent to and received from remote Docker registries. UCP allows you to configure a policy that requires all images deployed to the cluster to be signed by a trusted authority. This way, you can ensure that only authorized and verified images are used in your applications.

• Question 103:

  Will this command ensure that overlay traffic between service tasks is encrypted? Solution: docker network create -d overlay --secure

  A. Yes

  B. No

  Correct Answer: B

  This command will not ensure that overlay traffic between service tasks is encrypted, because it uses an invalid option for enabling encryption. According to the official documentation, there is no such option as --secure for the docker network create command. The correct option to use is -o encrypted=true.

• Question 104:

  Is this a Linux kernel namespace that is disabled by default and must be enabled at Docker engine runtime to be used? Solution: mnt

  A. Yes

  B. No

  Correct Answer: B

  mnt is not a Linux kernel namespace that is disabled by default and must be enabled at Docker engine runtime to be used. According to the official documentation, mnt is one of the namespaces that are enabled by default when using namespaces for isolation.

• Question 105:

  From a DevOps process standpoint, it is best practice to keep changes to an application in version control. Which of the following will allow changes to a docker Image to be stored in a version control system?

  A. docker commit

  B. docker save

  C. A docker-compose.yml file

  D. A dockerfile

  Correct Answer: A

• Question 106:

  You are troubleshooting a Kubernetes deployment called api, and want to see the events table for this object.

  Does this command display it?

  Solution: kubectl logs deployment api

  A. Yes

  B. No

  Correct Answer: B

  Using kubectl logs deployment api does not display the events table for this object. The kubectl logs command shows the logs of a pod or a container in a pod, but it does not show the events related to the deployment object. To see the events table for this object, you need to use kubectl describe deployment api.

• Question 107:

  Will this sequence of steps completely delete an image from disk in the Docker Trusted Registry? Solution: Delete the image and delete the image repository from Docker Trusted Registry

  A. Yes

  B. No

  Correct Answer: B

  Deleting the image and deleting the image repository from Docker Trusted Registry (DTR) does not completely delete an image from disk in DTR. Deleting an image only removes its tag and association with a repository, but does not delete its underlying layers from disk. Deleting a repository only removes its metadata and tags, but does not delete its underlying layers from disk either. To completely delete an image from disk in DTR, you need to run a garbage collection job after deleting the image or the repository. A garbage collection job scans the DTR storage and removes any unused layers that are not referenced by any images or repositories.

• Question 108:

  How do you configure Docker engine to use a registry that is not configured with TLS certificates from a trusted CA?

  A. Set IGNORE_TLS in the 'daemon.json' configuration file.

  B. Set and export the IGNORE_TLS environment variable on the command line

  C. Set INSECURE_REGISTRY in the '/etc/docker/default' configuration file

  D. Pass the '--insecure.-registry' flag to the daemon at run time

  Correct Answer: D

• Question 109:

  A server is running low on disk space. What command can be used to check the disk usage of images, containers, and volumes for Docker engine?

  A. 'docker system df'

  B. 'docker system prune'

  C. 'docker system free'

  D. 'docker system ps'

  Correct Answer: A

• Question 110:

  Is this a type of Linux kernel namespace that provides container isolation? Solution: Network

  A. Yes

  B. No

  Correct Answer: A

  Network is a type of Linux kernel namespace that provides container isolation. A network namespace provides isolation of network devices, stacks, ports, etc. Each network namespace has its own network devices, IP addresses, IP routing tables, /proc/net directory, port numbers, etc. Docker uses network namespaces to give each container its own virtual network interface and IP address.