Mirantis Mirantis Certifications DCA Questions & Answers

• Question 131:

  The output of which command can be used to find the architecture and operating system an image is compatible with?

  A. docker image inspect --filter {{.Architecture}} {{.OS}} '

  B. docker image ls

  C. docker image inspect --format {{.Architecture}} {{.OS}} '

  D. docker image info

  Correct Answer: C

• Question 132:

  One of several containers in a pod is marked as unhealthy after failing its livenessProbe many times. Is this the action taken by the orchestrator to fix the unhealthy container? Solution: The controller managing the pod is autoscaled back to delete the unhealthy pod and alleviate load.

  A. Yes

  B. No

  Correct Answer: B

  The controller managing the pod is not autoscaled back to delete the unhealthy pod and alleviate load, because this is not how Kubernetes handles pod failures. According to the official documentation, Kubernetes will try to maintain the desired number of pods for each controller, and will not scale down or up based on pod health.

• Question 133:

  The Kubernetes yaml shown below describes a networkPolicy.

  

  Will the networkPolicy BLOCK this traffic?

  Solution: a request issued from a pod bearing the tier: backend label, to a pod bearing the tier: frontend label

  A. Yes

  B. No

  Correct Answer: A

  The networkPolicy will block this traffic. A networkPolicy is a Kubernetes resource that defines how pods are allowed to communicate with each other and with other network endpoints. A networkPolicy has two main sections: podSelector and policyTypes. The podSelector selects which pods the networkPolicy applies to. The policyTypes specifies whether the networkPolicy affects ingress (incoming) traffic, egress (outgoing) traffic, or both. In this case, the networkPolicy applies to pods that have a label app: webserver and affects both ingress and egress traffic. The networkPolicy also has two optional sections: ingress and egress. The ingress section defines the rules for allowing ingress traffic to the selected pods. The egress section defines the rules for allowing egress traffic from the selected pods. If either section is missing or empty, it means that no traffic of that type is allowed. In this case, the networkPolicy has an empty ingress section, which means that no ingress traffic is allowed to the pods that have a label app: webserver. Therefore, a request issued from a pod bearing the tier: backend label, to a pod bearing the tier: frontend label will be blocked by this networkPolicy, since it is an ingress traffic to a pod that has a label app: webserver.

• Question 134:

  Will this command list all nodes in a swarm cluster from the command line?

  Solution: 'docker node Is'

  A. Yes

  B. No

  Correct Answer: A

  Using `docker node ls' lists all nodes in a swarm cluster from the command line. The docker node command is used to manage nodes in a swarm. The docker node ls subcommand displays information about the nodes in the swarm, such as their ID, hostname, status, availability, and role.

• Question 135:

  You want to create a container that is reachable from its host's network. Does this action accomplish this?

  Solution: Use either EXPOSE or --publish to access the containers on the bridge network

  A. Yes

  B. No

  Correct Answer: A

  Using either EXPOSE or --publish to access the containers on the bridge network makes the container reachable from its host's network. The EXPOSE instruction in the Dockerfile specifies which ports the container listens on at runtime,

  while the --publish option maps a port on the host to a port in the container. Both options allow external access to the container's services. References:

  https://docs.docker.com/engine/reference/builder/#expose, https://docs.docker.com/config/containers/container-networking/

• Question 136:

  Following the principle of least privilege, which of the following methods can be used to securely grnt access to the specific user to communicate to a Docker engine? (Choose two.)

  A. Utilize the '--host 0.0.0.0:2375' option to the Docker daemon to listen on port 2375 over TCP on all interfaces

  B. Utilize openssl to create TLS client and server certificates, configuring the Docker engine to use with mutual TLS over TCP.

  C. Utilize the '--host 127.0.0.1:2375' option to the Docker daemon to listen on port 2375 over TCP on localhost

  D. Give the user root access to the server to allow them to run Docker commands as root.

  Correct Answer: B

• Question 137:

  Seven managers are in a swarm cluster.

  Is this how should they be distributed across three datacenters or availability zones?

  Solution: 3-3-1

  A. Yes

  B. No

  Correct Answer: B

  This is not how they should be distributed across three datacenters or availability zones, because having one manager in one datacenter or availability zone creates a single point of failure and reduces the fault tolerance of the swarm. According to the official documentation, managers should be distributed evenly across datacenters or availability zones to ensure that the swarm can survive the loss of any one datacenter or availability zone.

• Question 138:

  Will this command display a list of volumes for a specific container?

  Solution: docker volume logs nginx --containers'

  A. Yes

  B. No

  Correct Answer: B

  This command will not display a list of volumes for a specific container, because it uses docker volume inspect with an image name instead of a volume name. According to the official documentation, docker volume inspect requires one or

  more volume names as arguments and will show detailed information about the volumes, not the containers that use them.

  References: https://docs.docker.com/engine/reference/commandline/volume_inspect/

• Question 139:

  Your organization has a centralized logging solution, such as Splunk.

  Will this configure a Docker container to export container logs to the logging solution?

  Solution: docker logs

  A. Yes

  B. No

  Correct Answer: B

  Using docker logs does not configure a Docker container to export container logs to the logging solution. The docker logs command shows information logged by a running container, such as standard output and standard error streams. It does not send or export container logs to any external service.

• Question 140:

  Is this a supported user authentication method for Universal Control Plane? Solution: PAM

  A. Yes

  B. No

  Correct Answer: B

  PAM is not a supported user authentication method for Universal Control Plane. According to the official documentation, the supported methods are LDAP, Active Directory, SAML 2.0, and local users.