Docker DCA Online Practice Questions and Exam Preparation

Docker DCA Online Questions & Answers

• Question 151:

  Is this a way to configure the Docker engine to use a registry without a trusted TLS certificate?

  Solution: Set INSECURE_REGISTRY in the' /etc/docker/default' configuration file.

  A. Yes
  B. No
  A. Yes

  ---

  Explanation/Reference:

  Setting INSECURE_REGISTRY in the /etc/docker/default configuration file is a way to configure the Docker engine to use a registry without a trusted TLS certificate. The INSECURE_REGISTRY option allows you to specify one or more registries that do not have valid TLS certificates or use HTTP instead of HTTPS. This option bypasses the TLS verification for these registries and allows Docker to pull and push images from them without errors. However, this option is not recommended for production use as it exposes your registry communication to potential security risks.

• Question 152:

  Which one of the following commands will show a list of volumes for a specific container?

  A. 'docker container logs nginx --volumes'
  B. 'docker container inspect nginx'
  C. 'docker volume inspect nginx' D. 'docker volume logs nginx --containers'
  B. 'docker container inspect nginx'

• Question 153:

  Which of the following statements is true about secrets?

  A. Secrets can be created from any node in the cluster.
  B. Secrets can be modified after they are created.
  C. Secret are stored unencrypted on manager nodes.
  D. Secrets can be created using standard input (STDIN) and a file.
  D. Secrets can be created using standard input (STDIN) and a file.

• Question 154:

  A users attempts to set the system time from inside a Docker container are unsuccessful. Could this be blocking this operation? Solution: Linux capabilities

  A. Yes
  B. No
  A. Yes

  ---

  Explanation/Reference:

  Linux capabilities are blocking this operation. Linux capabilities are a partitioning of the privileges traditionally associated with superuser into distinct units, known as capabilities, which can be independently enabled and disabled. Capabilities are used by Docker to restrict the operations that a container can perform on the host system. By default, Docker drops all capabilities except those needed for common operations, such as binding to ports below 1024 or mounting filesystems. One of the capabilities that is dropped by default is CAP_SYS_TIME, which allows setting the system clock. Therefore, a user cannot set the system time from inside a Docker container unless this capability is explicitly added.

• Question 155:

  You configure a local Docker engine to enforce content trust by setting the environment variable

  DOCKER_CONTENT_TRUST=1.

  If myorg/myimage: 1.0 is unsigned, does Docker block this command?

  Solution: docker service create myorg/myimage:1.0

  A. Yes
  B. No
  A. Yes

  ---

  Explanation/Reference:

  Docker will block this command, because docker service create requires content trust to be enabled by default and will not pull or run unsigned images. According to the official documentation, docker service create is one of the commands that verify content trust by default and will fail if the image is not signed or if the signing key is not

• Question 156:

  The Kubernetes yaml shown below describes a networkPolicy.

  

  Will the networkPolicy BLOCK this traffic?

  Solution: a request issued from a pod bearing the tier: backend label, to a pod bearing the tier: frontend label

  A. Yes
  B. No
  A. Yes

  ---

  Explanation/Reference:

  The networkPolicy will block this traffic. A networkPolicy is a Kubernetes resource that defines how pods are allowed to communicate with each other and with other network endpoints. A networkPolicy has two main sections: podSelector and policyTypes. The podSelector selects which pods the networkPolicy applies to. The policyTypes specifies whether the networkPolicy affects ingress (incoming) traffic, egress (outgoing) traffic, or both. In this case, the networkPolicy applies to pods that have a label app: webserver and affects both ingress and egress traffic. The networkPolicy also has two optional sections: ingress and egress. The ingress section defines the rules for allowing ingress traffic to the selected pods. The egress section defines the rules for allowing egress traffic from the selected pods. If either section is missing or empty, it means that no traffic of that type is allowed. In this case, the networkPolicy has an empty ingress section, which means that no ingress traffic is allowed to the pods that have a label app: webserver. Therefore, a request issued from a pod bearing the tier: backend label, to a pod bearing the tier: frontend label will be blocked by this networkPolicy, since it is an ingress traffic to a pod that has a label app: webserver.

• Question 157:

  Does this command create a swarm service that only listens on port 53 using the UDP protocol?

  Solution: `docker service create -name dns-cache -p 53:53 -service udp dns-cache'

  A. Yes
  B. No
  B. No

  ---

  Explanation/Reference:

  This command does not create a swarm service that only listens on port 53 using the UDP protocol, because it has several syntax errors and missing options. According to the official documentation, the correct command should be:

  docker service create --name dns-cache -p 53:53/udp --mode global dns-cache The errors and missing options are:

  The --name flag is missing a dash (-).

  The -p flag is missing the /udp suffix to specify the protocol. The --service flag does not exist and should be replaced by --mode to specify the service mode.

  The global option should follow the --mode flag to indicate that one task should run on each node.

  References:

  https://docs.docker.com/engine/reference/commandline/service_create/#publish-service- ports-externally-to-the-swarm--publish

  https://docs.docker.com/engine/reference/commandline/service_create/#specify-service- mode--mode

  https://docs.docker.com/engine/reference/commandline/service_create/#options

• Question 158:

  Will this command display a list of volumes for a specific container? Solution: docker container logs nginx --volumes'

  A. Yes
  B. No
  B. No

  ---

  Explanation/Reference:

  Using docker container logs nginx --volumes does not display a list of volumes for a specific container. The docker container logs command shows information about the logs of a container. The --volumes flag is not a valid option for this command and will cause an error. To display a list of volumes for a specific container, you need to use docker container inspect nginx --format `{{ .Mounts }}'.

• Question 159:

  Is this a type of Linux kernel namespace that provides container isolation? Solution: Storage

  A. Yes
  B. No
  B. No

  ---

  Explanation/Reference:

  Storage is not a type of Linux kernel namespace that provides container isolation. Namespaces are a Linux kernel feature that provide isolation and virtualization of system resources for processes. They can be used to create isolated environments for containers that have their own view of system resources, such as process IDs, user IDs, network interfaces, etc. However, there is no storage namespace in Linux. The types of namespaces that exist are mount (mnt), process ID (pid), network (net), interprocess communication (ipc), user ID (user), control group (cgroup), time (time), and user namespace (uts).

• Question 160:

  Is this a type of Linux kernel namespace that provides container isolation?

  Solution: Process ID

  A. Yes
  B. No
  A. Yes

  ---

  Explanation/Reference:

  Process ID is a type of Linux kernel namespace that provides container isolation. Process ID (pid) namespace isolates the process ID number space, which means that processes in different pid namespaces can have the same PID. This allows each container to have its own init process (PID 1), which is the first process to start in a container and the ancestor of all other processes in the container. Pid namespace also prevents processes in one container from seeing or signaling processes in another container or on the host system, unless they share the same pid namespace or have the CAP_SYS_PTRACE capability.