Mirantis Mirantis Certifications DCA Questions & Answers

• Question 171:

  Is this a supported user authentication method for Universal Control Plane? Solution: x.500

  A. Yes

  B. No

  Correct Answer: B

  x.500 is not a supported user authentication method for Universal Control Plane (UCP). x.500 is a series of standards for directory services that define how distributed directory information can be accessed and managed over a network. x.500 is not an external authentication backend that UCP supports. UCP supports LDAP, Active Directory, and SAML as external authentication backends.

• Question 172:

  Can this set of commands identify the published port(s) for a container? Solution: `docker container inspect", docker port'

  A. Yes

  B. No

  Correct Answer: A

  This set of commands can identify the published port(s) for a container. The docker container inspect command shows low-level information about a container in JSON format. This information includes the network settings of the container, such as the port bindings and exposed ports. The docker port command shows the public port(s) that are mapped to a private port inside the container. By using these two commands, you can identify the published port(s) for a container.

• Question 173:

  Is this statement correct?

  Solution: A Dockerfile stores persistent data between deployments of a container

  A. Yes

  B. No

  Correct Answer: B

  A Dockerfile does not store persistent data between deployments of a container. A Dockerfile is a text document that contains instructions for building an image from a base image and other components. A Dockerfile does not store any data itself; it only defines how an image should be built. Persistent data between deployments of a container can be stored using volumes or bind mounts, which are ways of attaching external storage to containers.

• Question 174:

  Is this a type of Linux kernel namespace that provides container isolation? Solution: Process ID

  A. Yes

  B. No

  Correct Answer: A

  Process ID is a type of Linux kernel namespace that provides container isolation. Process ID (pid) namespace isolates the process ID number space, which means that processes in different pid namespaces can have the same PID. This allows each container to have its own init process (PID 1), which is the first process to start in a container and the ancestor of all other processes in the container. Pid namespace also prevents processes in one container from seeing or signaling processes in another container or on the host system, unless they share the same pid namespace or have the CAP_SYS_PTRACE capability.

• Question 175:

  You configure a local Docker engine to enforce content trust by setting the environment variable DOCKER_C0NTENT_TRUST=l. If myorg/myimage: 1.0 is unsigned, does Docker block this command? Solution: docker image build, from a Dockeflle that begins FROM myorg/myimage: l1.0

  A. Yes

  B. No

  Correct Answer: A

  Docker blocks this command if you configure a local Docker engine to enforce content trust by setting the environment variable DOCKER_CONTENT_TRUST=1 and if myorg/myimage:1.0 is unsigned. Content trust is a feature that allows you to use digital signatures to verify the integrity and publisher of specific image tags. When you enable content trust, you can only pull, run, or build with trusted images. If an image tag is unsigned, Docker will block any command that attempts to use it. This includes docker image build, from a Dockerfile that begins FROM myorg/myimage:1.0, if myorg/myimage:1.0 is unsigned.

• Question 176:

  You are troubleshooting a Kubernetes deployment called api, and want to see the events table for this object.

  Does this command display it?

  Solution: kubectl get deployment api

  A. Yes

  B. No

  Correct Answer: B

  Using kubectl get deployment api does not display the events table for this object. The kubectl get command shows basic information about one or more resources, such as their name, age, status, etc. It does not show the events table, which is a list of events that occurred on the resource, such as creation, update, scaling, etc. To see the events table for this object, you need to use kubectl describe deployment api.

• Question 177:

  Will this Linux kernel facility limit a Docker container's access to host resources, such as CPU or memory? Solution: capabilities

  A. Yes

  B. No

  Correct Answer: B

  Capabilities are not a Linux kernel facility that limit a Docker container's access to host resources, such as CPU or memory. Capabilities are a Linux kernel feature that divide the privileges of the root user into distinct units, called capabilities, which can be independently enabled or disabled for each process. Capabilities allow fine-grained control over the operations that a process can perform on the system, such as binding to a privileged port, changing the system time, loading kernel modules, etc. Docker uses capabilities to restrict the default set of capabilities available to the root user inside a container, following the principle of least privilege. However, capabilities do not affect how much CPU or memory a container can use on the host system.

• Question 178:

  Is this the purpose of Docker Content Trust?

  Solution: Indicate an image on Docker Hub is an official image.

  A. Yes

  B. No

  Correct Answer: B

  Indicating an image on Docker Hub is an official image is not the purpose of Docker Content Trust. Official images are curated images that are provided and maintained by Docker, Inc. or by upstream software maintainers. Official images have a special badge on Docker Hub that indicates their status. Official images are not necessarily signed by Docker Content Trust, although some of them are. The purpose of Docker Content Trust is to sign and verify image tags, not to indicate official images.

• Question 179:

  Does this command create a swarm service that only listens on port 53 using the UDP protocol?

  Solution: `docker service create -name dns-cache -p 53:53 -service udp dns-cache'

  A. Yes

  B. No

  Correct Answer: B

  This command does not create a swarm service that only listens on port 53 using the UDP protocol, because it has several syntax errors and missing options. According to the official documentation, the correct command should be:

  docker service create --name dns-cache -p 53:53/udp --mode global dns-cache The errors and missing options are:

  The --name flag is missing a dash (-).

  The -p flag is missing the /udp suffix to specify the protocol. The --service flag does not exist and should be replaced by --mode to specify the service mode.

  The global option should follow the --mode flag to indicate that one task should run on each node.

  References:

  https://docs.docker.com/engine/reference/commandline/service_create/#publish-service- ports-externally-to-the-swarm--publish

  https://docs.docker.com/engine/reference/commandline/service_create/#specify-service- mode--mode

  https://docs.docker.com/engine/reference/commandline/service_create/#options

• Question 180:

  During development of an application meant to be orchestrated by Kubernetes, you want to mount the /data directory on your laptop into a container.

  Will this strategy successfully accomplish this?

  Solution: Set containers. Mounts. hostBinding: /data in the container's specification.

  A. Yes

  B. No

  Correct Answer: B

  This strategy does not successfully mount the /data directory on your laptop into a container. Setting containers.mounts.hostBinding to /data in the container's specification is not a valid way to mount a host directory into a container in

  Kubernetes. Kubernetes does not support mounting arbitrary host directories into containers, as this would break the portability and isolation of pods across different nodes. To mount a host directory into a container in Kubernetes, you need

  to use one of the following methods:

  Use hostPath volume, which allows you to mount a file or directory from the host node's filesystem into your pod.

  Use local volume, which allows you to mount local storage devices such as disks or partitions into your pod.

  Use persistentVolume and persistentVolumeClaim with hostPath or local volume as storage class, which allows you to abstract the details of how storage is provided from how it is consumed.