Mirantis Mirantis Certifications DCA Questions & Answers

• Question 11:

  Will this Linux kernel facility limit a Docker container's access to host resources, such as CPU or memory? Solution: cgroups

  A. Yes

  B. No

  Correct Answer: A

  Using cgroups does limit a Docker container's access to host resources, such as CPU or memory. Cgroups are a Linux kernel feature that allow grouping and managing processes and their resource consumption. They can be used to limit, account, and isolate the resource usage of a container, such as CPU time, memory, disk I/O, network bandwidth, etc.

• Question 12:

  What is the difference between the ADD and COPY dockerfile instructions? (choosen 2)

  A. ADD supports compression format handling while COPY does not.

  B. COPY supports regular expression handling while ADD does not.

  C. COPY supports compression format handling while ADD does not.

  D. ADD support remote URL handling while COPY does not.

  E. ADD supports regular expression handling while COPY does not.

  Correct Answer: DE

• Question 13:

  You are troubleshooting a Kubernetes deployment called api, and want to see the events table for this object.

  Does this command display it?

  Solution: kubectl describe deployment api

  A. Yes

  B. No

  Correct Answer: A

  Using kubectl describe deployment api displays the events table for this object. The kubectl describe command shows detailed information about a resource, including its status and events. This command can be used to troubleshoot a deployment that is not working as expected

• Question 14:

  Will this command mount the host's '/data' directory to the ubuntu container in read-only mode? Solution: 'docker run --add-volume /data /mydata -read-only ubuntu'

  A. Yes

  B. No

  Correct Answer: B

  This command will not mount the host's `/data' directory to the ubuntu container in read-only mode, because it has several syntax errors and missing options. According to the official documentation, the correct command should be:

  docker run --volume /data:/mydata:ro --read-only ubuntu The errors and missing options are:

  The --add-volume flag does not exist and should be replaced by --volume or -v to mount a host directory as a data volume.

  The --volume flag requires a colon (:) to separate the host directory and the container directory, not a space.

  The --read-only flag applies to the whole container's file system, not just the mounted volume.

  To make the volume read-only, a :ro suffix should be added to the --volume flag.

  The ubuntu image name should be the last argument of the command.

• Question 15:

  You want to create a container that is reachable from its host's network.

  Does this action accomplish this?

  Solution: Use --link to access the container on the bridge network.

  A. Yes

  B. No

  Correct Answer: B

  Using either EXPOSE or --publish to access the container on the bridge network does not create a container that is reachable from its host's network. EXPOSE and --publish are options that specify which ports on the container should be exposed or published to the outside world. They do not affect which network the container is connected to. By default, Docker creates and connects containers to a bridge network, which is an internal network that isolates containers from each other and from the host. To create a container that is reachable from its host's network, you need to use --network host option, which connects the container to the host's network stack.

• Question 16:

  Which one of the following commands will result in the volume being removed automatically once the container has exited?

  A. 'docker run --del -v /foo busybox'

  B. 'docker run --read-only -v /foo busybox'

  C. 'docker run --rm -v /foo busybox'

  D. 'docker run --remove -v /foo busybox'

  Correct Answer: C

• Question 17:

  Which flag for a service would allow a container to consume more than 2 GB of memory only when there is no memory contention but would also prevent a container from consuming more than 4GB of memory, in any case?

  A. --limit-memory 2GB --reserve-memory 4GB

  B. --limit-memory 4GB --reserve-memory 2GB

  C. --memory-swap 2GB --limit-memory 4GB

  D. --memory-swap 4GB --limit-memory 2GB

  Correct Answer: C

• Question 18:

  You configure a local Docker engine to enforce content trust by setting the environment variable

  DOCKER_CONTENT_TRUST=1.

  If myorg/myimage: 1.0 is unsigned, does Docker block this command?

  Solution: docker service create myorg/myimage:1.0

  A. Yes

  B. No

  Correct Answer: A

  Docker will block this command, because docker service create requires content trust to be enabled by default and will not pull or run unsigned images. According to the official documentation, docker service create is one of the commands that verify content trust by default and will fail if the image is not signed or if the signing key is not

• Question 19:

  Which of the following commands will create a swarm service which only listens on port 53 using the UDP protocol?

  A. docker service create --name dns-cache -p 53:53/udp dns-cache

  B. docker service create --name dns-cache -p 53:53 --service udp dns-cache

  C. docker service create --name dns-cache -p 53:53 ..constraint networking.protocol.udp=true dns-cache

  D. docker service create --name dns-cache -p 53:53 --udp dns-cache

  Correct Answer: A

• Question 20:

  Does this describe the role of Control Groups (cgroups) when used with a Docker container? Solution: role-based access control to clustered resources

  A. Yes

  B. No

  Correct Answer: B

  This does not describe the role of Control Groups (cgroups) when used with a Docker container, because role-based access control to clustered resources is not related to cgroups. According to the official documentation, cgroups are a Linux kernel feature that limits and isolates the resource usage of a group of processes, such as CPU, memory, disk I/O, network, etc. Docker can use cgroups to share available hardware resources to containers and optionally enforce limits and constraints.