Mirantis Mirantis Certifications DCA Questions & Answers

• Question 191:

  Is this an advantage of multi-stage builds?

  Solution: better logical separation of Dockerfile instructions for increased readability

  A. Yes

  B. No

  Correct Answer: B

  Better logical separation of Dockerfile instructions for increased readability is not an advantage of multi-stage builds. Multi-stage builds are a feature that allows you to use multiple FROM statements in your Dockerfile. Each FROM statement begins a new stage of the build. You can selectively copy artifacts from one stage to another, leaving behind everything you don't want in the final image. The main advantage of multi-stage builds is that they allow you to reduce the size of your final image by only including the essential components and dependencies. Another advantage of multi-stage builds is that they allow you to optimize the build cache by grouping similar instructions in each stage. Better logical separation of Dockerfile instructions for increased readability is not an inherent advantage of multi-stage builds, as it depends on how you write and organize your Dockerfile.

• Question 192:

  An application image runs in multiple environments, with each environment using different certificates and ports. Is this a way to provision configuration to containers at runtime?

  Solution: Create a Dockerfile for each environment, specifying ports and Docker secrets for certificates.

  A. Yes

  B. No

  Correct Answer: B

  Creating a Dockerfile for each environment, specifying ports and Docker secrets for certificates, is not a way to provision configuration to containers at runtime. A Dockerfile defines the configuration of an image at build time, not at runtime. Creating a different Dockerfile for each environment is not a good practice, as it introduces duplication and inconsistency. To provision configuration to containers at runtime, you can use environment variables, config objects, or command-line arguments.

• Question 193:

  In the context of a swarm mode cluster, does this describe a node?

  Solution: an instance of the Docker CLI connected to the swarm

  A. Yes

  B. No

  Correct Answer: B

  An instance of the Docker CLI connected to the swarm does not describe a node in the context of a swarm mode cluster. A node is a physical or virtual machine that runs the Docker Engine and participates in the swarm. A node can have one

  of two roles:

  manager or worker. Manager nodes maintain the cluster state and orchestrate tasks. Worker nodes execute tasks assigned by manager nodes. An instance of the Docker CLI connected to the swarm is a client that can interact with the

  swarm using commands such as docker service, docker node, docker stack, etc. A client can connect to any manager node in the swarm using the --host or -H flag.

• Question 194:

  Can this set of commands identify the published port(s) for a container?

  Solution: `docker port inspect", docker container inspect"

  A. Yes

  B. No

  Correct Answer: B

  This set of commands cannot identify the published port(s) for a container. The docker port inspect command does not exist and will cause an error. The docker container inspect command shows low-level information about a container in JSON format, but it does not show the public port(s) that are mapped to a private port inside the container. To identify the published port(s) for a container, you can use docker container inspect and docker port commands.

• Question 195:

  Will this command ensure that overlay traffic between service tasks is encrypted?

  Solution: docker network create -d overlay --secure

  A. Yes

  B. No

  Correct Answer: B

  Using docker network create -d overlay --secure does not ensure that overlay traffic between service tasks is encrypted. The --secure flag is not a valid option for this command and will cause an error. To ensure that overlay traffic between service tasks is encrypted, you need to use --opt encrypted flag instead. This flag enables IPsec encryption at the level of the vxlan overlay driver.

• Question 196:

  Will a DTR security scan detect this?

  Solution: image configuration poor practices, such as exposed ports or inclusion of compilers in production images

  A. Yes

  B. No

  Correct Answer: B

  A DTR security scan does not detect image configuration poor practices, such as exposed ports or inclusion of compilers in production images. A DTR security scan is a feature that scans images for known vulnerabilities in the software packages or dependencies that are installed in the image. A DTR security scan does not check for image configuration poor practices, such as exposing unnecessary ports or including unnecessary tools in production images. To avoid image configuration poor practices, you should follow the Dockerfile best practices and use multi-stage builds to optimize your images.

• Question 197:

  Does this command create a swarm service that only listens on port 53 using the UDP protocol?

  Solution: `docker service create -name dns-cache -p 53:53 -constraint networking.protocol.udp=true dns-cache"

  A. Yes

  B. No

  Correct Answer: B

  This command does not create a swarm service that only listens on port 53 using the UDP protocol. The docker service create command creates a new service in a swarm cluster. The --name flag sets the name of the service. The -p or -publish flag publishes a port or a range of ports to the swarm. The --constraint flag applies a constraint to limit the set of nodes where the task can be scheduled. The networking.protocol.udp is not a valid constraint and will cause an error. To create a swarm service that only listens on port 53 using the UDP protocol, you need to use -p 53:53/udp instead.

• Question 198:

  Will this command display a list of volumes for a specific container?

  Solution: `docker container inspect nginx'

  A. Yes

  B. No

  Correct Answer: A

  Using docker container inspect nginx does display a list of volumes for a specific container. The docker container inspect command shows low-level information about one or more containers in JSON format. This information includes various details about the container's configuration, state, network settings, mounts, etc. To display a list of volumes for a specific container, you can either look at the Mounts section in the JSON output or use --format `{{ .Mounts }}' to filter out only that section.

• Question 199:

  You add a new user to the engineering organization in DTR.

  Will this action grant them read/write access to the engineering/api repository?

  Solution: Mirror the engineering/api repository to one of the user's own private repositories.

  A. Yes

  B. No

  Correct Answer: B

  Mirroring the engineering/api repository to one of the user's own private repositories does not grant them read/write access to the engineering/api repository. Mirroring is a feature that allows you to automatically replicate images from one repository to another, either within the same DTR or across different DTRs. Mirroring does not change the permissions or access levels of the source or destination repositories. It only copies the images and tags from one repository to another. To grant a user read/write access to the engineering/api repository, you need to add them as a collaborator with read/write role on that repository, or add them to a team that has read/write role on that repository.