Mirantis Mirantis Certifications DCA Questions & Answers

• Question 71:

  A company's security policy specifies that development and production containers must run on separate nodes in a given Swarm cluster.

  Can this be used to schedule containers to meet the security policy requirements?

  Solution: node taints

  A. Yes

  B. No

  Correct Answer: B

  Node taints cannot be used to schedule containers to meet the security policy requirements, because node taints are a Kubernetes concept and not a Swarm concept. According to the official documentation, node taints are used to mark nodes with certain attributes that prevent pods from being scheduled on them unless they have matching tolerations.

• Question 72:

  Which of the following statements is true about secrets?

  A. Secrets can be created from any node in the cluster.

  B. Secrets can be modified after they are created.

  C. Secret are stored unencrypted on manager nodes.

  D. Secrets can be created using standard input (STDIN) and a file.

  Correct Answer: D

• Question 73:

  Wha is the purpose of Docker Content Trust?

  A. Signing and verification of image tags

  B. Enabling mutual TLS between the Docker client and server

  C. Docker registry TLS verification and encryption

  D. Indicating an image on Docker Hub is an official image

  Correct Answer: A

• Question 74:

  When using the Docker client to push an image to a registry, what environment variable is used to instruct the client to perform signing of the image?

  A. DOCKER_CONTENT_TRUST=1

  B. DOCKER_IMAGE_SIGN=1

  C. DOCKER_PUSH_SIGN=1

  D. NOTARY_ENABLE=1

  Correct Answer: A

• Question 75:

  Is this an advantage of multi-stage builds?

  Solution: better caching when building Docker images

  A. Yes

  B. No

  Correct Answer: B

  Better caching when building Docker images is not an advantage of multi- stage builds. Multi-stage builds are a feature that allows you to use multiple FROM statements in a single Dockerfile. Each FROM statement begins a new stage of the

  build, with its own base image and instructions. You can selectively copy artifacts from one stage to another, leaving behind everything you don't want in the final image. The advantages of multi-stage builds are:

  Reducing the size of the final image by removing unnecessary dependencies or intermediate files.

  Improving the security of the final image by minimizing the attack surface and avoiding leaking secrets.

  Simplifying the development workflow by using different tools or environments in different stages. Better caching when building Docker images is not an advantage of multi-stage builds, as it depends on other factors, such as the order and

  content of the instructions in each stage, the availability and freshness of the base images and intermediate layers, and the use of build arguments or environment variables that may invalidate the cache.

• Question 76:

  Two development teams in your organization use Kubernetes and want to deploy their applications while ensuring that Kubernetes-specific resources, such as secrets, are grouped together for each application.

  Is this a way to accomplish this?

  Solution: Add all the resources to the default namespace.

  A. Yes

  B. No

  Correct Answer: B

  This is not a way to accomplish this, because adding all the resources to the default namespace is not a good practice for isolating applications in Kubernetes. According to the official documentation, namespaces are used to group resources into logical units that correspond to different projects, teams, or environments. Using namespaces can help avoid naming collisions and enforce resource quotas and access policies.

• Question 77:

  Is this a type of Linux kernel namespace that provides container isolation? Solution: Storage

  A. Yes

  B. No

  Correct Answer: B

  Storage is not a type of Linux kernel namespace that provides container isolation. Namespaces are a Linux kernel feature that provide isolation and virtualization of system resources for processes. They can be used to create isolated environments for containers that have their own view of system resources, such as process IDs, user IDs, network interfaces, etc. However, there is no storage namespace in Linux. The types of namespaces that exist are mount (mnt), process ID (pid), network (net), interprocess communication (ipc), user ID (user), control group (cgroup), time (time), and user namespace (uts).

• Question 78:

  Will this configuration achieve fault tolerance for managers in a swarm? Solution: only two managers, one active and one passive.

  A. Yes

  B. No

  Correct Answer: B

  This configuration will not achieve fault tolerance for managers in a swarm, because having only two managers creates a risk of losing quorum if one manager fails or becomes unavailable. According to the official documentation, having two managers also does not provide any benefits over having one manager, since both managers must be available for any management operations.

• Question 79:

  Are these conditions sufficient for Kubernetes to dynamically provision a persistentVolume, assuming there are no limitations on the amount and type of available external storage? Solution: A default provisioner is specified, and subsequently a persistentVolumeClaim is created.

  A. Yes

  B. No

  Correct Answer: B

  These conditions are not sufficient for Kubernetes to dynamically provision a persistentVolume, because a default provisioner is not enough to determine how to create a persistentVolume. According to the official documentation, you also need to specify a default storageClass or annotate your persistentVolumeClaim with a specific storageClass name.

• Question 80:

  You created a new service named 'http' and discover it is not registering as healthy. Will this command enable you to view the list of historical tasks for this service? Solution: 'docker inspect http'

  A. Yes

  B. No

  Correct Answer: B

  Using docker inspect http does not enable you to view the list of historical tasks for this service. The docker inspect command shows low-level information about one or more objects, such as containers, images, networks, etc. It does not show information about services or tasks. To view the list of historical tasks for this service, you need to use docker service ps http --no-trunc.