DCA DCA Docker Security 2

Question 1

What does the `--cap-drop ALL` flag do when running a container?

Accepted Answer

Drops all Linux capabilities from the container process

Answer

The `--cap-drop ALL` flag removes all Linux capabilities from the container, which can then be selectively restored with `--cap-add`.

Question 2

Which Linux feature is used by Docker to enforce CPU and memory resource limits on containers?

Accepted Answer

cgroups (control groups)

Answer

Linux cgroups (control groups) limit, prioritize, and monitor resource usage including CPU, memory, and I/O for Docker containers.

Question 3

How are Docker secrets passed to a container in Swarm mode?

Accepted Answer

As files mounted under /run/secrets/ inside the container

Answer

Docker secrets are mounted as in-memory tmpfs files at /run/secrets/<secret_name> inside the container, never exposed in environment variables or image layers.

Question 4

What format is used to define a custom seccomp profile for a Docker container?

Accepted Answer

A JSON profile file

Answer

Docker seccomp profiles are defined in JSON format, specifying the default action and the list of allowed or denied system calls.

Question 5

What does the `--read-only` flag do when running a Docker container?

Accepted Answer

Makes the container's root filesystem read-only

Answer

The `--read-only` flag mounts the container's root filesystem as read-only, preventing any process from writing to it.

DCA - Docker Certified Associate Exam Practice Test

DCA - Docker Certified Associate Exam Practice Test

DCA DCA Docker Security 2