Docker Certified Associate (DCA) — Questions and Answers

Question 1: What happens to containers connected to the 'none' network driver?

They use a bridge connection
They share the host network stack
They have no network access (Correct answer)
They are connected to all available networks

Correct answer: They have no network access

The none network driver completely disables all networking for the container.

Question 2: What does the `--read-only` flag do when passed to `docker run`?

Mounts the host filesystem as read-only
Prevents reading from bind mounts
Disables volume writes cluster-wide
Makes the container's root filesystem read-only (Correct answer)

Correct answer: Makes the container's root filesystem read-only

`--read-only` mounts the container's root filesystem in read-only mode, preventing writes to it at runtime.

Question 3: In a CI pipeline, 'docker build' exits with code 1. Which step should be taken first to diagnose the failure?

Switch to a different base image
Re-run with '--no-cache' to rule out stale layers
Delete all local images and rebuild from scratch
Check the build log output for the specific RUN instruction that failed (Correct answer)

Correct answer: Check the build log output for the specific RUN instruction that failed

The build log identifies the exact failing RUN step and its stderr, providing the most direct path to diagnosing the failure cause.

Question 4: When documenting container dependencies for stakeholders, which Docker Compose key explicitly defines startup order communication?

networks
links
depends_on (Correct answer)
environment

Correct answer: depends_on

`depends_on` defines service startup order and dependency relationships in Docker Compose.

Question 5: Which Docker feature is used to securely store and transmit sensitive data like passwords to Swarm services?

Docker volumes
Docker environment variables
Docker secrets (Correct answer)
Docker configs

Correct answer: Docker secrets

Docker secrets provide a secure mechanism for storing sensitive data, encrypted at rest and transmitted only to authorized Swarm service containers.

Question 6: What does Docker Content Trust (DCT) enable from a professional ethics standpoint?

It encrypts all container network traffic
It verifies the authenticity and integrity of images using cryptographic signatures (Correct answer)
It enforces CPU and memory limits automatically
It prevents containers from accessing the host filesystem

Correct answer: It verifies the authenticity and integrity of images using cryptographic signatures

DCT uses cryptographic signatures to verify that images come from a trusted publisher and have not been tampered with.

Question 7: What risk is introduced by running long-lived, stateful data directly inside a container's writable layer rather than in a Docker volume?

Data loss on container removal, since the writable layer is destroyed when the container is deleted (Correct answer)
Data stored in the writable layer is replicated to all nodes in a Swarm cluster
Docker Compose cannot manage containers that write to their writable layer
The writable layer encrypts data automatically, causing performance issues

Correct answer: Data loss on container removal, since the writable layer is destroyed when the container is deleted

A container's writable layer is ephemeral and tied to the container's lifecycle; data not stored in a named volume is permanently lost when the container is removed.

Question 8: You want to capture a single snapshot of container stats without streaming continuously. Which flag achieves this?

--single
--once
--snapshot
--no-stream (Correct answer)

Correct answer: --no-stream

`docker stats --no-stream` outputs one set of stats and exits instead of continuously streaming.

Question 9: Which Docker command shows real-time resource consumption (CPU, memory, I/O) for all running containers to help identify cost-driving processes?

docker events
docker inspect
docker top
docker stats (Correct answer)

Correct answer: docker stats

docker stats streams live resource usage metrics for all running containers by default.

Question 10: A container's health check is reporting `unhealthy`. Which command gives you the detailed health check output history?

docker inspect <container> (Correct answer)
docker logs --health <container>
docker stats <container>
docker events --filter health

Correct answer: docker inspect <container>

`docker inspect` includes a `Health` field with the last five health check results and their output.

Question 11: Which network driver assigns a MAC address and connects containers directly to the physical network?

overlay
macvlan (Correct answer)
host
bridge

Correct answer: macvlan

The macvlan network driver assigns a unique MAC address to each container, making it appear as a physical device on the network.

Question 12: What is the function of 'docker service rollback' compared to 'docker service update --rollback'?

Only 'docker service update --rollback' can revert image changes
'docker service rollback' deletes the service and redeploys from a snapshot
'docker service rollback' reverts to the previous service spec; '--rollback' is used to configure rollback parameters (Correct answer)
They are identical commands with different syntax

Correct answer: 'docker service rollback' reverts to the previous service spec; '--rollback' is used to configure rollback parameters

'docker service rollback' is a dedicated command that immediately reverts the service to its previous configuration, while '--rollback' in update sets rollback policy parameters.

Question 13: What is the principle of least privilege in DCA technology management?

Users should only have the minimum access rights necessary for their job functions (Correct answer)
Everyone should share a single set of login credentials
Access privileges should be based on employee seniority
All users should have full administrator access to all systems

Correct answer: Users should only have the minimum access rights necessary for their job functions

The principle of least privilege limits each user's access to only what is strictly necessary for their role, reducing potential damage from errors, insider threats, or compromised accounts.

Question 14: What does the `--network host` flag do when running a container?

Connects the container to a bridge network
Disables all networking
Creates a new isolated network
Shares the host's network namespace with the container (Correct answer)

Correct answer: Shares the host's network namespace with the container

The `--network host` flag removes network isolation between the container and the Docker host.

Question 15: How do you scale a replicated service named 'web' to 5 replicas in Docker Swarm?

docker service update --replicas 5 web
docker swarm scale --service web --replicas 5
docker service scale web=5 (Correct answer)
docker service scale web 5

Correct answer: docker service scale web=5

`docker service scale web=5` is the correct syntax, using `name=count` format to set the desired replica count.

Question 16: Which Linux feature does Docker use to filter the system calls a container can make to the kernel?

SELinux
Namespaces
AppArmor
Seccomp (Correct answer)

Correct answer: Seccomp

Docker uses seccomp (secure computing mode) profiles to restrict which system calls a container process can invoke.

Question 17: Which command rolls back a service named 'db' to its previous deployed configuration?

docker service rollback db (Correct answer)
docker service revert db
docker service undo db
docker service update --previous db

Correct answer: docker service rollback db

`docker service rollback db` reverts the service to the specification it had before the most recent `docker service update`.

Question 18: What is a compliance audit in DCA practice?

A financial profit and loss assessment
An annual employee performance evaluation
A systematic review verifying adherence to regulatory requirements and policies (Correct answer)
A routine customer satisfaction survey

Correct answer: A systematic review verifying adherence to regulatory requirements and policies

A compliance audit systematically examines adherence to external regulations, internal policies, and industry standards, identifying gaps and recommending corrective actions.

Question 19: Under NIST SP 800-190 (Application Container Security Guide), what is the recommended approach to container image provenance?

Trust images that have been deployed successfully in production without scanning
Use only images from trusted registries with verified signatures and maintained update cadence (Correct answer)
Pull images from any public registry to maximize choice
Build all images from scratch without base image dependencies

Correct answer: Use only images from trusted registries with verified signatures and maintained update cadence

NIST SP 800-190 recommends using trusted, signed images from reputable sources and regularly updating them to address vulnerabilities.

Question 20: What is the purpose of signing Docker images with 'docker trust sign'?

It encrypts image layers at rest in the registry
It creates a cryptographic signature so consumers can verify the image has not been tampered with (Correct answer)
It locks the image so it cannot be deleted from the registry
It generates a checksum file stored alongside the image tarball

Correct answer: It creates a cryptographic signature so consumers can verify the image has not been tampered with

Docker Content Trust (DCT) uses Notary to create digital signatures, allowing clients to verify image integrity and publisher identity before pulling.

Question 21: Which Docker runtime security tool specifically generates and enforces Seccomp profiles to limit syscalls available to containers, supporting compliance with least-privilege requirements?

Docker Scout
Falco
Docker Bench for Security
docker/default Seccomp profile or custom profiles with --security-opt seccomp (Correct answer)

Correct answer: docker/default Seccomp profile or custom profiles with --security-opt seccomp

Docker's default Seccomp profile blocks ~44 dangerous syscalls, and custom profiles via --security-opt seccomp enforce granular syscall restrictions for least-privilege compliance.

Question 22: Which Docker CLI command lists all Docker events (create, start, stop, etc.) occurring in real time?

docker events (Correct answer)
docker ps --watch
docker inspect --stream
docker logs --events

Correct answer: docker events

`docker events` streams real-time lifecycle and configuration events from the Docker daemon.

Question 23: Docker Hub's Terms of Service for free accounts includes rate limiting on image pulls. Which organizational compliance concern does this primarily raise?

PCI DSS cardholder data exposure
GDPR data residency violations
SOC 2 encryption requirement violations
Supply chain reliability and availability risk for production CI/CD pipelines (Correct answer)

Correct answer: Supply chain reliability and availability risk for production CI/CD pipelines

Rate limiting on free Docker Hub accounts can disrupt CI/CD pipelines and production deployments, creating operational risk and potential SLA compliance failures.

Question 24: What is the difference between quantitative and qualitative data in DCA analysis?

Quantitative data cannot be used in professional settings
They are interchangeable terms for the same type of data
Quantitative data is numerical and measurable; qualitative data is descriptive and categorical (Correct answer)
Qualitative data is always more accurate than quantitative

Correct answer: Quantitative data is numerical and measurable; qualitative data is descriptive and categorical

Quantitative data consists of numerical measurements that can be statistically analyzed, while qualitative data consists of descriptive observations, opinions, and categories that provide context and depth.

Question 25: How are Docker secrets passed to a container in Swarm mode?

Embedded in the container image layer
Via the docker run -e flag at service creation
As files mounted under /run/secrets/ inside the container (Correct answer)
As environment variables visible in docker inspect

Correct answer: As files mounted under /run/secrets/ inside the container

Docker secrets are mounted as in-memory tmpfs files at /run/secrets/<secret_name> inside the container, never exposed in environment variables or image layers.

Question 26: Which behavior best demonstrates professional integrity when estimating the effort required to harden a Docker deployment?

Copy estimates from a similar project without reviewing the current environment
Skip the estimate and start work immediately
Underestimate to get the project approved and fix it later
Provide an accurate estimate based on a thorough security assessment, even if it delays the project (Correct answer)

Correct answer: Provide an accurate estimate based on a thorough security assessment, even if it delays the project

Accurate estimates based on real assessments are essential to professional integrity, even when they are inconvenient for project timelines.

Question 27: A stakeholder asks why two containers on the default bridge network cannot reach each other by name. What is the correct explanation?

Containers must share a volume to communicate by name
Only Swarm overlay networks support any form of DNS
The default bridge network does not provide automatic DNS resolution; user-defined networks do (Correct answer)
Docker disables DNS entirely on bridge networks

Correct answer: The default bridge network does not provide automatic DNS resolution; user-defined networks do

The default bridge network lacks the embedded DNS server that user-defined bridge networks provide for container name resolution.

Question 28: What is the role of the IPAM driver in Docker networking?

Ingress Proxy and Access Module for Swarm
IP Address Management for allocating IPs and subnets to networks and containers (Correct answer)
Internal Port Access Mapping for published services
Image and Package Asset Management

Correct answer: IP Address Management for allocating IPs and subnets to networks and containers

IPAM (IP Address Management) is responsible for allocating IP addresses and subnets to Docker networks and their connected containers.

Question 29: A developer wants to enforce that no container in a Swarm service runs as root. Which mechanism enforces this at the orchestration level?

Dockerfile USER instruction
Docker Swarm --user flag on service create (Correct answer)
AppArmor profile attached to the service
A Swarm config file with user constraints

Correct answer: Docker Swarm --user flag on service create

The '--user' flag on 'docker service create' overrides the image default and ensures all tasks in the service run as the specified non-root user.

Question 30: What does the `--cap-drop ALL` flag do when running a container?

Disables all bind-mounted volumes
Prevents the container from forking child processes
Drops all Linux capabilities from the container process (Correct answer)
Removes the container from all networks

Correct answer: Drops all Linux capabilities from the container process

The `--cap-drop ALL` flag removes all Linux capabilities from the container, which can then be selectively restored with `--cap-add`.

Question 31: A developer accidentally pushed a Docker image containing a hardcoded database password to a public registry. What is the CORRECT remediation approach?

Add a `.dockerignore` file and rebuild the image without pushing
Delete only the specific layer containing the secret, then re-push the image
Immediately rotate the compromised credential, remove all affected image versions, and audit access logs (Correct answer)
Change the image tag from `latest` to a random string to obscure the image

Correct answer: Immediately rotate the compromised credential, remove all affected image versions, and audit access logs

Rotating the credential limits blast radius immediately; removing all image versions prevents further exposure since image layers are immutable and may be cached.

Question 32: A CI pipeline must build multi-architecture Docker images for both amd64 and arm64. Which tool and command accomplishes this in one step?

docker build --cross-compile linux/amd64,linux/arm64 -t myimage .
docker build --arch amd64,arm64 -t myimage .
docker manifest build --multi-arch -t myimage .
docker buildx build --platform linux/amd64,linux/arm64 -t myimage --push . (Correct answer)

Correct answer: docker buildx build --platform linux/amd64,linux/arm64 -t myimage --push .

Docker Buildx with the --platform flag builds multi-architecture images and can push a multi-arch manifest in a single command.

Question 33: Which of the subsequent claims is true? Select exactly two statements.

Only one container can be spawned from a given image at a time
If multiple containers are spawned from the same image then they all use the same copy of image in memory. (Correct answer)
Container can exist without the image but image cannot exist without container
Image is a collection of immutable layers whereas container is a running instance of an image. (Correct answer)

Correct answer: If multiple containers are spawned from the same image then they all use the same copy of image in memory.

There are immutable layers in an image. A container is a live copy of an image. <br> When several containers are launched from a single picture, only one copy of the image is stored in memory. In order to handle its local modifications, each container has a separate Read and Write layer.

Question 34: Which `docker events` filter would show only container die events?

--filter event=die
--filter type=container --filter event=die (Correct answer)
--filter status=die
--filter action=die

Correct answer: --filter type=container --filter event=die

Combining `--filter type=container` and `--filter event=die` precisely targets container die events.

Question 35: A Docker Certified Associate is asked to sign off on a container deployment they have not reviewed. What is the correct professional response?

Delegate sign-off to a junior team member
Sign off with a disclaimer that they did not review it
Sign off to avoid slowing down the team
Refuse to sign off without personally reviewing the deployment artifacts and security checks (Correct answer)

Correct answer: Refuse to sign off without personally reviewing the deployment artifacts and security checks

Professional certifications carry ethical responsibility; signing off on unreviewed work exposes both the individual and the organization to unnecessary risk.

Question 36: What is the default network driver used when you create a container without specifying a network?

none
overlay
host
bridge (Correct answer)

Correct answer: bridge

Docker uses the bridge network driver by default when no network is specified at container creation.

Question 37: What is a milestone in DCA project management?

A physical marker at a construction site every mile
A daily task that must be completed by each team member
A significant event or deliverable marking progress at a key point in the project timeline (Correct answer)
An optional checkpoint that can be skipped if needed

Correct answer: A significant event or deliverable marking progress at a key point in the project timeline

Milestones are significant checkpoints or achievements in a project timeline that mark the completion of major deliverables, phase transitions, or critical decision points.

Question 38: Which open-source license requires that derivative works be distributed under the same license terms as the original software?

MIT License
BSD 2-Clause License
Apache 2.0 License
GNU GPL (Copyleft) (Correct answer)

Correct answer: GNU GPL (Copyleft)

The GNU GPL is a copyleft license that requires derivative works to be released under the same GPL terms.

Question 39: A security team discovers that several Docker containers are running with the `--privileged` flag in production. What is the PRIMARY risk this introduces?

Containers gain access to all host devices and can escape the container isolation boundary (Correct answer)
Containers cannot communicate with each other over the default bridge network
Containers are prevented from pulling updated images from a registry
Containers consume more CPU and memory resources than necessary

Correct answer: Containers gain access to all host devices and can escape the container isolation boundary

The `--privileged` flag grants the container nearly all capabilities of the host kernel, allowing potential container escape and full host compromise.

Question 40: What does the `--format` flag in `docker stats` allow you to do?

Output stats as JSON automatically
Set the refresh interval
Customize the output columns using Go templates (Correct answer)
Filter containers by resource threshold

Correct answer: Customize the output columns using Go templates

`--format` accepts Go template strings to select and arrange which stats fields are displayed.

Question 41: What does the `PIDS` column in `docker stats` output represent?

Number of processes or threads running inside the container (Correct answer)
Total number of Docker processes on the host
Process ID of the container's init process
Number of paused containers

Correct answer: Number of processes or threads running inside the container

The `PIDS` column shows how many processes or threads are currently running inside that container.

Question 42: Under FedRAMP authorization, which Docker registry practice is required for containerized applications in U.S. federal cloud environments?

Exempting containers from FedRAMP controls due to their ephemeral nature
Using only Docker Hub public images without additional controls
Pulling images at runtime from external registries to reduce storage costs
Operating a private registry within the FedRAMP authorization boundary with continuous image scanning (Correct answer)

Correct answer: Operating a private registry within the FedRAMP authorization boundary with continuous image scanning

FedRAMP requires all components within the authorization boundary to be controlled; a private registry with continuous scanning ensures images meet the required security posture.

Question 43: What is a key performance indicator (KPI) in DCA quality management?

An employee's personal opinion about job satisfaction
A type of financial investment instrument
A decorative dashboard element with no practical use
A measurable value demonstrating how effectively objectives are being achieved (Correct answer)

Correct answer: A measurable value demonstrating how effectively objectives are being achieved

KPIs are quantifiable measurements tied to specific objectives that provide actionable data about performance, enabling evidence-based decisions about process improvements and resource allocation.

Question 44: The MIT License is considered permissive. What is the primary legal obligation when incorporating MIT-licensed code into a Docker image for commercial distribution?

Pay licensing fees to the original author
Open-source the entire application
Retain the original copyright notice and license text (Correct answer)
Register the derivative work with the U.S. Copyright Office

Correct answer: Retain the original copyright notice and license text

The MIT License only requires preserving the copyright notice and license text in distributions, with no restrictions on commercial use or proprietary derivatives.

Question 45: What does 'routing mesh' mean in Docker Swarm networking?

Any Swarm node can accept requests on a published port and route them to a service container (Correct answer)
A DNS round-robin load balancing technique
A method for assigning static IPs to Swarm services
A process for encrypting overlay network traffic

Correct answer: Any Swarm node can accept requests on a published port and route them to a service container

Swarm's routing mesh allows any node to accept incoming connections on a published port and route them to a service task on any node.

Question 46: A container workload requires reading from `/etc/passwd` on the host. An assessor flags this as high risk. What mitigation maintains functionality while reducing risk?

Use `--cap-add SYS_PTRACE` to allow the container to inspect host processes
Copy `/etc/passwd` into the container image during the build stage
Run the container with `--privileged` to ensure full host filesystem access
Mount the file as a read-only bind mount (`--mount type=bind,source=/etc/passwd,target=/etc/passwd,readonly`) (Correct answer)

Correct answer: Mount the file as a read-only bind mount (`--mount type=bind,source=/etc/passwd,target=/etc/passwd,readonly`)

A read-only bind mount grants the container access to the specific file without allowing writes or granting broader host filesystem permissions.

Question 47: What command creates a user-defined bridge network named 'my-network'?

docker create network my-network
docker network add my-network
docker network create --driver bridge my-network (Correct answer)
docker network init my-network

Correct answer: docker network create --driver bridge my-network

The `docker network create --driver bridge my-network` command creates a user-defined bridge network.

Question 48: Which command connects a running container to an additional network?

docker container network add my-network my-container
docker network connect my-network my-container (Correct answer)
docker attach network my-network my-container
docker network join my-network my-container

Correct answer: docker network connect my-network my-container

The `docker network connect` command attaches a running container to an existing network.

Question 49: What does the `--read-only` flag do when running a Docker container?

Prevents the container from reading files on the host
Restricts the container's network to read-only monitoring
Makes the container's root filesystem read-only (Correct answer)
Prevents pulling updated versions of the container image

Correct answer: Makes the container's root filesystem read-only

The `--read-only` flag mounts the container's root filesystem as read-only, preventing any process from writing to it.

Question 50: Which Docker Swarm command promotes a worker node to a manager?

docker node update --role manager <NODE>
docker swarm promote <NODE>
docker node promote <NODE> (Correct answer)
docker swarm update --manager <NODE>

Correct answer: docker node promote <NODE>

`docker node promote <NODE>` changes a worker's role to manager within the swarm cluster.

Question 51: What is the default subnet used by Docker's default bridge network (docker0)?

192.168.0.0/16
10.0.0.0/8
192.168.1.0/24
172.17.0.0/16 (Correct answer)

Correct answer: 172.17.0.0/16

Docker's default bridge network uses the 172.17.0.0/16 subnet by default.

Question 52: A developer discovers a critical vulnerability in a public Docker image used by their organization. What is the most ethical course of action?

Ignore it since it is a third-party image and not their responsibility
Post the vulnerability details on social media to warn the community
Report the vulnerability privately to the image maintainer before public disclosure (Correct answer)
Delete the image from the registry immediately without notifying anyone

Correct answer: Report the vulnerability privately to the image maintainer before public disclosure

Responsible disclosure means privately notifying the maintainer first so they can issue a patch before the vulnerability is publicly known.

Question 53: Which command exports a container's filesystem as a tar archive for offline security auditing?

docker export (Correct answer)
docker save
docker cp --all
docker image export

Correct answer: docker export

'docker export' flattens a container's filesystem (all layers merged) into a tar archive, useful for offline inspection or security auditing tools.

Question 54: When planning a migration of a monolithic application to Docker containers, which approach best minimizes risk?

Deploy containers only in development and keep production on bare metal
Rewrite all services from scratch before containerizing
Containerize all services simultaneously in a single sprint
Strangler fig pattern — incrementally containerize one service at a time (Correct answer)

Correct answer: Strangler fig pattern — incrementally containerize one service at a time

The strangler fig pattern reduces risk by migrating one service at a time, allowing rollback without full-system impact.

Question 55: A healthcare organization uses Docker for a telehealth platform. Under HITECH Act provisions, breach notification timelines apply when PHI is exposed. What Docker control helps detect a potential breach quickly?

Runtime security monitoring with anomaly detection for unexpected container behaviors (Correct answer)
Using bridge networking for all containers
Weekly manual review of container logs
Setting container restart policies to 'always'

Correct answer: Runtime security monitoring with anomaly detection for unexpected container behaviors

Runtime monitoring with anomaly detection enables rapid detection of unauthorized access or data exfiltration, supporting the HITECH 60-day breach notification requirement.

Docker Certified Associate (DCA)

The Docker Certified Associate exam validates skills in containerization using Docker, covering orchestration, image management, networking, security, installation, and storage. It is administered by Mirantis and targets intermediate-level Docker practitioners.

Questions

90 min

Time Limit

65%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds