Docker Certified Associate (DCA) — Questions and Answers

Question 1: What does return on investment (ROI) measure in DCA financial analysis?

The number of employees in the organization
The physical return of purchased goods
The total revenue of an organization
The gain or loss generated relative to the amount of money invested (Correct answer)

Correct answer: The gain or loss generated relative to the amount of money invested

ROI measures the efficiency of an investment by comparing the net gain or loss to the initial investment cost, expressed as a percentage. It helps compare the profitability of different investment options.

Question 2: What is a compliance audit in DCA practice?

A financial profit and loss assessment
A routine customer satisfaction survey
A systematic review verifying adherence to regulatory requirements and policies (Correct answer)
An annual employee performance evaluation

Correct answer: A systematic review verifying adherence to regulatory requirements and policies

A compliance audit systematically examines adherence to external regulations, internal policies, and industry standards, identifying gaps and recommending corrective actions.

Question 3: You need to extract the container's IP address from `docker inspect` output using a Go template. Which template expression is correct?

{{.Config.IPAddress}}
{{.HostConfig.IPAddress}}
{{.NetworkSettings.IPAddress}} (Correct answer)
{{.Network.IPAddress}}

Correct answer: {{.NetworkSettings.IPAddress}}

The IP address lives at `{{.NetworkSettings.IPAddress}}` in the inspect JSON structure.

Question 4: During execution planning, a team needs containers to communicate using service names as hostnames within a Docker Compose application. What enables this?

Docker Compose automatically creates a network where service names resolve as DNS hostnames (Correct answer)
Containers must use --add-host flags to register each other's names
An external DNS server must be configured and referenced in each service
Service name DNS only works when --network=host is specified

Correct answer: Docker Compose automatically creates a network where service names resolve as DNS hostnames

Docker Compose creates a default bridge network with embedded DNS so each service name resolves to the correct container IP.

Question 5: An SRE team wants to communicate resource constraints to developers. Which Docker flag limits a container's CPU usage?

--cpus (Correct answer)
--cpu-cap
--cpu-limit
--max-cpu

Correct answer: --cpus

The `--cpus` flag specifies the number of CPUs available to the container as a decimal value.

Question 6: Which open-source tool stack is commonly integrated with Docker to provide container-level resource metrics for cost attribution and chargeback?

Docker Bench Security
Portainer Community Edition
cAdvisor with Prometheus and Grafana (Correct answer)
Docker Registry UI

Correct answer: cAdvisor with Prometheus and Grafana

cAdvisor exposes per-container resource metrics that Prometheus scrapes and Grafana visualizes, enabling department-level cost reporting.

Question 7: Which `docker run` option configures a container to use a specific DNS server?

--nameserver
--dns (Correct answer)
--dns-server
--resolve

Correct answer: --dns

The `--dns` flag in `docker run` specifies a custom DNS server IP address for the container.

Question 8: What is the purpose of DNS resolution in user-defined Docker networks?

To allow containers to communicate using container names as hostnames (Correct answer)
To assign IP addresses to containers
To route traffic between Docker hosts
To expose container ports to the host

Correct answer: To allow containers to communicate using container names as hostnames

User-defined networks include an embedded DNS server that allows containers to resolve each other by container name.

Question 9: A compliance team asks how to confirm a Docker image has not been tampered with before deployment. What mechanism should you verify?

Checking the image creation date only
Using docker diff after pulling
Docker Content Trust (DCT) with image signing (Correct answer)
Comparing image names across registries

Correct answer: Docker Content Trust (DCT) with image signing

Docker Content Trust uses cryptographic signatures to verify image integrity and publisher authenticity before deployment.

Question 10: What risk is introduced by running long-lived, stateful data directly inside a container's writable layer rather than in a Docker volume?

The writable layer encrypts data automatically, causing performance issues
Data loss on container removal, since the writable layer is destroyed when the container is deleted (Correct answer)
Data stored in the writable layer is replicated to all nodes in a Swarm cluster
Docker Compose cannot manage containers that write to their writable layer

Correct answer: Data loss on container removal, since the writable layer is destroyed when the container is deleted

A container's writable layer is ephemeral and tied to the container's lifecycle; data not stored in a named volume is permanently lost when the container is removed.

Question 11: A company runs 200 microservices in Docker Swarm. Resource limits are not set on any service. What is the primary financial risk?

Services will not start without resource limits
Images will fail to pull from the registry
A noisy-neighbor container can exhaust host resources, causing unplanned scaling costs (Correct answer)
Docker Swarm requires paid licensing without resource limits

Correct answer: A noisy-neighbor container can exhaust host resources, causing unplanned scaling costs

Without limits, a single runaway container can consume all host resources, forcing emergency scale-outs and unexpected cloud spend.

Question 12: What happens to containers connected to the 'none' network driver?

They have no network access (Correct answer)
They are connected to all available networks
They use a bridge connection
They share the host network stack

Correct answer: They have no network access

The none network driver completely disables all networking for the container.

Question 13: What format does `docker inspect` use to output container metadata by default?

YAML
JSON (Correct answer)
XML
TOML

Correct answer: JSON

`docker inspect` outputs container metadata as a JSON array by default.

Question 14: A network engineer needs to understand how Docker assigns DNS names to services in a user-defined bridge network. What is the default behavior?

DNS resolution requires an external nameserver
All containers share a single IP with different ports
Containers are reachable by their name as DNS hostnames (Correct answer)
Docker uses /etc/hosts only, no embedded DNS

Correct answer: Containers are reachable by their name as DNS hostnames

User-defined bridge networks include an embedded DNS server that resolves container names to their IP addresses automatically.

Question 15: What is scope creep in DCA project management?

The process of reducing project deliverables
A technique for incrementally adding features
Uncontrolled expansion of project scope without corresponding adjustments to time, cost, and resources (Correct answer)
The natural growth of a project within planned parameters

Correct answer: Uncontrolled expansion of project scope without corresponding adjustments to time, cost, and resources

Scope creep occurs when new requirements or features are added without formal evaluation and approval, leading to schedule delays, budget overruns, and resource strain.

Question 16: What does professional competency require of a DCA practitioner?

Accepting all work regardless of personal qualifications
Relying solely on the original certification training received
Learning only during initial formal schooling or training
Maintaining current knowledge through continuing education within qualified areas (Correct answer)

Correct answer: Maintaining current knowledge through continuing education within qualified areas

Professional competency requires ongoing education, staying current with field developments, and practicing only within demonstrated areas of qualification.

Question 17: What does the `--read-only` flag do when running a Docker container?

Makes the container's root filesystem read-only (Correct answer)
Prevents the container from reading files on the host
Prevents pulling updated versions of the container image
Restricts the container's network to read-only monitoring

Correct answer: Makes the container's root filesystem read-only

The `--read-only` flag mounts the container's root filesystem as read-only, preventing any process from writing to it.

Question 18: A product manager wants to understand why a container exited unexpectedly. Which command provides the most relevant information first?

docker diff <container>
docker logs <container> (Correct answer)
docker commit <container>
docker export <container>

Correct answer: docker logs <container>

`docker logs` shows the stdout/stderr output of a container, which typically reveals the reason for an unexpected exit.

Question 19: Which 'docker system df' output column tells you how much disk space could be reclaimed by pruning?

ACTIVE
SIZE
SHARED SIZE
RECLAIMABLE (Correct answer)

Correct answer: RECLAIMABLE

The RECLAIMABLE column shows how much disk space would be freed if unused images, containers, and volumes were removed.

Question 20: When contributing a Docker-related tool to an open-source project, what professional standard must be followed regarding licensing?

Include any third-party code without attribution since it is open source
License compliance is only required for commercial projects
Choose a more restrictive license than the project to protect your work
Ensure your contribution complies with the project's license and properly attributes dependencies (Correct answer)

Correct answer: Ensure your contribution complies with the project's license and properly attributes dependencies

Open-source contributions must comply with the project's existing license and properly attribute any included third-party code.

Question 21: How do you scale a replicated service named 'web' to 5 replicas in Docker Swarm?

docker service scale web=5 (Correct answer)
docker service scale web 5
docker swarm scale --service web --replicas 5
docker service update --replicas 5 web

Correct answer: docker service scale web=5

`docker service scale web=5` is the correct syntax, using `name=count` format to set the desired replica count.

Question 22: Which Linux feature is used by Docker to enforce CPU and memory resource limits on containers?

Namespaces
Seccomp profiles
cgroups (control groups) (Correct answer)
AppArmor policies

Correct answer: cgroups (control groups)

Linux cgroups (control groups) limit, prioritize, and monitor resource usage including CPU, memory, and I/O for Docker containers.

Question 23: In Docker Swarm, what is a 'task'?

A scheduled cron job inside a container
A named network attached to a service
An atomic unit of work representing one container instance of a service (Correct answer)
A health-check probe definition

Correct answer: An atomic unit of work representing one container instance of a service

A task is the smallest schedulable unit in Swarm — it represents a single running container assigned to a node.

Question 24: Which approach best reflects professional standards when decommissioning a Docker-based service that stores sensitive data?

Stop the containers and leave the volumes intact indefinitely
Transfer the data volumes to a development environment for reuse
Archive the images to a public registry for future reference
Remove containers, securely wipe associated volumes, and revoke all related credentials and access (Correct answer)

Correct answer: Remove containers, securely wipe associated volumes, and revoke all related credentials and access

Secure decommissioning requires stopping services, wiping sensitive data from volumes, and revoking all credentials to prevent data leakage.

Question 25: A team member shares a Dockerfile that pulls a base image using 'latest' tag in production. What professional concern should be raised?

Using 'latest' reduces reproducibility and can introduce unexpected breaking changes (Correct answer)
There is no concern; Docker automatically pins the digest
The 'latest' tag is required by Docker best practices
The 'latest' tag is always preferred for security patches

Correct answer: Using 'latest' reduces reproducibility and can introduce unexpected breaking changes

The 'latest' tag is mutable and can change unexpectedly, making builds non-reproducible and potentially breaking production.

Question 26: How do regulations differ from industry standards in DCA practice?

They are exactly the same thing in all contexts
Regulations are legally binding; standards are typically voluntary guidelines (Correct answer)
Regulations apply only to individuals, not organizations
Standards are always stricter than regulations

Correct answer: Regulations are legally binding; standards are typically voluntary guidelines

Regulations are legally enforceable rules from government agencies, while standards are developed by industry bodies and are typically voluntary, though they may become requirements through regulatory adoption.

Question 27: What is change management in DCA technology operations?

A process for replacing all legacy systems at once
Making any changes immediately without review or documentation
A structured process for evaluating, approving, and implementing changes to minimize risk (Correct answer)
A method for changing employee passwords monthly

Correct answer: A structured process for evaluating, approving, and implementing changes to minimize risk

IT change management ensures that all changes to systems and infrastructure are evaluated for risk, properly approved, tested, documented, and implemented in a controlled manner to minimize service disruption.

Question 28: What Linux mandatory access control (MAC) systems can Docker integrate with for additional container security?

Both AppArmor and SELinux, depending on the host OS (Correct answer)
Neither; Docker uses its own MAC system
Only AppArmor on Debian-based systems
Only SELinux on Red Hat-based systems

Correct answer: Both AppArmor and SELinux, depending on the host OS

Docker can integrate with both AppArmor (on Ubuntu/Debian hosts) and SELinux (on RHEL/CentOS hosts) to apply mandatory access control policies to containers.

Question 29: Your CI pipeline pulls the same base image hundreds of times per day from Docker Hub. Which solution reduces both pull latency and potential rate-limit costs?

Set up a Docker Hub pull-through cache or mirror registry (Correct answer)
Use --no-cache on all docker build commands
Increase runner machine CPU to speed up pulls
Switch all images to scratch base

Correct answer: Set up a Docker Hub pull-through cache or mirror registry

A pull-through cache stores images locally on first pull and serves subsequent requests without hitting Docker Hub, avoiding rate limits.

Question 30: Which command removes a Docker network?

docker remove network my-network
docker network rm my-network (Correct answer)
docker network delete my-network
docker network destroy my-network

Correct answer: docker network rm my-network

The `docker network rm` command removes one or more Docker networks by name or ID.

Question 31: An assessor recommends enabling AppArmor profiles for Docker containers. What category of risk does this specifically address?

Unauthorized file system access and process execution within the container (Correct answer)
Network-based denial-of-service attacks targeting the container's open ports
Registry authentication failures during image pulls
Misconfigured Docker Compose service dependencies

Correct answer: Unauthorized file system access and process execution within the container

AppArmor profiles use mandatory access control to restrict which files, directories, and executables a container process can access, limiting exploit impact.

Question 32: In Docker Swarm, what is the purpose of the '--update-monitor' duration flag on 'docker service update'?

Defines the window after each task update during which failures count against the failure ratio (Correct answer)
Specifies the timeout before a task is considered failed
Sets how long the update waits between each task replacement
Controls how long Swarm waits before starting the rollback

Correct answer: Defines the window after each task update during which failures count against the failure ratio

'--update-monitor' sets the observation window after each task is updated; failures within this window increment the failure count used against '--update-max-failure-ratio'.

Question 33: Which Docker Trusted Registry (DTR) feature enables organizations to enforce policy that only vulnerability-free images can be promoted to production, supporting compliance requirements?

Repository webhooks
Garbage collection scheduling
Image mirroring
Promotion policies based on image scan results (Correct answer)

Correct answer: Promotion policies based on image scan results

DTR promotion policies allow automated enforcement of quality gates, blocking images with critical vulnerabilities from being promoted to production repositories.

Question 34: What command creates a user-defined bridge network named 'my-network'?

docker network add my-network
docker create network my-network
docker network create --driver bridge my-network (Correct answer)
docker network init my-network

Correct answer: docker network create --driver bridge my-network

The `docker network create --driver bridge my-network` command creates a user-defined bridge network.

Question 35: What is the difference between quantitative and qualitative data in DCA analysis?

Quantitative data is numerical and measurable; qualitative data is descriptive and categorical (Correct answer)
Quantitative data cannot be used in professional settings
Qualitative data is always more accurate than quantitative
They are interchangeable terms for the same type of data

Correct answer: Quantitative data is numerical and measurable; qualitative data is descriptive and categorical

Quantitative data consists of numerical measurements that can be statistically analyzed, while qualitative data consists of descriptive observations, opinions, and categories that provide context and depth.

Question 36: The MIT License is considered permissive. What is the primary legal obligation when incorporating MIT-licensed code into a Docker image for commercial distribution?

Retain the original copyright notice and license text (Correct answer)
Open-source the entire application
Register the derivative work with the U.S. Copyright Office
Pay licensing fees to the original author

Correct answer: Retain the original copyright notice and license text

The MIT License only requires preserving the copyright notice and license text in distributions, with no restrictions on commercial use or proprietary derivatives.

Question 37: A team uses 'docker diff' on a running container. What does this command reveal that supports quality assurance?

The network configuration delta from the base image
Differences between the container image and the latest registry version
Differences between two image tags
Files added, changed, or deleted inside the container's writable layer at runtime (Correct answer)

Correct answer: Files added, changed, or deleted inside the container's writable layer at runtime

'docker diff' lists filesystem changes (A=added, C=changed, D=deleted) in the container's writable layer compared to the image, helping identify unexpected runtime mutations.

Question 38: Which Docker command runs a container's built-in health check immediately and returns the result without waiting for the interval?

docker exec <container> healthcheck
docker inspect --health
There is no way to trigger a health check on demand (Correct answer)
docker run --health-cmd with --health-interval=0

Correct answer: There is no way to trigger a health check on demand

Docker does not provide a direct command to trigger a HEALTHCHECK on demand; you must exec into the container and run the check command manually.

Question 39: When using the `gelf` log driver, logs are sent to which type of endpoint?

Amazon CloudWatch
A Redis queue
Elasticsearch HTTP endpoint
A Graylog Extended Log Format UDP/TCP endpoint (Correct answer)

Correct answer: A Graylog Extended Log Format UDP/TCP endpoint

The `gelf` driver sends logs in Graylog Extended Log Format to a Graylog or compatible GELF endpoint.

Question 40: What are potential consequences of non-compliance in DCA practice?

Fines, license revocation, legal liability, and reputational damage (Correct answer)
Automatic contract renewal regardless of violations
A simple verbal warning with no follow-up
No consequences if the violation is not discovered

Correct answer: Fines, license revocation, legal liability, and reputational damage

Non-compliance can result in monetary fines, suspension or revocation of professional licenses, civil or criminal liability, and lasting damage to professional reputation.

Question 41: You run `docker logs --since 2h api`. What does this output?

Logs generated in the past 2 hours of wall-clock time (Correct answer)
Logs from the last 2 hours of uptime
The first 2 hours of container logs only
Logs timestamped exactly 2 hours ago

Correct answer: Logs generated in the past 2 hours of wall-clock time

`--since 2h` filters logs to those produced within the last 2 hours of real (wall-clock) time.

Question 42: A project requires Docker images to be reproducible across CI/CD pipelines. Which Dockerfile best practice ensures this?

Rebuild images without caching to ensure freshness
Use FROM scratch to avoid external dependencies
Pin base image versions with specific digest or tag (Correct answer)
Use the 'latest' tag for base images to always get security patches

Correct answer: Pin base image versions with specific digest or tag

Pinning base image versions with specific tags or SHA digests ensures identical builds across all environments.

Question 43: What is the default network driver created when Docker is installed on a Linux host?

host
macvlan
bridge (Correct answer)
overlay

Correct answer: bridge

Docker creates a default `bridge` network (docker0) on installation, used by containers unless another network is specified.

Question 44: What does the `--network host` flag do when running a container?

Disables all networking
Creates a new isolated network
Shares the host's network namespace with the container (Correct answer)
Connects the container to a bridge network

Correct answer: Shares the host's network namespace with the container

The `--network host` flag removes network isolation between the container and the Docker host.

Question 45: Which command displays all Docker networks on a host?

docker network list --all
docker network ls (Correct answer)
docker networks
docker network show

Correct answer: docker network ls

The `docker network ls` command lists all networks available on the Docker host.

Question 46: What does the `--format` flag in `docker stats` allow you to do?

Customize the output columns using Go templates (Correct answer)
Set the refresh interval
Output stats as JSON automatically
Filter containers by resource threshold

Correct answer: Customize the output columns using Go templates

`--format` accepts Go template strings to select and arrange which stats fields are displayed.

Question 47: Which Dockerfile instruction, when used incorrectly, most commonly leads to unnecessarily large image sizes that fail image size quality gates?

EXPOSE
FROM
COPY
RUN (installing packages without cleaning up cache in the same layer) (Correct answer)

Correct answer: RUN (installing packages without cleaning up cache in the same layer)

Each RUN creates a new layer; installing packages and cleaning up in separate RUN instructions leaves the package cache committed in an intermediate layer, bloating the image.

Question 48: What does the `--cap-drop ALL` flag do when running a container?

Disables all bind-mounted volumes
Prevents the container from forking child processes
Drops all Linux capabilities from the container process (Correct answer)
Removes the container from all networks

Correct answer: Drops all Linux capabilities from the container process

The `--cap-drop ALL` flag removes all Linux capabilities from the container, which can then be selectively restored with `--cap-add`.

Question 49: A team wants to prevent 'latest' tags from being deployed to production Swarm services. Which approach enforces this policy?

Use Docker Content Trust and only sign versioned tags
Set DOCKER_TAG=latest in the daemon config
Configure Swarm with --no-latest flag
Use image pinning in stack files with explicit digest references (Correct answer)

Correct answer: Use image pinning in stack files with explicit digest references

Referencing images by digest in stack compose files ensures exactly the tested image is deployed, preventing accidental 'latest' mutations.

Question 50: Which practice best reduces the attack surface of a production Docker image for a compiled Go application?

Use Alpine Linux with all packages installed
Add all debugging tools for incident response
Use the official golang:latest image as the final stage
Use a multi-stage build and copy only the binary into a 'FROM scratch' final image (Correct answer)

Correct answer: Use a multi-stage build and copy only the binary into a 'FROM scratch' final image

A 'FROM scratch' final stage containing only the statically compiled binary eliminates all OS packages, reducing CVE exposure to nearly zero.

Question 51: What does 'routing mesh' mean in Docker Swarm networking?

Any Swarm node can accept requests on a published port and route them to a service container (Correct answer)
A DNS round-robin load balancing technique
A method for assigning static IPs to Swarm services
A process for encrypting overlay network traffic

Correct answer: Any Swarm node can accept requests on a published port and route them to a service container

Swarm's routing mesh allows any node to accept incoming connections on a published port and route them to a service task on any node.

Question 52: A release manager asks how to roll back a Docker Swarm service update that introduced errors. Which command should you use?

docker service rollback <service> (Correct answer)
docker rollback service <service>
docker swarm revert <service>
docker service update --rollback <service>

Correct answer: docker service rollback <service>

`docker service rollback <service>` reverts a service to its previous configuration in Docker Swarm.

Question 53: A Dockerfile HEALTHCHECK reports 'unhealthy' but the container keeps running. What is the default Docker behavior in this situation?

The container continues running; orchestrators like Swarm may reschedule it (Correct answer)
Docker automatically restarts the container
Docker stops and removes the container
Docker pauses the container until it becomes healthy

Correct answer: The container continues running; orchestrators like Swarm may reschedule it

Docker itself does not stop an unhealthy standalone container; it is up to orchestrators (Swarm, Kubernetes) to act on the unhealthy status.

Question 54: Which professional standard governs how Docker audit logs should be handled in a regulated industry?

Only failed commands need to be logged
Audit logs can be deleted weekly to save disk space
Audit logs must be retained for the period required by regulation, stored securely, and protected from tampering (Correct answer)
Audit logs are optional if the team uses Docker Enterprise

Correct answer: Audit logs must be retained for the period required by regulation, stored securely, and protected from tampering

Regulated industries require audit logs to be retained, secured, and tamper-proof to support compliance and forensic investigations.

Question 55: A GDPR Data Protection Impact Assessment (DPIA) is being conducted for a new Docker-based analytics platform. When is a DPIA legally required under GDPR Article 35?

When processing is likely to result in high risk to individuals' rights, such as large-scale profiling or systematic monitoring (Correct answer)
Only for healthcare and financial data regardless of scale
Only when processing data of more than 1 million users
Whenever Docker containers are deployed in EU data centers

Correct answer: When processing is likely to result in high risk to individuals' rights, such as large-scale profiling or systematic monitoring

GDPR Article 35 mandates a DPIA before processing that is likely to result in high risk, including large-scale profiling, systematic monitoring, or processing sensitive categories of data.

Docker Certified Associate (DCA)

The Docker Certified Associate exam validates skills in containerization using Docker, covering orchestration, image management, networking, security, installation, and storage. It is administered by Mirantis and targets intermediate-level Docker practitioners.

Questions

90 min

Time Limit

65%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds