Docker Certified Associate (DCA) — Questions and Answers

Question 1: A developer asks how to verify that a container's published port is actively accepting connections before marking it ready. What Docker feature supports this?

ENV PORT variable
EXPOSE instruction alone
CMD with a port-bind test
HEALTHCHECK instruction in the Dockerfile (Correct answer)

Correct answer: HEALTHCHECK instruction in the Dockerfile

HEALTHCHECK defines a command Docker runs periodically to determine if the container is healthy and ready.

Question 2: Which network driver assigns a MAC address and connects containers directly to the physical network?

overlay
bridge
macvlan (Correct answer)
host

Correct answer: macvlan

The macvlan network driver assigns a unique MAC address to each container, making it appear as a physical device on the network.

Question 3: Which 'docker stats' metric is most useful for detecting a memory leak in a containerized application?

MEM USAGE / LIMIT trending upward over time (Correct answer)
CPU %
BLOCK I/O
NET I/O

Correct answer: MEM USAGE / LIMIT trending upward over time

A steadily increasing MEM USAGE value that approaches the LIMIT over time is the classic signature of a memory leak in a container.

Question 4: What is the purpose of DNS resolution in user-defined Docker networks?

To allow containers to communicate using container names as hostnames (Correct answer)
To assign IP addresses to containers
To route traffic between Docker hosts
To expose container ports to the host

Correct answer: To allow containers to communicate using container names as hostnames

User-defined networks include an embedded DNS server that allows containers to resolve each other by container name.

Question 5: When planning a migration of a monolithic application to Docker containers, which approach best minimizes risk?

Containerize all services simultaneously in a single sprint
Deploy containers only in development and keep production on bare metal
Rewrite all services from scratch before containerizing
Strangler fig pattern — incrementally containerize one service at a time (Correct answer)

Correct answer: Strangler fig pattern — incrementally containerize one service at a time

The strangler fig pattern reduces risk by migrating one service at a time, allowing rollback without full-system impact.

Question 6: Which port publishing flag maps host port 8080 to container port 80?

-P 8080:80
-p 80:8080
--port 8080-80
-p 8080:80 (Correct answer)

Correct answer: -p 8080:80

The `-p 8080:80` flag maps host port 8080 to container port 80 using the host:container format.

Question 7: In Docker Swarm, what does setting '--rollback-parallelism 0' on a service accomplish?

Rolls back all tasks simultaneously instead of one at a time (Correct answer)
Sets rollback delay to zero seconds
Disables automatic rollback entirely
Pauses rollback between each task for manual approval

Correct answer: Rolls back all tasks simultaneously instead of one at a time

A parallelism of 0 means all tasks are rolled back at the same time, which is the fastest but most disruptive rollback strategy.

Question 8: Why is regular review important in DCA risk management?

Because conditions change and new risks emerge requiring updated assessments (Correct answer)
Reviews are only needed after incidents occur
Regulations prohibit reviewing risks more than annually
Risk assessments remain valid indefinitely once completed

Correct answer: Because conditions change and new risks emerge requiring updated assessments

Regular reviews ensure risk assessments remain current as conditions change, new hazards emerge, operations evolve, and lessons from incidents or near-misses are incorporated into updated controls.

Question 9: What is scope creep in DCA project management?

The natural growth of a project within planned parameters
Uncontrolled expansion of project scope without corresponding adjustments to time, cost, and resources (Correct answer)
A technique for incrementally adding features
The process of reducing project deliverables

Correct answer: Uncontrolled expansion of project scope without corresponding adjustments to time, cost, and resources

Scope creep occurs when new requirements or features are added without formal evaluation and approval, leading to schedule delays, budget overruns, and resource strain.

Question 10: A risk assessment identifies that Docker build cache is being shared across multiple teams in a CI environment. What is the primary security concern?

Shared cache increases build times because of cache invalidation conflicts
Build cache sharing disables layer deduplication in the image registry
Shared build cache prevents Docker Content Trust from verifying image signatures
A malicious or compromised build from one team could poison the shared cache and inject artifacts into other teams' images (Correct answer)

Correct answer: A malicious or compromised build from one team could poison the shared cache and inject artifacts into other teams' images

Cache poisoning allows a tampered layer to be reused by subsequent builds, silently introducing malicious code into images built by other teams.

Question 11: What is the function of 'docker service rollback' compared to 'docker service update --rollback'?

'docker service rollback' deletes the service and redeploys from a snapshot
'docker service rollback' reverts to the previous service spec; '--rollback' is used to configure rollback parameters (Correct answer)
Only 'docker service update --rollback' can revert image changes
They are identical commands with different syntax

Correct answer: 'docker service rollback' reverts to the previous service spec; '--rollback' is used to configure rollback parameters

'docker service rollback' is a dedicated command that immediately reverts the service to its previous configuration, while '--rollback' in update sets rollback policy parameters.

Question 12: Which flag in `docker service create` limits the maximum amount of memory a service's tasks can use?

--memory-limit
--reserve-memory
--constraint memory
--limit-memory (Correct answer)

Correct answer: --limit-memory

`--limit-memory` sets the hard memory ceiling per task; if exceeded, the container's process may be OOM-killed.

Question 13: Which Linux feature does Docker use to filter the system calls a container can make to the kernel?

AppArmor
Namespaces
Seccomp (Correct answer)
SELinux

Correct answer: Seccomp

Docker uses seccomp (secure computing mode) profiles to restrict which system calls a container process can invoke.

Question 14: What is multi-factor authentication (MFA) in DCA security?

A security method requiring two or more verification factors to gain access (Correct answer)
A method for encrypting stored data
A type of network firewall configuration
Using the same password for multiple accounts for convenience

Correct answer: A security method requiring two or more verification factors to gain access

MFA requires users to provide two or more distinct verification factors (something they know, something they have, something they are) before gaining access, significantly reducing unauthorized access risk.

Question 15: An auditor asks for proof that a containerized production environment has no unauthorized configuration changes. Which Docker/Kubernetes approach best satisfies this Infrastructure as Code compliance requirement?

Allowing operators to exec into containers and make live changes
Running containers in privileged mode for maximum flexibility
Using GitOps workflows where all configuration changes are tracked in version control with signed commits (Correct answer)
Manually documenting container configurations after each change

Correct answer: Using GitOps workflows where all configuration changes are tracked in version control with signed commits

GitOps enforces that all configuration changes flow through version-controlled, auditable pipelines, providing a complete change history satisfying compliance audit requirements.

Question 16: What does the `-P` (uppercase) flag do when used with `docker run`?

Maps all ports to port 80 on the host
Limits port exposure to privileged ports only
Publishes all EXPOSE ports to random ephemeral host ports (Correct answer)
Disables port publishing entirely

Correct answer: Publishes all EXPOSE ports to random ephemeral host ports

The `-P` flag automatically publishes all ports declared with EXPOSE in the Dockerfile to random host ports.

Question 17: A company must demonstrate that only authorized users accessed container registries during an audit. Which Docker Enterprise feature primarily supports this requirement?

Role-Based Access Control (RBAC) with audit logs in Docker Trusted Registry (Correct answer)
Automated container restarts via orchestration
Docker Content Trust (DCT)
Image scanning with Snyk

Correct answer: Role-Based Access Control (RBAC) with audit logs in Docker Trusted Registry

DTR's RBAC combined with audit logs provides a record of who accessed which images and when, satisfying access control audit requirements.

Question 18: In Docker Swarm, which network is automatically created to handle load balancing for published service ports?

An ingress overlay network (Correct answer)
A default bridge network
A macvlan network
A host network

Correct answer: An ingress overlay network

Docker Swarm automatically creates an ingress overlay network to implement the routing mesh for published ports.

Question 19: When running containers in a multi-tenant Docker environment, which security standard is most critical for ethical isolation?

Enforcing namespace isolation, network segmentation, and resource quotas per tenant (Correct answer)
Mounting the host filesystem into tenant containers for performance
Sharing the same Docker network for all tenants to simplify management
Running all containers as root for maximum compatibility

Correct answer: Enforcing namespace isolation, network segmentation, and resource quotas per tenant

Multi-tenant environments require strict namespace isolation, network segmentation, and resource quotas to prevent one tenant from affecting another.

Question 20: What is the key difference between 'replicated' and 'global' service modes in Docker Swarm?

Replicated services run on specific nodes; global services run on all nodes
Replicated services run a specified number of task copies; global services run exactly one task on every available node (Correct answer)
Replicated services support rolling updates; global services do not
Replicated services use the ingress network; global services use host networking

Correct answer: Replicated services run a specified number of task copies; global services run exactly one task on every available node

In replicated mode you define a desired replica count; in global mode, the Swarm schedules exactly one task per available node.

Question 21: Which command shows real-time resource usage statistics for all running containers?

docker stats (Correct answer)
docker monitor
docker ps --stats
docker inspect --live

Correct answer: docker stats

`docker stats` streams live CPU, memory, network I/O, and block I/O metrics for running containers.

Question 22: What type of attack does Docker's default seccomp profile primarily help prevent?

Cross-container network traffic sniffing
Container escape via dangerous kernel system calls (Correct answer)
DDoS attacks targeting containerized web services
Image tampering during a registry push

Correct answer: Container escape via dangerous kernel system calls

Docker's default seccomp profile blocks system calls that could be exploited to escape the container sandbox or compromise the host kernel.

Question 23: When the `json-file` log driver is configured with `max-size=10m` and `max-file=3`, what happens when logs exceed 10MB?

The container is paused
Logging stops until the file is cleared
Logs are compressed in place
The log file rotates and old files are deleted when count exceeds 3 (Correct answer)

Correct answer: The log file rotates and old files are deleted when count exceeds 3

Docker rotates the log file at `max-size` and keeps only `max-file` rotated files, deleting the oldest.

Question 24: The EU Cyber Resilience Act (CRA) imposes requirements on products with digital elements. How does it affect companies distributing Docker-based commercial software?

Only open-source Docker images are subject to CRA obligations
CRA exempts containerized applications from security requirements
Vendors must implement vulnerability handling processes, provide SBOMs, and report actively exploited vulnerabilities within 24 hours (Correct answer)
It only applies to hardware manufacturers, not software vendors

Correct answer: Vendors must implement vulnerability handling processes, provide SBOMs, and report actively exploited vulnerabilities within 24 hours

The CRA requires manufacturers of products with digital elements to establish vulnerability management, provide SBOMs, and notify authorities of actively exploited vulnerabilities within 24 hours.

Question 25: In a CI pipeline, 'docker build' exits with code 1. Which step should be taken first to diagnose the failure?

Delete all local images and rebuild from scratch
Switch to a different base image
Check the build log output for the specific RUN instruction that failed (Correct answer)
Re-run with '--no-cache' to rule out stale layers

Correct answer: Check the build log output for the specific RUN instruction that failed

The build log identifies the exact failing RUN step and its stderr, providing the most direct path to diagnosing the failure cause.

Question 26: A Docker swarm cluster is shared between development and production workloads. What professional concern should be raised?

Mixing dev and production on the same cluster creates blast-radius and compliance risks that require strong isolation controls or separate clusters (Correct answer)
There is no concern if network policies are in place
Shared clusters reduce costs and are always acceptable
Development workloads improve production performance by sharing the warm cache

Correct answer: Mixing dev and production on the same cluster creates blast-radius and compliance risks that require strong isolation controls or separate clusters

Mixing dev and production workloads risks a dev misconfiguration affecting production and often violates compliance requirements for environment separation.

Question 27: Which log driver sends Docker container logs directly to a syslog endpoint?

journald
gelf
syslog (Correct answer)
json-file

Correct answer: syslog

The `syslog` log driver forwards container logs to a syslog server using RFC 5424 format over UDP, TCP, or TLS.

Question 28: PCI DSS Requirement 6 mandates secure development practices. Which Docker workflow directly addresses this for containerized applications?

Integrating image vulnerability scanning into the CI/CD pipeline before deployment (Correct answer)
Running all containers as root for simplified access
Using latest tags for all base images
Disabling Docker Content Trust to speed up deployments

Correct answer: Integrating image vulnerability scanning into the CI/CD pipeline before deployment

Scanning images for vulnerabilities in CI/CD pipelines aligns with PCI DSS Req 6's mandate to identify and fix security vulnerabilities before deployment.

Question 29: Why is written communication important in DCA practice?

It creates a permanent record, ensures clarity, and provides reference for future actions (Correct answer)
It is less effective than verbal communication in all situations
Written records are only needed for legal disputes
Modern technology has eliminated the need for written communication

Correct answer: It creates a permanent record, ensures clarity, and provides reference for future actions

Written communication creates documented records, provides clarity through careful word choice, allows review before sending, and serves as reference material for decisions and future actions.

Question 30: Which log driver sends container logs directly to a syslog server?

json-file
gelf
syslog (Correct answer)
fluentd

Correct answer: syslog

The `syslog` log driver forwards container log messages to a syslog-compatible server.

Question 31: What are the five process groups in DCA project management?

Hiring, Training, Working, Evaluating, and Terminating
Initiating, Planning, Executing, Monitoring & Controlling, and Closing (Correct answer)
Researching, Proposing, Funding, Implementing, and Reporting
Designing, Building, Testing, Deploying, and Supporting

Correct answer: Initiating, Planning, Executing, Monitoring & Controlling, and Closing

The five process groups provide a framework for managing any project: Initiating (defining the project), Planning (establishing scope and approach), Executing (doing the work), Monitoring & Controlling (tracking progress), and Closing (formal completion).

Question 32: What does the Apache 2.0 license require when distributing modified versions of Apache-licensed Docker components?

Release modified source code under Apache 2.0
Include a NOTICE file and state significant changes made to the original (Correct answer)
Obtain written permission from the Apache Software Foundation
Pay royalties for commercial use

Correct answer: Include a NOTICE file and state significant changes made to the original

Apache 2.0 requires preserving the NOTICE file and indicating changes, but does not require releasing modified source code.

Question 33: A QA engineer wants to verify that a Docker image's layers are reproducible given the same Dockerfile and context. Which build feature helps achieve reproducible builds?

BuildKit's build caching with fixed base image digests pinned in FROM (Correct answer)
docker build --compress
docker build --squash
BuildKit's --secret flag

Correct answer: BuildKit's build caching with fixed base image digests pinned in FROM

Pinning the base image by digest (e.g., FROM ubuntu@sha256:...) ensures the exact same base is used every time, making builds reproducible across environments.

Question 34: What command creates a user-defined bridge network named 'my-network'?

docker network add my-network
docker create network my-network
docker network create --driver bridge my-network (Correct answer)
docker network init my-network

Correct answer: docker network create --driver bridge my-network

The `docker network create --driver bridge my-network` command creates a user-defined bridge network.

Question 35: A colleague proposes pulling container images from an unverified public registry to save time. What is the ethical response?

Accept it as long as the containers run in an isolated network
Agree, since speed is the top priority in DevOps
Accept it only if the images have a high download count
Reject it and require images to come from trusted, verified sources (Correct answer)

Correct answer: Reject it and require images to come from trusted, verified sources

Unverified images may contain malware or supply chain compromises, so professional standards require using trusted sources.

Question 36: During project execution, an operator needs to run a one-time database migration task in a running Swarm service without creating a permanent task. What is the best approach?

Use 'docker service update --force' to trigger all tasks to restart
Exec into an existing container and run the migration
Scale the service to 0 and run the migration manually
Deploy a separate one-shot service with --restart-condition=none (Correct answer)

Correct answer: Deploy a separate one-shot service with --restart-condition=none

A service with --restart-condition=none runs once and exits cleanly, making it suitable for one-time migration jobs.

Question 37: What does the `--read-only` flag do when running a Docker container?

Makes the container's root filesystem read-only (Correct answer)
Restricts the container's network to read-only monitoring
Prevents the container from reading files on the host
Prevents pulling updated versions of the container image

Correct answer: Makes the container's root filesystem read-only

The `--read-only` flag mounts the container's root filesystem as read-only, preventing any process from writing to it.

Question 38: What is the purpose of data analysis in DCA practice?

To replace professional judgment entirely with numbers
To collect as much data as possible regardless of relevance
To transform raw data into meaningful insights that support informed decision-making (Correct answer)
To create attractive charts with no analytical value

Correct answer: To transform raw data into meaningful insights that support informed decision-making

Data analysis involves examining, cleaning, transforming, and modeling data to discover useful information, draw conclusions, and support decision-making processes with evidence-based insights.

Question 39: What is the triple constraint in DCA project management?

The requirement for three project team members minimum
The interdependent relationship between scope, time, and cost (Correct answer)
Three phases that every project must complete
Three mandatory project approvals from management

Correct answer: The interdependent relationship between scope, time, and cost

The triple constraint recognizes that scope, time, and cost are interdependent: changing one necessarily affects the others. Project managers must balance all three to deliver successful outcomes.

Question 40: What does the `HEALTHCHECK` instruction in a Dockerfile do?

Defines a command Docker periodically runs to assess if the container is healthy (Correct answer)
Runs a command to test container health at build time
Checks host system health before starting the container
Validates network connectivity on container start

Correct answer: Defines a command Docker periodically runs to assess if the container is healthy

`HEALTHCHECK` tells Docker how to test a container's health; a failing check marks the container as `unhealthy` in `docker ps`.

Question 41: Which command shows detailed information about a Docker network including its connected containers?

docker network detail my-network
docker network inspect my-network (Correct answer)
docker network status my-network
docker network show my-network

Correct answer: docker network inspect my-network

The `docker network inspect` command displays detailed JSON-formatted information about a network, including configuration and connected containers.

Question 42: Under ISO 27001, which control category is most relevant when defining how Docker container access should be managed within an ISMS?

A.12 Operations Security
A.9 Access Control (Correct answer)
A.14 System Acquisition, Development, and Maintenance
A.7 Human Resource Security

Correct answer: A.9 Access Control

ISO 27001 Annex A.9 (Access Control) governs user access management, including permissions to container registries, orchestration platforms, and container runtimes.

Question 43: Which command displays all Docker networks on a host?

docker network ls (Correct answer)
docker network list --all
docker networks
docker network show

Correct answer: docker network ls

The `docker network ls` command lists all networks available on the Docker host.

Question 44: What is the difference between quantitative and qualitative data in DCA analysis?

Quantitative data is numerical and measurable; qualitative data is descriptive and categorical (Correct answer)
They are interchangeable terms for the same type of data
Quantitative data cannot be used in professional settings
Qualitative data is always more accurate than quantitative

Correct answer: Quantitative data is numerical and measurable; qualitative data is descriptive and categorical

Quantitative data consists of numerical measurements that can be statistically analyzed, while qualitative data consists of descriptive observations, opinions, and categories that provide context and depth.

Question 45: Which metric is NOT reported by `docker stats`?

CPU percentage
Network I/O
Number of open file descriptors (Correct answer)
Memory usage and limit

Correct answer: Number of open file descriptors

`docker stats` reports CPU %, memory, network I/O, and block I/O but does not show open file descriptor counts.

Question 46: Which command connects a running container to an additional network?

docker network join my-network my-container
docker network connect my-network my-container (Correct answer)
docker container network add my-network my-container
docker attach network my-network my-container

Correct answer: docker network connect my-network my-container

The `docker network connect` command attaches a running container to an existing network.

Question 47: Which Docker feature allows you to enforce mandatory access controls by restricting the system calls a container can make to the host kernel?

Docker Compose networks
Health checks
Seccomp profiles (Correct answer)
Docker volumes

Correct answer: Seccomp profiles

Seccomp (Secure Computing Mode) profiles define an allowlist or blocklist of Linux system calls available to a container, reducing kernel attack surface.

Question 48: A service in Docker Swarm is configured with `--update-failure-action rollback`. What happens when an updated task fails its health check?

The failed task is retried indefinitely
The swarm automatically rolls back to the previous version (Correct answer)
The swarm removes the service
The service is paused immediately

Correct answer: The swarm automatically rolls back to the previous version

With `--update-failure-action rollback`, Swarm automatically reverts the service to its prior configuration when an update task fails.

Question 49: A Docker image includes a library licensed under LGPL. What obligation does this create for a company distributing a proprietary application using that image?

The LGPL library source code must be made available, but the proprietary application code can remain closed (Correct answer)
The company must purchase a commercial license from the library maintainer
The entire application must be open-sourced under LGPL
No obligations exist because the library is inside a container

Correct answer: The LGPL library source code must be made available, but the proprietary application code can remain closed

LGPL allows linking proprietary software with LGPL libraries as long as the LGPL library source (or object files enabling relinking) is made available.

Question 50: A company runs 200 microservices in Docker Swarm. Resource limits are not set on any service. What is the primary financial risk?

A noisy-neighbor container can exhaust host resources, causing unplanned scaling costs (Correct answer)
Services will not start without resource limits
Docker Swarm requires paid licensing without resource limits
Images will fail to pull from the registry

Correct answer: A noisy-neighbor container can exhaust host resources, causing unplanned scaling costs

Without limits, a single runaway container can consume all host resources, forcing emergency scale-outs and unexpected cloud spend.

Question 51: Which Docker daemon flag enables mutual TLS authentication for secure client-to-daemon communication?

--tls-verify
--tlsverify (Correct answer)
--secure-mode
--enable-tls

Correct answer: --tlsverify

The `--tlsverify` flag enables TLS authentication for the Docker daemon, requiring both the server and client to present valid certificates.

Question 52: Under FedRAMP authorization, which Docker registry practice is required for containerized applications in U.S. federal cloud environments?

Exempting containers from FedRAMP controls due to their ephemeral nature
Using only Docker Hub public images without additional controls
Operating a private registry within the FedRAMP authorization boundary with continuous image scanning (Correct answer)
Pulling images at runtime from external registries to reduce storage costs

Correct answer: Operating a private registry within the FedRAMP authorization boundary with continuous image scanning

FedRAMP requires all components within the authorization boundary to be controlled; a private registry with continuous scanning ensures images meet the required security posture.

Question 53: A risk model classifies the Docker host's kernel as a shared resource. Which threat does this shared-kernel architecture create that hypervisor-based virtualization does not?

Containers on the same host cannot share CPU cache lines, causing cache misses
Docker containers cannot run on hosts with SELinux enabled
A kernel vulnerability exploited inside one container can potentially affect all containers and the host (Correct answer)
The shared kernel prevents more than 256 containers from running simultaneously on one host

Correct answer: A kernel vulnerability exploited inside one container can potentially affect all containers and the host

Because all containers share the host kernel, a kernel exploit (e.g., container escape CVE) can compromise the entire host and all co-located containers simultaneously.

Question 54: Which storage location on the host holds `json-file` log driver output for a container?

/var/log/containers/<container_id>.log
/run/docker/logs/<container_id>.log
/var/lib/docker/containers/<container_id>/<container_id>-json.log (Correct answer)
/etc/docker/logs/<container_id>.json

Correct answer: /var/lib/docker/containers/<container_id>/<container_id>-json.log

The `json-file` driver writes logs to `/var/lib/docker/containers/<id>/<id>-json.log` on the host.

Question 55: How do you scale a replicated service named 'web' to 5 replicas in Docker Swarm?

docker service update --replicas 5 web
docker swarm scale --service web --replicas 5
docker service scale web 5
docker service scale web=5 (Correct answer)

Correct answer: docker service scale web=5

`docker service scale web=5` is the correct syntax, using `name=count` format to set the desired replica count.

Docker Certified Associate (DCA)

The Docker Certified Associate exam validates skills in containerization using Docker, covering orchestration, image management, networking, security, installation, and storage. It is administered by Mirantis and targets intermediate-level Docker practitioners.

Questions

90 min

Time Limit

65%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds