Docker Certified Associate (DCA) — Questions and Answers

Question 1: A team is planning resource limits for containers in a production Kubernetes cluster. Which flag sets both CPU and memory limits in a Docker run command for testing?

--cpu-shares and --mem-limit
--cpu-quota and --memory-swap
--cpus and --memory (Correct answer)
--cpu-period and --memory-reservation

Correct answer: --cpus and --memory

The --cpus flag limits CPU cores and --memory limits the container's maximum RAM allocation.

Question 2: Which command connects a running container to an additional network?

docker network join my-network my-container
docker container network add my-network my-container
docker attach network my-network my-container
docker network connect my-network my-container (Correct answer)

Correct answer: docker network connect my-network my-container

The `docker network connect` command attaches a running container to an existing network.

Question 3: Which command sets the availability of a Swarm node named 'node1' to 'drain'?

docker node set --drain node1
docker swarm drain node1
docker node drain node1
docker node update --availability drain node1 (Correct answer)

Correct answer: docker node update --availability drain node1

`docker node update --availability drain node1` prevents new tasks from being scheduled on the node and reschedules existing tasks elsewhere.

Question 4: Which 'docker service ls' output field indicates a service has not reached its desired replica count?

IMAGE shows 'pending'
The REPLICAS column shows a value less than desired, e.g., '2/3' (Correct answer)
MODE shows 'replicated/failed'
PORTS shows '0.0.0.0:0'

Correct answer: The REPLICAS column shows a value less than desired, e.g., '2/3'

The REPLICAS column format is 'running/desired'; a mismatch like '2/3' immediately signals that one replica is not healthy or scheduled.

Question 5: What does return on investment (ROI) measure in DCA financial analysis?

The total revenue of an organization
The physical return of purchased goods
The number of employees in the organization
The gain or loss generated relative to the amount of money invested (Correct answer)

Correct answer: The gain or loss generated relative to the amount of money invested

ROI measures the efficiency of an investment by comparing the net gain or loss to the initial investment cost, expressed as a percentage. It helps compare the profitability of different investment options.

Question 6: What is a root cause analysis in DCA quality assurance?

A technique for assigning blame after an incident
A systematic investigation to identify the fundamental underlying cause of a problem (Correct answer)
A superficial review of symptoms only
A method for counting defects in a product

Correct answer: A systematic investigation to identify the fundamental underlying cause of a problem

Root cause analysis digs beyond immediate symptoms to find the fundamental cause of a problem, enabling corrective actions that prevent recurrence rather than just addressing surface-level issues.

Question 7: Which of the following statements regarding secrets is FALSE?

Secrets are encrypted during transit and also at rest
Secrets are mounted in container's filesystem directly
Secrets are available to swarm services and standalone containers (Correct answer)
Secrets can be used for storing username and password

Correct answer: Secrets are available to swarm services and standalone containers

Swarm services and standalone containers have access to secrets, hence the assertion is untrue. Only swarm services and not solo containers are permitted to use secrets.

Question 8: What is the Docker container's default container format?

None of the above
libcontainer (Correct answer)
LXD
Application Container Image (ACI)

Correct answer: libcontainer

Libcontainer is a library developed by the Docker project (now part of the Open Container Initiative) that provides a native interface to manage containerization features in various operating systems. It is responsible for creating and managing containers, isolating their resources, and setting up namespaces, control groups, and other operating system-level constructs to provide secure and isolated environments for running applications. Libcontainer acts as an abstraction layer between Docker and the underlying operating system, allowing Docker to work with different containerization technologies depending on the host system. It supports multiple container runtimes such as Docker's own runtime, runc, as well as other container runtimes compliant with the Open Container Initiative (OCI) runtime specifications.

Question 9: What is the purpose of Docker Content Trust (DCT)?

To encrypt container-to-container traffic
To control user access to Docker registries
To scan images for OS vulnerabilities
To sign and verify the authenticity and integrity of Docker images (Correct answer)

Correct answer: To sign and verify the authenticity and integrity of Docker images

Docker Content Trust uses digital signatures via The Update Framework (TUF) to verify the integrity and publisher of Docker images.

Question 10: What is cash flow management in DCA practice?

Only tracking money received, not money spent
Investing all available funds in the stock market
Monitoring and optimizing the timing of money coming in and going out of an organization (Correct answer)
Physically managing coins and paper currency

Correct answer: Monitoring and optimizing the timing of money coming in and going out of an organization

Cash flow management involves tracking, analyzing, and optimizing the timing of cash inflows and outflows to ensure the organization always has sufficient funds to meet obligations while maximizing use of available cash.

Question 11: Which Docker network driver allows containers on different Docker hosts to communicate?

macvlan
overlay (Correct answer)
bridge
host

Correct answer: overlay

The overlay network driver enables communication between containers across multiple Docker hosts in a Swarm cluster.

Question 12: Which `docker run` option configures a container to use a specific DNS server?

--nameserver
--resolve
--dns (Correct answer)
--dns-server

Correct answer: --dns

The `--dns` flag in `docker run` specifies a custom DNS server IP address for the container.

Question 13: In Docker Swarm, what is the purpose of the '--update-monitor' duration flag on 'docker service update'?

Defines the window after each task update during which failures count against the failure ratio (Correct answer)
Sets how long the update waits between each task replacement
Controls how long Swarm waits before starting the rollback
Specifies the timeout before a task is considered failed

Correct answer: Defines the window after each task update during which failures count against the failure ratio

'--update-monitor' sets the observation window after each task is updated; failures within this window increment the failure count used against '--update-max-failure-ratio'.

Question 14: How do you scale a replicated service named 'web' to 5 replicas in Docker Swarm?

docker service scale web 5
docker swarm scale --service web --replicas 5
docker service scale web=5 (Correct answer)
docker service update --replicas 5 web

Correct answer: docker service scale web=5

`docker service scale web=5` is the correct syntax, using `name=count` format to set the desired replica count.

Question 15: A project plan includes health checks for all services. Where can a HEALTHCHECK instruction be defined so it applies to every container started from an image?

Directly in the Dockerfile using the HEALTHCHECK instruction (Correct answer)
In the docker-compose.yml healthcheck key only — Dockerfile does not support it
In the /etc/docker/daemon.json file as a global default
As a --health-cmd flag passed at 'docker build' time

Correct answer: Directly in the Dockerfile using the HEALTHCHECK instruction

The HEALTHCHECK instruction in a Dockerfile embeds the health check into the image so it runs by default for all containers started from it.

Question 16: To export Prometheus-compatible metrics from the Docker daemon, which configuration option must be enabled?

"metrics": true in daemon.json
"telemetry": "prometheus"
"log-driver": "prometheus"
"experimental": true and "metrics-addr" (Correct answer)

Correct answer: "experimental": true and "metrics-addr"

Enabling experimental mode and setting `metrics-addr` in `daemon.json` exposes a Prometheus metrics endpoint.

Question 17: You need to time-limit `docker events` to only show events that occurred in a specific window. Which flags accomplish this?

--start and --end
--from and --to
--begin and --finish
--since and --until (Correct answer)

Correct answer: --since and --until

`docker events --since` and `--until` bound the time range of events returned.

Question 18: Why is data visualization important in DCA reporting?

Visual data always replaces the need for written analysis
It makes complex data patterns and relationships easier to understand and communicate (Correct answer)
It is purely decorative with no analytical value
Charts are required by law in all professional reports

Correct answer: It makes complex data patterns and relationships easier to understand and communicate

Data visualization translates complex datasets into visual formats (charts, graphs, maps) that highlight patterns, trends, and outliers, making information more accessible and actionable for diverse audiences.

Question 19: Why is written communication important in DCA practice?

It creates a permanent record, ensures clarity, and provides reference for future actions (Correct answer)
Written records are only needed for legal disputes
It is less effective than verbal communication in all situations
Modern technology has eliminated the need for written communication

Correct answer: It creates a permanent record, ensures clarity, and provides reference for future actions

Written communication creates documented records, provides clarity through careful word choice, allows review before sending, and serves as reference material for decisions and future actions.

Question 20: Which of the commands can be used to view an IPv4 network's subnet?

docker network is
docker info network
docker network info
docker network inspect (Correct answer)

Correct answer: docker network inspect

"docker network inspect" is an authorized command to examine a certain network

Question 21: When executing a Docker project rollout, a health check fails on new containers. What does Docker Swarm do by default?

Pauses the rollout and keeps the previous version running (Correct answer)
Continues the rollout and logs the failure
Restarts the failed container indefinitely without pausing
Immediately terminates all tasks and halts the rollout

Correct answer: Pauses the rollout and keeps the previous version running

Docker Swarm's default update failure action is 'pause', preserving the last healthy state while alerting operators.

Question 22: What command creates a user-defined bridge network named 'my-network'?

docker network init my-network
docker create network my-network
docker network add my-network
docker network create --driver bridge my-network (Correct answer)

Correct answer: docker network create --driver bridge my-network

The `docker network create --driver bridge my-network` command creates a user-defined bridge network.

Question 23: What is the triple constraint in DCA project management?

The interdependent relationship between scope, time, and cost (Correct answer)
Three mandatory project approvals from management
Three phases that every project must complete
The requirement for three project team members minimum

Correct answer: The interdependent relationship between scope, time, and cost

The triple constraint recognizes that scope, time, and cost are interdependent: changing one necessarily affects the others. Project managers must balance all three to deliver successful outcomes.

Question 24: Which Linux feature is used by Docker to enforce CPU and memory resource limits on containers?

Seccomp profiles
AppArmor policies
cgroups (control groups) (Correct answer)
Namespaces

Correct answer: cgroups (control groups)

Linux cgroups (control groups) limit, prioritize, and monitor resource usage including CPU, memory, and I/O for Docker containers.

Question 25: Which port publishing flag maps host port 8080 to container port 80?

--port 8080-80
-p 80:8080
-P 8080:80
-p 8080:80 (Correct answer)

Correct answer: -p 8080:80

The `-p 8080:80` flag maps host port 8080 to container port 80 using the host:container format.

Question 26: When the `json-file` log driver is configured with `max-size=10m` and `max-file=3`, what happens when logs exceed 10MB?

Logging stops until the file is cleared
Logs are compressed in place
The log file rotates and old files are deleted when count exceeds 3 (Correct answer)
The container is paused

Correct answer: The log file rotates and old files are deleted when count exceeds 3

Docker rotates the log file at `max-size` and keeps only `max-file` rotated files, deleting the oldest.

Question 27: What is the purpose of data analysis in DCA practice?

To create attractive charts with no analytical value
To collect as much data as possible regardless of relevance
To transform raw data into meaningful insights that support informed decision-making (Correct answer)
To replace professional judgment entirely with numbers

Correct answer: To transform raw data into meaningful insights that support informed decision-making

Data analysis involves examining, cleaning, transforming, and modeling data to discover useful information, draw conclusions, and support decision-making processes with evidence-based insights.

Question 28: What is the default subnet used by Docker's default bridge network (docker0)?

192.168.1.0/24
10.0.0.0/8
192.168.0.0/16
172.17.0.0/16 (Correct answer)

Correct answer: 172.17.0.0/16

Docker's default bridge network uses the 172.17.0.0/16 subnet by default.

Question 29: When planning a migration of a monolithic application to Docker containers, which approach best minimizes risk?

Rewrite all services from scratch before containerizing
Containerize all services simultaneously in a single sprint
Deploy containers only in development and keep production on bare metal
Strangler fig pattern — incrementally containerize one service at a time (Correct answer)

Correct answer: Strangler fig pattern — incrementally containerize one service at a time

The strangler fig pattern reduces risk by migrating one service at a time, allowing rollback without full-system impact.

Question 30: How can a running container on a Linux host be interpreted?

a process (Correct answer)
a file
an application
a program

Correct answer: a process

On a Linux host, a running container can be interpreted as a collection of isolated processes with their own filesystem, network stack, and resource constraints. Containers on Linux are implemented using kernel features such as namespaces and cgroups, which provide process and resource isolation.

Question 31: When using 'docker build --no-cache', what quality assurance benefit does this provide?

It ensures every layer is rebuilt fresh, catching dependency drift (Correct answer)
It disables multi-stage builds
It speeds up the build by skipping unchanged layers
It forces BuildKit to use a remote cache

Correct answer: It ensures every layer is rebuilt fresh, catching dependency drift

Building without cache forces all layers to be re-executed, ensuring the image reflects the latest upstream dependencies and revealing any drift.

Question 32: What does the `--cap-drop ALL` flag do when running a container?

Drops all Linux capabilities from the container process (Correct answer)
Removes the container from all networks
Prevents the container from forking child processes
Disables all bind-mounted volumes

Correct answer: Drops all Linux capabilities from the container process

The `--cap-drop ALL` flag removes all Linux capabilities from the container, which can then be selectively restored with `--cap-add`.

Question 33: On AWS, you are creating a brand-new Docker Swarm. You must make sure that neither the Security Group Rules nor the Network Access Control List are blocking traffic between hosts. Which of the following statements accurately describes every port that needs to be open between Docker hosts?

TCP/7946 and UDP/2377
TCP/2377 and UDP/2377
TCP/2377 and TCP/4789
TCP/2377, TCP/7946, and UDP/7946 (Correct answer)

Correct answer: TCP/2377, TCP/7946, and UDP/7946

<li>TCP port 2377 for cluster management communications</li> <li>TCP and UDP port 7946 for communication among nodes

Question 34: What is a dashboard in DCA data reporting?

A visual display of key metrics and data points for at-a-glance monitoring of performance (Correct answer)
A physical control panel in an office
A tool used only by IT departments
A written report submitted monthly to management

Correct answer: A visual display of key metrics and data points for at-a-glance monitoring of performance

A dashboard provides a consolidated visual display of important metrics, KPIs, and data trends, enabling stakeholders to quickly assess performance status and identify areas needing attention.

Question 35: Which `docker system` subcommand displays disk usage broken down by images, containers, and volumes?

docker system usage
docker system info
docker system inspect
docker system df (Correct answer)

Correct answer: docker system df

`docker system df` reports disk usage for images, containers, local volumes, and build cache.

Question 36: Which command correctly creates a Docker secret named 'db_password' with the value 'mysecret'?

echo 'mysecret' | docker secret create db_password - (Correct answer)
docker secret add db_password mysecret
docker secret set db_password mysecret
docker create secret --name db_password --value mysecret

Correct answer: echo 'mysecret' | docker secret create db_password -

Docker secrets are created by piping the secret value to `docker secret create <name> -`, where the dash reads from stdin.

Question 37: Which storage location on the host holds `json-file` log driver output for a container?

/var/lib/docker/containers/<container_id>/<container_id>-json.log (Correct answer)
/run/docker/logs/<container_id>.log
/etc/docker/logs/<container_id>.json
/var/log/containers/<container_id>.log

Correct answer: /var/lib/docker/containers/<container_id>/<container_id>-json.log

The `json-file` driver writes logs to `/var/lib/docker/containers/<id>/<id>-json.log` on the host.

Question 38: A project requires zero-downtime deployments in Docker Swarm. Which update configuration achieves this?

--update-parallelism 1 --update-delay 10s with health checks configured (Correct answer)
--update-failure-action continue to skip failed tasks
--update-parallelism 0 --update-delay 0s
--update-order stop-first with --update-parallelism equal to replica count

Correct answer: --update-parallelism 1 --update-delay 10s with health checks configured

Rolling updates with parallelism of 1, a delay, and health checks ensure new tasks are healthy before old ones are removed.

Question 39: You need to extract the container's IP address from `docker inspect` output using a Go template. Which template expression is correct?

{{.HostConfig.IPAddress}}
{{.Config.IPAddress}}
{{.NetworkSettings.IPAddress}} (Correct answer)
{{.Network.IPAddress}}

Correct answer: {{.NetworkSettings.IPAddress}}

The IP address lives at `{{.NetworkSettings.IPAddress}}` in the inspect JSON structure.

Question 40: In Docker Swarm, which network is automatically created to handle load balancing for published service ports?

An ingress overlay network (Correct answer)
A default bridge network
A macvlan network
A host network

Correct answer: An ingress overlay network

Docker Swarm automatically creates an ingress overlay network to implement the routing mesh for published ports.

Question 41: What command retrieves the join token needed to add a worker node to an existing Swarm?

docker node add --token worker
docker swarm join-token worker (Correct answer)
docker swarm token --worker
docker swarm worker-token

Correct answer: docker swarm join-token worker

`docker swarm join-token worker` outputs the full `docker swarm join` command with the token required for a worker to join.

Question 42: Which command exports a container's filesystem as a tar archive for offline security auditing?

docker save
docker image export
docker export (Correct answer)
docker cp --all

Correct answer: docker export

'docker export' flattens a container's filesystem (all layers merged) into a tar archive, useful for offline inspection or security auditing tools.

Question 43: What security benefit does enabling user namespace remapping in Docker provide?

Enables SSH key-based access to running containers
Allows multiple host users to share a single running container
Maps the container's root user (UID 0) to an unprivileged UID on the host (Correct answer)
Creates an isolated user database for each container

Correct answer: Maps the container's root user (UID 0) to an unprivileged UID on the host

User namespace remapping maps the container's root UID to a non-privileged host UID, significantly reducing the risk if a process escapes the container.

Question 44: What format is used to define a custom seccomp profile for a Docker container?

An INI-style configuration file
A JSON profile file (Correct answer)
A YAML configuration file
A Docker Compose extension file

Correct answer: A JSON profile file

Docker seccomp profiles are defined in JSON format, specifying the default action and the list of allowed or denied system calls.

Question 45: What is a compliance audit in DCA practice?

A systematic review verifying adherence to regulatory requirements and policies (Correct answer)
A routine customer satisfaction survey
An annual employee performance evaluation
A financial profit and loss assessment

Correct answer: A systematic review verifying adherence to regulatory requirements and policies

A compliance audit systematically examines adherence to external regulations, internal policies, and industry standards, identifying gaps and recommending corrective actions.

Question 46: What is the purpose of the USER instruction in a Dockerfile?

To add a new system user account to the container image
To set the username or UID for subsequent RUN, CMD, and ENTRYPOINT instructions (Correct answer)
To authenticate against a Docker registry during build
To grant sudo access to a container user

Correct answer: To set the username or UID for subsequent RUN, CMD, and ENTRYPOINT instructions

The USER instruction sets the username or UID (and optionally group) that runs subsequent Dockerfile instructions and the container's default process.

Question 47: What does running a container with the `--privileged` flag do?

Grants the container almost all Linux capabilities and access to host devices (Correct answer)
Runs the container process as root on the host filesystem
Enables Docker Content Trust for that container
Makes the container filesystem read-only

Correct answer: Grants the container almost all Linux capabilities and access to host devices

The `--privileged` flag grants the container nearly all the same access to the host as native processes running outside containers.

Question 48: Why is documentation critical in DCA regulatory compliance?

It creates unnecessary paperwork with no practical value
It is optional for experienced professionals in the field
It is only needed for annual tax filing purposes
It provides evidence of compliance and creates a defensible record of activities (Correct answer)

Correct answer: It provides evidence of compliance and creates a defensible record of activities

Documentation provides verifiable evidence that regulatory requirements have been met, supports audit processes, and creates a defensible record if compliance is ever questioned.

Question 49: A project calls for containers to share the same network namespace so they can communicate over localhost. Which Docker run option achieves this?

docker run --network=container:<name_or_id> (Correct answer)
docker run --ipc=container:<name_or_id>
docker run --network=shared --name=sidecar
docker run --pid=container:<name_or_id>

Correct answer: docker run --network=container:<name_or_id>

The --network=container: option joins a new container to an existing container's network namespace, sharing the same network interfaces.

Question 50: What is active listening in DCA professional communication?

Taking notes without making any eye contact
Waiting for your turn to speak without processing content
Hearing words while multitasking on other activities
Fully concentrating on the speaker, understanding their message, and providing thoughtful feedback (Correct answer)

Correct answer: Fully concentrating on the speaker, understanding their message, and providing thoughtful feedback

Active listening involves fully focusing on the speaker, processing their message, asking clarifying questions, and providing thoughtful responses that demonstrate understanding and engagement.

Question 51: You want to capture a single snapshot of container stats without streaming continuously. Which flag achieves this?

--no-stream (Correct answer)
--single
--once
--snapshot

Correct answer: --no-stream

`docker stats --no-stream` outputs one set of stats and exits instead of continuously streaming.

Question 52: What is the principle of least privilege in DCA technology management?

Users should only have the minimum access rights necessary for their job functions (Correct answer)
All users should have full administrator access to all systems
Access privileges should be based on employee seniority
Everyone should share a single set of login credentials

Correct answer: Users should only have the minimum access rights necessary for their job functions

The principle of least privilege limits each user's access to only what is strictly necessary for their role, reducing potential damage from errors, insider threats, or compromised accounts.

Question 53: When executing a Swarm stack deployment, which command deploys or updates all services defined in a Compose file to the Swarm?

docker compose up --swarm -f docker-compose.yml
docker service create --compose-file docker-compose.yml
docker swarm apply -f docker-compose.yml <stack_name>
docker stack deploy -c docker-compose.yml <stack_name> (Correct answer)

Correct answer: docker stack deploy -c docker-compose.yml <stack_name>

The 'docker stack deploy -c <file> <stack>' command deploys a multi-service application to Docker Swarm using a Compose v3 file.

Question 54: Which of the following parameters would allow you to SSH into an active "nginx" Docker container?

docker inspect webserver
docker run -it nginx /bin/sh
docker exec -it nginx /bin/sh (Correct answer)
docker ssh -it nginx /bin/sh

Correct answer: docker exec -it nginx /bin/sh

"docker exec -it nginx /bin/sh" will construct a TTY-equipped interactive session that is tied to the STDIN.

Question 55: What does the `-P` (uppercase) flag do when used with `docker run`?

Maps all ports to port 80 on the host
Limits port exposure to privileged ports only
Disables port publishing entirely
Publishes all EXPOSE ports to random ephemeral host ports (Correct answer)

Correct answer: Publishes all EXPOSE ports to random ephemeral host ports

The `-P` flag automatically publishes all ports declared with EXPOSE in the Dockerfile to random host ports.

Docker Certified Associate (DCA)

The Docker Certified Associate exam validates skills in containerization using Docker, covering orchestration, image management, networking, security, installation, and storage. It is administered by Mirantis and targets intermediate-level Docker practitioners.

Questions

90 min

Time Limit

65%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

training.mirantis.com — Test delivery, eligibility, fees, passing score, renewal, retake policy, score release, time limit, score validity · verified Oct 2026