DCA Professional Standards & Ethics 2 — Questions and Answers
Question 1: A developer discovers a critical vulnerability in a public Docker image used by their organization. What is the most ethical course of action?
- Delete the image from the registry immediately without notifying anyone
- Report the vulnerability privately to the image maintainer before public disclosure (Correct answer)
- Post the vulnerability details on social media to warn the community
- Ignore it since it is a third-party image and not their responsibility
Correct answer: Report the vulnerability privately to the image maintainer before public disclosure
Responsible disclosure means privately notifying the maintainer first so they can issue a patch before the vulnerability is publicly known.
Question 2: When managing Docker secrets in a professional environment, which practice best upholds security ethics?
- Store secrets in environment variables baked into the Docker image
- Hardcode secrets in the Dockerfile for reproducibility
- Use Docker secrets or an external vault and never embed credentials in images (Correct answer)
- Share secrets via a shared Slack channel for team access
Correct answer: Use Docker secrets or an external vault and never embed credentials in images
Docker secrets or an external vault ensures credentials are not exposed in image layers or version control.
Question 3: A team member shares a Dockerfile that pulls a base image using 'latest' tag in production. What professional concern should be raised?
- The 'latest' tag is always preferred for security patches
- Using 'latest' reduces reproducibility and can introduce unexpected breaking changes (Correct answer)
- The 'latest' tag is required by Docker best practices
- There is no concern; Docker automatically pins the digest
Correct answer: Using 'latest' reduces reproducibility and can introduce unexpected breaking changes
The 'latest' tag is mutable and can change unexpectedly, making builds non-reproducible and potentially breaking production.
Question 4: Which action best demonstrates professional responsibility when a Docker host shows signs of compromise?
- Continue operating to gather more evidence before acting
- Immediately isolate the host, preserve logs, and follow the incident response plan (Correct answer)
- Restart all containers to clear any malicious processes
- Notify only the direct manager and keep it confidential
Correct answer: Immediately isolate the host, preserve logs, and follow the incident response plan
Isolating the compromised host and following the incident response plan limits damage while preserving forensic evidence.
Question 5: A colleague proposes pulling container images from an unverified public registry to save time. What is the ethical response?
- Agree, since speed is the top priority in DevOps
- Accept it only if the images have a high download count
- Reject it and require images to come from trusted, verified sources (Correct answer)
- Accept it as long as the containers run in an isolated network
Correct answer: Reject it and require images to come from trusted, verified sources
Unverified images may contain malware or supply chain compromises, so professional standards require using trusted sources.
Question 6: When contributing a Docker-related tool to an open-source project, what professional standard must be followed regarding licensing?
- Include any third-party code without attribution since it is open source
- Ensure your contribution complies with the project's license and properly attributes dependencies (Correct answer)
- Choose a more restrictive license than the project to protect your work
- License compliance is only required for commercial projects
Correct answer: Ensure your contribution complies with the project's license and properly attributes dependencies
Open-source contributions must comply with the project's existing license and properly attribute any included third-party code.
Question 7: A DevOps engineer notices that container resource limits are not set in production, causing occasional host instability. What is the professional obligation?
- Document the issue and wait for a formal ticket before acting
- Immediately set appropriate CPU and memory limits and communicate the change to the team (Correct answer)
- Increase the host hardware capacity instead
- Ignore it since containers are self-regulating
Correct answer: Immediately set appropriate CPU and memory limits and communicate the change to the team
Setting resource limits is a professional obligation to prevent a single container from starving others and causing host instability.
DCA Professional Standards & Ethics 2
A developer discovers a critical vulnerability in a public Docker image used by their organization.
What is the most ethical course of action?