DCA Professional Standards & Ethics 2

Question 1

A developer discovers a critical vulnerability in a public Docker image used by their organization. What is the most ethical course of action?

Accepted Answer

Report the vulnerability privately to the image maintainer before public disclosure

Answer

Responsible disclosure means privately notifying the maintainer first so they can issue a patch before the vulnerability is publicly known.

Question 2

When managing Docker secrets in a professional environment, which practice best upholds security ethics?

Accepted Answer

Use Docker secrets or an external vault and never embed credentials in images

Answer

Docker secrets or an external vault ensures credentials are not exposed in image layers or version control.

Question 3

A team member shares a Dockerfile that pulls a base image using 'latest' tag in production. What professional concern should be raised?

Accepted Answer

Using 'latest' reduces reproducibility and can introduce unexpected breaking changes

Answer

The 'latest' tag is mutable and can change unexpectedly, making builds non-reproducible and potentially breaking production.

Question 4

Which action best demonstrates professional responsibility when a Docker host shows signs of compromise?

Accepted Answer

Immediately isolate the host, preserve logs, and follow the incident response plan

Answer

Isolating the compromised host and following the incident response plan limits damage while preserving forensic evidence.

Question 5

A colleague proposes pulling container images from an unverified public registry to save time. What is the ethical response?

Accepted Answer

Reject it and require images to come from trusted, verified sources

Answer

Unverified images may contain malware or supply chain compromises, so professional standards require using trusted sources.

DCA - Docker Certified Associate Exam Practice Test