DCA Professional Standards & Ethics 3 — Questions and Answers
Question 1: Which practice best upholds data privacy ethics when building Docker images that process user PII?
- Log all PII to container stdout for debugging convenience
- Ensure PII never appears in image layers, logs, or environment variables (Correct answer)
- Store PII in a bind-mounted volume for easy access
- Include sample PII data in the image for testing purposes
Correct answer: Ensure PII never appears in image layers, logs, or environment variables
PII must never be embedded in image layers, logs, or environment variables to comply with privacy regulations and ethical data handling.
Question 2: A company's Docker registry contains images with known CVEs. What is the ethical professional standard for handling them?
- Leave them as-is since rebuilding takes time
- Mark them as deprecated, notify users, and provide patched replacements promptly (Correct answer)
- Delete them without notice to force teams to update
- Accept the risk since CVEs are common in all software
Correct answer: Mark them as deprecated, notify users, and provide patched replacements promptly
Responsible image management requires deprecating vulnerable images, notifying stakeholders, and providing patched alternatives in a timely manner.
Question 3: When running containers in a multi-tenant Docker environment, which security standard is most critical for ethical isolation?
- Sharing the same Docker network for all tenants to simplify management
- Running all containers as root for maximum compatibility
- Enforcing namespace isolation, network segmentation, and resource quotas per tenant (Correct answer)
- Mounting the host filesystem into tenant containers for performance
Correct answer: Enforcing namespace isolation, network segmentation, and resource quotas per tenant
Multi-tenant environments require strict namespace isolation, network segmentation, and resource quotas to prevent one tenant from affecting another.
Question 4: A Docker image you maintain is being widely used. You discover it accidentally includes a private API key in an earlier layer. What should you do first?
- Push a new version and hope no one checks the old layers
- Immediately revoke the API key, rebuild without it, and notify users to pull the new image (Correct answer)
- Delete only the latest tag to hide the issue
- Keep the key active since changing it would break existing deployments
Correct answer: Immediately revoke the API key, rebuild without it, and notify users to pull the new image
The exposed key must be revoked immediately since image layers are readable by anyone who has pulled the image.
Question 5: What does Docker Content Trust (DCT) enable from a professional ethics standpoint?
- It encrypts all container network traffic
- It verifies the authenticity and integrity of images using cryptographic signatures (Correct answer)
- It prevents containers from accessing the host filesystem
- It enforces CPU and memory limits automatically
Correct answer: It verifies the authenticity and integrity of images using cryptographic signatures
DCT uses cryptographic signatures to verify that images come from a trusted publisher and have not been tampered with.
Question 6: A junior engineer checks in a Dockerfile with the instruction 'USER root' for all services. What is the professional responsibility of the reviewer?
- Approve it since root access simplifies operations
- Request that the engineer use a non-root user and explain the principle of least privilege (Correct answer)
- Merge it and add a comment to fix later
- Reject it without explanation to enforce standards
Correct answer: Request that the engineer use a non-root user and explain the principle of least privilege
Reviewers should require non-root users and explain why least privilege reduces the blast radius of a container compromise.
Question 7: Which approach best reflects professional standards when decommissioning a Docker-based service that stores sensitive data?
- Stop the containers and leave the volumes intact indefinitely
- Remove containers, securely wipe associated volumes, and revoke all related credentials and access (Correct answer)
- Archive the images to a public registry for future reference
- Transfer the data volumes to a development environment for reuse
Correct answer: Remove containers, securely wipe associated volumes, and revoke all related credentials and access
Secure decommissioning requires stopping services, wiping sensitive data from volumes, and revoking all credentials to prevent data leakage.
DCA Professional Standards & Ethics 3
Which practice best upholds data privacy ethics when building Docker images that process user PII?