DCA Professional Standards & Ethics 4 — Questions and Answers
Question 1: A team is under deadline pressure to ship a container update. The security scan shows a high-severity CVE. What is the ethically correct action?
- Ship the update and file a ticket to fix the CVE next sprint
- Block the release until the CVE is patched or a formal risk acceptance is documented by stakeholders (Correct answer)
- Suppress the scan result to avoid delays
- Deploy to production and monitor for exploitation
Correct answer: Block the release until the CVE is patched or a formal risk acceptance is documented by stakeholders
Shipping a known high-severity CVE without documented risk acceptance is professionally irresponsible and exposes users to harm.
Question 2: What professional standard applies when documenting a Docker Compose file used in production?
- Documentation is optional if the team is small
- Include service dependencies, port mappings, environment variable meanings, and security considerations (Correct answer)
- Only document the image names used
- Use inline comments sparingly since they clutter the file
Correct answer: Include service dependencies, port mappings, environment variable meanings, and security considerations
Production infrastructure must be documented thoroughly so any team member can understand, maintain, and securely operate the system.
Question 3: An engineer uses a personal Docker Hub account to store company images. Which professional concern does this raise?
- Personal accounts offer better storage capacity
- Company intellectual property and access control are at risk if the personal account is compromised or the employee leaves (Correct answer)
- Docker Hub personal accounts have stronger security than organization accounts
- There is no concern since Docker Hub is a public platform
Correct answer: Company intellectual property and access control are at risk if the personal account is compromised or the employee leaves
Storing company images in a personal account creates IP ownership ambiguity and access control gaps when the employee departs.
Question 4: Which practice best demonstrates professional ethics when running automated container builds in a CI/CD pipeline?
- Allow the pipeline to use root credentials for simplicity
- Use scoped service account credentials with minimal required permissions for each pipeline stage (Correct answer)
- Share one admin token across all pipeline stages
- Disable TLS verification to speed up image pulls
Correct answer: Use scoped service account credentials with minimal required permissions for each pipeline stage
CI/CD pipelines should use scoped, least-privilege credentials to minimize the blast radius of a credential leak.
Question 5: A Docker swarm node is running at 95% memory utilization. What is the professional response?
- Ignore it; Docker will handle memory pressure automatically
- Investigate the cause, scale the service or add capacity, and set memory limits to prevent recurrence (Correct answer)
- Restart the node to free memory without further investigation
- Reduce the number of replicas to lower memory usage without telling anyone
Correct answer: Investigate the cause, scale the service or add capacity, and set memory limits to prevent recurrence
Persistent high utilization requires investigation, capacity planning, and applying resource limits to prevent instability.
Question 6: Which professional standard governs how Docker audit logs should be handled in a regulated industry?
- Audit logs can be deleted weekly to save disk space
- Audit logs must be retained for the period required by regulation, stored securely, and protected from tampering (Correct answer)
- Only failed commands need to be logged
- Audit logs are optional if the team uses Docker Enterprise
Correct answer: Audit logs must be retained for the period required by regulation, stored securely, and protected from tampering
Regulated industries require audit logs to be retained, secured, and tamper-proof to support compliance and forensic investigations.
Question 7: A team discovers that a container is exfiltrating data via an unexpected outbound network connection. What is the ethical and professional first step?
- Restart the container to stop the connection
- Isolate the container immediately, preserve network logs, and begin incident response procedures (Correct answer)
- Notify the container owner and wait for them to investigate
- Document it for the next quarterly security review
Correct answer: Isolate the container immediately, preserve network logs, and begin incident response procedures
Active exfiltration is a security incident requiring immediate isolation and evidence preservation, not deferred action.
DCA Professional Standards & Ethics 4
A team is under deadline pressure to ship a container update.
The security scan shows a high-severity CVE.
What is the ethically correct action?