DCA Professional Standards & Ethics 5 — Questions and Answers
Question 1: What ethical obligation exists when a Docker professional transitions to a new employer and has knowledge of the former employer's container infrastructure?
- They may replicate the former employer's architecture since it is general technical knowledge
- They must maintain confidentiality of proprietary configurations, credentials, and internal architecture details (Correct answer)
- They can share the former employer's Dockerfiles if they improve them
- They are free to use any container images they personally built for the former employer
Correct answer: They must maintain confidentiality of proprietary configurations, credentials, and internal architecture details
Professional ethics and most employment agreements require maintaining confidentiality of proprietary technical information after departure.
Question 2: A Docker Certified Associate is asked to sign off on a container deployment they have not reviewed. What is the correct professional response?
- Sign off to avoid slowing down the team
- Refuse to sign off without personally reviewing the deployment artifacts and security checks (Correct answer)
- Delegate sign-off to a junior team member
- Sign off with a disclaimer that they did not review it
Correct answer: Refuse to sign off without personally reviewing the deployment artifacts and security checks
Professional certifications carry ethical responsibility; signing off on unreviewed work exposes both the individual and the organization to unnecessary risk.
Question 3: Which action best demonstrates professional responsibility when a publicly available Dockerfile you authored is found to have a security flaw?
- Remove the repository without explanation
- Publish a corrected version, add a security advisory, and notify known users of the vulnerability and fix (Correct answer)
- Mark the flaw as a 'won't fix' without explanation
- Archive the project to avoid further responsibility
Correct answer: Publish a corrected version, add a security advisory, and notify known users of the vulnerability and fix
Publishing a fix, issuing a security advisory, and notifying users are the professionally responsible actions when a public artifact has a security flaw.
Question 4: When a team adopts a new container security scanning tool, how should professionals handle scan findings they disagree with?
- Suppress the findings to keep dashboards clean
- Evaluate each finding on merit, document any accepted risks formally, and escalate disagreements through proper channels (Correct answer)
- Disable the rule without documentation
- Argue that the tool is incorrect and stop using it
Correct answer: Evaluate each finding on merit, document any accepted risks formally, and escalate disagreements through proper channels
Security findings should be evaluated carefully; accepted risks must be formally documented, and disagreements escalated through proper review processes.
Question 5: A Docker swarm cluster is shared between development and production workloads. What professional concern should be raised?
- Shared clusters reduce costs and are always acceptable
- Mixing dev and production on the same cluster creates blast-radius and compliance risks that require strong isolation controls or separate clusters (Correct answer)
- Development workloads improve production performance by sharing the warm cache
- There is no concern if network policies are in place
Correct answer: Mixing dev and production on the same cluster creates blast-radius and compliance risks that require strong isolation controls or separate clusters
Mixing dev and production workloads risks a dev misconfiguration affecting production and often violates compliance requirements for environment separation.
Question 6: Which behavior best demonstrates professional integrity when estimating the effort required to harden a Docker deployment?
- Underestimate to get the project approved and fix it later
- Provide an accurate estimate based on a thorough security assessment, even if it delays the project (Correct answer)
- Skip the estimate and start work immediately
- Copy estimates from a similar project without reviewing the current environment
Correct answer: Provide an accurate estimate based on a thorough security assessment, even if it delays the project
Accurate estimates based on real assessments are essential to professional integrity, even when they are inconvenient for project timelines.
Question 7: A container orchestration platform is configured to allow privileged containers by default. What professional standard demands immediate attention?
- Privileged mode is standard and requires no action
- The default must be changed to deny privileged containers and require explicit approval with documented justification for any exceptions (Correct answer)
- Only containers from external registries need this restriction
- Privileged mode should be allowed for performance-sensitive workloads without restriction
Correct answer: The default must be changed to deny privileged containers and require explicit approval with documented justification for any exceptions
Privileged containers effectively have host-level access, so denying them by default and requiring documented exceptions is a critical security standard.
DCA Professional Standards & Ethics 5
What ethical obligation exists when a Docker professional transitions to a new employer and has knowledge of the former employer's container infrastructure?