DCA Project Planning & Execution 3 — Questions and Answers
Question 1: A project architect must ensure containers in different Docker networks cannot communicate unless explicitly allowed. What feature enforces this?
- Docker network aliases restrict cross-network traffic by default
- By default, containers on different networks are isolated from each other (Correct answer)
- IPTables rules must be manually written to enforce isolation
- Docker Compose v3 files disable inter-network routing automatically
Correct answer: By default, containers on different networks are isolated from each other
Docker network isolation is the default; containers on separate networks cannot communicate unless connected to a shared network.
Question 2: When planning secrets management for a Docker Swarm project, what is the correct way to create a secret from a file?
- docker secret add --file ./secret.txt my_secret
- docker secret create my_secret ./secret.txt (Correct answer)
- docker config create my_secret ./secret.txt
- docker service secret inject my_secret ./secret.txt
Correct answer: docker secret create my_secret ./secret.txt
The 'docker secret create <name> <file>' command creates a Swarm secret stored encrypted in the Raft log.
Question 3: A CI pipeline must build multi-architecture Docker images for both amd64 and arm64. Which tool and command accomplishes this in one step?
- docker build --arch amd64,arm64 -t myimage .
- docker buildx build --platform linux/amd64,linux/arm64 -t myimage --push . (Correct answer)
- docker manifest build --multi-arch -t myimage .
- docker build --cross-compile linux/amd64,linux/arm64 -t myimage .
Correct answer: docker buildx build --platform linux/amd64,linux/arm64 -t myimage --push .
Docker Buildx with the --platform flag builds multi-architecture images and can push a multi-arch manifest in a single command.
Question 4: During project planning, the team decides to use Docker volumes instead of bind mounts for persistent data. What is the primary operational advantage?
- Volumes are faster because they bypass the union filesystem entirely on all drivers
- Volumes are managed by Docker, making backup, migration, and sharing between containers easier (Correct answer)
- Volumes store data inside the container layer for better portability
- Volumes automatically replicate data across Swarm nodes
Correct answer: Volumes are managed by Docker, making backup, migration, and sharing between containers easier
Docker-managed volumes support lifecycle operations (backup, inspect, migrate) and are decoupled from the host filesystem path.
Question 5: A project requires zero-downtime deployments in Docker Swarm. Which update configuration achieves this?
- --update-parallelism 0 --update-delay 0s
- --update-parallelism 1 --update-delay 10s with health checks configured (Correct answer)
- --update-order stop-first with --update-parallelism equal to replica count
- --update-failure-action continue to skip failed tasks
Correct answer: --update-parallelism 1 --update-delay 10s with health checks configured
Rolling updates with parallelism of 1, a delay, and health checks ensure new tasks are healthy before old ones are removed.
Question 6: When executing a containerized project in a regulated environment, which Docker feature allows you to drop Linux kernel capabilities from a container?
- docker run --no-caps
- docker run --cap-drop <capability> (Correct answer)
- docker run --security-opt no-capabilities
- docker run --privilege=false
Correct answer: docker run --cap-drop <capability>
The --cap-drop flag removes specific Linux capabilities, following the principle of least privilege for container security.
Question 7: A team is planning Docker image layer caching strategy in their CI system. Which Dockerfile instruction order maximizes cache reuse?
- COPY source code first, then RUN dependency installation
- RUN dependency installation first using lockfiles, then COPY application source (Correct answer)
- ADD all files at the start so all layers share the same cache
- Place all RUN commands at the end after all COPY instructions
Correct answer: RUN dependency installation first using lockfiles, then COPY application source
Copying only the lockfile and installing dependencies before copying source code allows the dependency layer to be cached across code changes.
DCA Project Planning & Execution 3
A project architect must ensure containers in different Docker networks cannot communicate unless explicitly allowed.
What feature enforces this?