DCA Project Planning & Execution 4 — Questions and Answers
Question 1: A project manager wants to enforce that all production services use only images from a trusted registry. Which Docker feature supports this at the Swarm level?
- Docker Content Trust (DCT) enforces signed image verification before deployment (Correct answer)
- Docker registry mirrors redirect all pull requests to the trusted registry
- Docker Swarm's --image-verify flag blocks unsigned images
- Firewalling all other registries at the host level is the only option
Correct answer: Docker Content Trust (DCT) enforces signed image verification before deployment
Docker Content Trust uses Notary to verify image signatures, preventing unsigned or tampered images from running.
Question 2: During execution planning, a team needs containers to communicate using service names as hostnames within a Docker Compose application. What enables this?
- Containers must use --add-host flags to register each other's names
- Docker Compose automatically creates a network where service names resolve as DNS hostnames (Correct answer)
- An external DNS server must be configured and referenced in each service
- Service name DNS only works when --network=host is specified
Correct answer: Docker Compose automatically creates a network where service names resolve as DNS hostnames
Docker Compose creates a default bridge network with embedded DNS so each service name resolves to the correct container IP.
Question 3: When planning log aggregation for a Dockerized project, which logging driver sends container logs directly to a remote syslog endpoint?
- json-file
- syslog (Correct answer)
- fluentd
- awslogs
Correct answer: syslog
The syslog logging driver forwards container log output to a syslog-compatible endpoint specified by --log-opt syslog-address.
Question 4: A project calls for containers to share the same network namespace so they can communicate over localhost. Which Docker run option achieves this?
- docker run --network=shared --name=sidecar
- docker run --network=container:<name_or_id> (Correct answer)
- docker run --ipc=container:<name_or_id>
- docker run --pid=container:<name_or_id>
Correct answer: docker run --network=container:<name_or_id>
The --network=container: option joins a new container to an existing container's network namespace, sharing the same network interfaces.
Question 5: During a Docker project retrospective, the team notes image sizes are too large. Which multi-stage build pattern most effectively reduces final image size?
- Using alpine as the base for both build and runtime stages
- Building in a full SDK image and copying only compiled artifacts to a minimal runtime image (Correct answer)
- Running apt-get clean in the final RUN statement of a single-stage build
- Using .dockerignore to exclude large files from the build context
Correct answer: Building in a full SDK image and copying only compiled artifacts to a minimal runtime image
Multi-stage builds compile in a full SDK image and COPY only the final binary/artifact into a slim runtime image, excluding build tools from the final image.
Question 6: A project plan requires that Swarm service replicas are distributed evenly across availability zones. Which placement constraint achieves this?
- --constraint 'node.role == worker'
- --placement-pref 'spread=node.labels.az' (Correct answer)
- --constraint 'node.labels.az != none'
- --replicas-max-per-node 1
Correct answer: --placement-pref 'spread=node.labels.az'
The --placement-pref spread option distributes replicas evenly across the values of a node label, such as availability zone.
Question 7: When executing a Swarm stack deployment, which command deploys or updates all services defined in a Compose file to the Swarm?
- docker compose up --swarm -f docker-compose.yml
- docker stack deploy -c docker-compose.yml <stack_name> (Correct answer)
- docker swarm apply -f docker-compose.yml <stack_name>
- docker service create --compose-file docker-compose.yml
Correct answer: docker stack deploy -c docker-compose.yml <stack_name>
The 'docker stack deploy -c <file> <stack>' command deploys a multi-service application to Docker Swarm using a Compose v3 file.
DCA Project Planning & Execution 4
A project manager wants to enforce that all production services use only images from a trusted registry.
Which Docker feature supports this at the Swarm level?