DCA Quality Assurance & Improvement 2 — Questions and Answers
Question 1: Which Docker command runs a container's built-in health check immediately and returns the result without waiting for the interval?
- docker inspect --health
- docker exec <container> healthcheck
- docker run --health-cmd with --health-interval=0
- There is no way to trigger a health check on demand (Correct answer)
Correct answer: There is no way to trigger a health check on demand
Docker does not provide a direct command to trigger a HEALTHCHECK on demand; you must exec into the container and run the check command manually.
Question 2: A Dockerfile HEALTHCHECK reports 'unhealthy' but the container keeps running. What is the default Docker behavior in this situation?
- Docker automatically restarts the container
- Docker stops and removes the container
- The container continues running; orchestrators like Swarm may reschedule it (Correct answer)
- Docker pauses the container until it becomes healthy
Correct answer: The container continues running; orchestrators like Swarm may reschedule it
Docker itself does not stop an unhealthy standalone container; it is up to orchestrators (Swarm, Kubernetes) to act on the unhealthy status.
Question 3: When using 'docker build --no-cache', what quality assurance benefit does this provide?
- It speeds up the build by skipping unchanged layers
- It ensures every layer is rebuilt fresh, catching dependency drift (Correct answer)
- It disables multi-stage builds
- It forces BuildKit to use a remote cache
Correct answer: It ensures every layer is rebuilt fresh, catching dependency drift
Building without cache forces all layers to be re-executed, ensuring the image reflects the latest upstream dependencies and revealing any drift.
Question 4: Which tool is specifically designed to scan Docker images for OS and library CVEs and integrates natively with Docker Hub?
- Trivy
- Docker Scout (Correct answer)
- Snyk
- Anchore Engine
Correct answer: Docker Scout
Docker Scout is Docker's native vulnerability scanning and supply-chain security tool that integrates directly with Docker Hub and Docker Desktop.
Question 5: A developer wants to enforce that no container in a Swarm service runs as root. Which mechanism enforces this at the orchestration level?
- Dockerfile USER instruction
- Docker Swarm --user flag on service create (Correct answer)
- A Swarm config file with user constraints
- AppArmor profile attached to the service
Correct answer: Docker Swarm --user flag on service create
The '--user' flag on 'docker service create' overrides the image default and ensures all tasks in the service run as the specified non-root user.
Question 6: What does the '--iidfile' flag in 'docker build' help with in a CI/CD quality pipeline?
- It saves the image ID to a file so downstream pipeline steps can reference the exact built image (Correct answer)
- It writes the Dockerfile instructions to a file for auditing
- It tags the image with the commit hash automatically
- It generates an SBOM and writes it to the specified file
Correct answer: It saves the image ID to a file so downstream pipeline steps can reference the exact built image
'--iidfile' writes the resulting image ID to a file, allowing subsequent CI steps to reference the precise image digest rather than a mutable tag.
Question 7: Which 'docker service update' flag triggers a rolling update while ensuring a minimum number of tasks remain healthy before proceeding?
- --update-parallelism
- --update-delay
- --update-failure-action
- --update-max-failure-ratio (Correct answer)
Correct answer: --update-max-failure-ratio
'--update-max-failure-ratio' sets the fraction of tasks that may fail before the rolling update is considered failed and halted or rolled back.
DCA Quality Assurance & Improvement 2
Which Docker command runs a container's built-in health check immediately and returns the result without waiting for the interval?