DCA Quality Assurance & Improvement 5 — Questions and Answers
Question 1: A security scan finds a critical CVE in a base image. What is the recommended remediation workflow in a Docker-based CI/CD pipeline?
- Add the vulnerable package to a .dockerignore exclusion list
- Update the base image tag in the Dockerfile, rebuild, re-scan, and redeploy (Correct answer)
- Manually patch the running container and commit it as a new image
- Set the HEALTHCHECK to monitor for exploitation attempts
Correct answer: Update the base image tag in the Dockerfile, rebuild, re-scan, and redeploy
The correct remediation is to update the Dockerfile to a patched base image version, rebuild from source, verify with a new scan, and redeploy to eliminate the vulnerability.
Question 2: Which 'docker stats' metric is most useful for detecting a memory leak in a containerized application?
- CPU %
- MEM USAGE / LIMIT trending upward over time (Correct answer)
- NET I/O
- BLOCK I/O
Correct answer: MEM USAGE / LIMIT trending upward over time
A steadily increasing MEM USAGE value that approaches the LIMIT over time is the classic signature of a memory leak in a container.
Question 3: What is the effect of setting '--health-retries 1' in a Dockerfile HEALTHCHECK instruction?
- The container becomes unhealthy after the very first failed health check probe (Correct answer)
- The health check runs only once at startup
- Docker retries the health check once before marking the container unhealthy
- It disables retries, making the check pass/fail on the first attempt only
Correct answer: The container becomes unhealthy after the very first failed health check probe
With retries=1, a single failed probe immediately transitions the container to 'unhealthy' status without additional retry attempts.
Question 4: A DevOps team wants to enforce image immutability in production. Which registry feature supports this goal?
- Enabling anonymous pull access
- Configuring immutable tags so that a pushed tag cannot be overwritten (Correct answer)
- Setting image expiration policies
- Enabling image compression on push
Correct answer: Configuring immutable tags so that a pushed tag cannot be overwritten
Immutable tags in registries like ECR or Docker Hub prevent a tag from being overwritten after it is pushed, ensuring deployed images remain unchanged.
Question 5: Which command exports a container's filesystem as a tar archive for offline security auditing?
- docker save
- docker export (Correct answer)
- docker image export
- docker cp --all
Correct answer: docker export
'docker export' flattens a container's filesystem (all layers merged) into a tar archive, useful for offline inspection or security auditing tools.
Question 6: In Docker Swarm, what is the purpose of the '--update-monitor' duration flag on 'docker service update'?
- Sets how long the update waits between each task replacement
- Defines the window after each task update during which failures count against the failure ratio (Correct answer)
- Specifies the timeout before a task is considered failed
- Controls how long Swarm waits before starting the rollback
Correct answer: Defines the window after each task update during which failures count against the failure ratio
'--update-monitor' sets the observation window after each task is updated; failures within this window increment the failure count used against '--update-max-failure-ratio'.
Question 7: Which practice ensures that secrets passed to a Docker build do not appear in the final image's layer history?
- Passing secrets via ARG instructions
- Using BuildKit's '--secret' flag with 'RUN --mount=type=secret' (Correct answer)
- Storing secrets in ENV variables and deleting them in a later RUN
- Using a .dockerignore file to exclude secret files
Correct answer: Using BuildKit's '--secret' flag with 'RUN --mount=type=secret'
BuildKit's secret mount makes the secret available only during that RUN instruction's execution and is never committed to any image layer.
DCA Quality Assurance & Improvement 5
A security scan finds a critical CVE in a base image.
What is the recommended remediation workflow in a Docker-based CI/CD pipeline?