DCA Quality Assurance & Improvement 5

Question 1

A security scan finds a critical CVE in a base image. What is the recommended remediation workflow in a Docker-based CI/CD pipeline?

Accepted Answer

Update the base image tag in the Dockerfile, rebuild, re-scan, and redeploy

Answer

The correct remediation is to update the Dockerfile to a patched base image version, rebuild from source, verify with a new scan, and redeploy to eliminate the vulnerability.

Question 2

Which 'docker stats' metric is most useful for detecting a memory leak in a containerized application?

Accepted Answer

MEM USAGE / LIMIT trending upward over time

Answer

A steadily increasing MEM USAGE value that approaches the LIMIT over time is the classic signature of a memory leak in a container.

Question 3

What is the effect of setting '--health-retries 1' in a Dockerfile HEALTHCHECK instruction?

Accepted Answer

The container becomes unhealthy after the very first failed health check probe

Answer

With retries=1, a single failed probe immediately transitions the container to 'unhealthy' status without additional retry attempts.

Question 4

A DevOps team wants to enforce image immutability in production. Which registry feature supports this goal?

Accepted Answer

Configuring immutable tags so that a pushed tag cannot be overwritten

Answer

Immutable tags in registries like ECR or Docker Hub prevent a tag from being overwritten after it is pushed, ensuring deployed images remain unchanged.

Question 5

Which command exports a container's filesystem as a tar archive for offline security auditing?

Accepted Answer

docker export

Answer

'docker export' flattens a container's filesystem (all layers merged) into a tar archive, useful for offline inspection or security auditing tools.

DCA - Docker Certified Associate Exam Practice Test

DCA - Docker Certified Associate Exam Practice Test

DCA Quality Assurance & Improvement 5