DCA Regulatory Compliance & Legal Framework 2 — Questions and Answers
Question 1: Under HIPAA regulations, which Docker practice best protects Protected Health Information (PHI) stored in container volumes?
- Encrypting volume data at rest using Docker's built-in encryption
- Storing PHI in named volumes without access controls
- Using bind mounts for PHI to leverage host filesystem permissions
- Encrypting volumes at rest and enforcing access controls via secrets management (Correct answer)
Correct answer: Encrypting volumes at rest and enforcing access controls via secrets management
HIPAA requires both encryption of PHI at rest and strict access controls, so combining encrypted volumes with secrets management satisfies the Security Rule.
Question 2: Which open-source license requires that derivative works be distributed under the same license terms as the original software?
- MIT License
- Apache 2.0 License
- GNU GPL (Copyleft) (Correct answer)
- BSD 2-Clause License
Correct answer: GNU GPL (Copyleft)
The GNU GPL is a copyleft license that requires derivative works to be released under the same GPL terms.
Question 3: A company must demonstrate that only authorized users accessed container registries during an audit. Which Docker Enterprise feature primarily supports this requirement?
- Docker Content Trust (DCT)
- Role-Based Access Control (RBAC) with audit logs in Docker Trusted Registry (Correct answer)
- Image scanning with Snyk
- Automated container restarts via orchestration
Correct answer: Role-Based Access Control (RBAC) with audit logs in Docker Trusted Registry
DTR's RBAC combined with audit logs provides a record of who accessed which images and when, satisfying access control audit requirements.
Question 4: PCI DSS Requirement 6 mandates secure development practices. Which Docker workflow directly addresses this for containerized applications?
- Using latest tags for all base images
- Integrating image vulnerability scanning into the CI/CD pipeline before deployment (Correct answer)
- Running all containers as root for simplified access
- Disabling Docker Content Trust to speed up deployments
Correct answer: Integrating image vulnerability scanning into the CI/CD pipeline before deployment
Scanning images for vulnerabilities in CI/CD pipelines aligns with PCI DSS Req 6's mandate to identify and fix security vulnerabilities before deployment.
Question 5: What is the primary legal purpose of a Software Bill of Materials (SBOM) in a containerized environment?
- To list all running container IDs in a cluster
- To document all software components and dependencies for vulnerability tracking and license compliance (Correct answer)
- To automate container image builds
- To configure Docker network policies
Correct answer: To document all software components and dependencies for vulnerability tracking and license compliance
An SBOM inventories all software components so organizations can track vulnerabilities (e.g., Log4Shell) and verify license compliance across dependencies.
Question 6: Under GDPR, a Docker-based application processes EU citizens' data. What must the organization ensure about data transferred outside the EU?
- Data can be transferred freely to any country if encrypted
- Transfers require adequacy decisions, Standard Contractual Clauses, or other approved mechanisms (Correct answer)
- GDPR only applies to data stored within EU data centers
- Container orchestration tools automatically handle GDPR data transfer compliance
Correct answer: Transfers require adequacy decisions, Standard Contractual Clauses, or other approved mechanisms
GDPR Chapter V restricts international data transfers and requires adequacy decisions, SCCs, or binding corporate rules unless an exception applies.
Question 7: Which Docker feature helps organizations comply with the CIS Docker Benchmark recommendation to prevent privilege escalation in containers?
- Setting --privileged flag on all containers
- Using --security-opt=no-new-privileges in container run commands (Correct answer)
- Mounting the Docker socket into all containers
- Disabling AppArmor profiles for flexibility
Correct answer: Using --security-opt=no-new-privileges in container run commands
The --security-opt=no-new-privileges flag prevents processes inside containers from gaining additional privileges via setuid or setgid executables.
DCA Regulatory Compliance & Legal Framework 2
Under HIPAA regulations, which Docker practice best protects Protected Health Information (PHI) stored in container volumes?