DCA Regulatory Compliance & Legal Framework 3 — Questions and Answers
Question 1: A Docker image includes a library licensed under LGPL. What obligation does this create for a company distributing a proprietary application using that image?
- The entire application must be open-sourced under LGPL
- The LGPL library source code must be made available, but the proprietary application code can remain closed (Correct answer)
- No obligations exist because the library is inside a container
- The company must purchase a commercial license from the library maintainer
Correct answer: The LGPL library source code must be made available, but the proprietary application code can remain closed
LGPL allows linking proprietary software with LGPL libraries as long as the LGPL library source (or object files enabling relinking) is made available.
Question 2: SOC 2 Type II compliance requires evidence of controls over an extended period. Which Docker logging approach best supports this requirement?
- Logging only to container stdout without persistence
- Centralized log aggregation with tamper-evident storage for the required retention period (Correct answer)
- Storing logs inside the container filesystem
- Disabling logging to reduce container overhead
Correct answer: Centralized log aggregation with tamper-evident storage for the required retention period
SOC 2 Type II requires evidence of consistent controls over time, necessitating centralized, tamper-evident logs retained for audit periods.
Question 3: Which U.S. executive order and subsequent guidance requires federal agencies to provide SBOMs for critical software?
- Executive Order 13556 on Controlled Unclassified Information
- Executive Order 14028 on Improving the Nation's Cybersecurity (Correct answer)
- FISMA Modernization Act of 2014
- Federal Acquisition Regulation Part 12
Correct answer: Executive Order 14028 on Improving the Nation's Cybersecurity
EO 14028 (May 2021) directed NIST and CISA to define critical software and required vendors to provide SBOMs to enhance software supply chain security.
Question 4: When using Docker Secrets in Swarm mode, how are secrets delivered to containers in a way that supports least-privilege compliance?
- Secrets are baked into the image at build time
- Secrets are injected as environment variables visible in docker inspect
- Secrets are mounted as in-memory tmpfs files accessible only to authorized services (Correct answer)
- Secrets are stored in container labels
Correct answer: Secrets are mounted as in-memory tmpfs files accessible only to authorized services
Docker Secrets are mounted as tmpfs files inside containers, never written to disk, and only accessible to services explicitly granted access.
Question 5: A financial institution subject to FFIEC guidelines deploys Docker containers. Which network segmentation practice aligns with FFIEC cybersecurity requirements?
- Placing all containers on a single flat network for simplicity
- Using Docker network overlays to segment containers by trust zone and enforcing inter-zone firewall rules (Correct answer)
- Exposing all container ports on the host interface
- Disabling TLS between microservices for lower latency
Correct answer: Using Docker network overlays to segment containers by trust zone and enforcing inter-zone firewall rules
FFIEC guidance requires network segmentation to isolate sensitive systems; Docker overlay networks enable logical separation enforced by network policies.
Question 6: What does the Apache 2.0 license require when distributing modified versions of Apache-licensed Docker components?
- Release modified source code under Apache 2.0
- Include a NOTICE file and state significant changes made to the original (Correct answer)
- Obtain written permission from the Apache Software Foundation
- Pay royalties for commercial use
Correct answer: Include a NOTICE file and state significant changes made to the original
Apache 2.0 requires preserving the NOTICE file and indicating changes, but does not require releasing modified source code.
Question 7: Under NIST SP 800-190 (Application Container Security Guide), what is the recommended approach to container image provenance?
- Pull images from any public registry to maximize choice
- Use only images from trusted registries with verified signatures and maintained update cadence (Correct answer)
- Build all images from scratch without base image dependencies
- Trust images that have been deployed successfully in production without scanning
Correct answer: Use only images from trusted registries with verified signatures and maintained update cadence
NIST SP 800-190 recommends using trusted, signed images from reputable sources and regularly updating them to address vulnerabilities.
DCA Regulatory Compliance & Legal Framework 3
A Docker image includes a library licensed under LGPL.
What obligation does this create for a company distributing a proprietary application using that image?