DCA Regulatory Compliance & Legal Framework 4

Question 1

Which Docker capability should be dropped to comply with CIS Docker Benchmark recommendations for minimizing container attack surface?

Accepted Answer

CAP_NET_BIND_SERVICE when the container does not need to bind privileged ports

Answer

The CIS Benchmark recommends dropping unneeded capabilities; CAP_NET_BIND_SERVICE is often unnecessary and should be removed when containers don't bind to ports below 1024.

Question 2

A healthcare organization uses Docker for a telehealth platform. Under HITECH Act provisions, breach notification timelines apply when PHI is exposed. What Docker control helps detect a potential breach quickly?

Accepted Answer

Runtime security monitoring with anomaly detection for unexpected container behaviors

Answer

Runtime monitoring with anomaly detection enables rapid detection of unauthorized access or data exfiltration, supporting the HITECH 60-day breach notification requirement.

Question 3

Docker Hub's Terms of Service for free accounts includes rate limiting on image pulls. Which organizational compliance concern does this primarily raise?

Accepted Answer

Supply chain reliability and availability risk for production CI/CD pipelines

Answer

Rate limiting on free Docker Hub accounts can disrupt CI/CD pipelines and production deployments, creating operational risk and potential SLA compliance failures.

Question 4

Which practice ensures Docker image build reproducibility, which is required for software supply chain compliance frameworks like SLSA?

Accepted Answer

Pinning base images to immutable digests (SHA256) in Dockerfiles

Answer

Pinning to SHA256 digests ensures the exact same base image is used in every build, enabling reproducibility as required by SLSA provenance requirements.

Question 5

The EU Cyber Resilience Act (CRA) imposes requirements on products with digital elements. How does it affect companies distributing Docker-based commercial software?

Accepted Answer

Vendors must implement vulnerability handling processes, provide SBOMs, and report actively exploited vulnerabilities within 24 hours

Answer

The CRA requires manufacturers of products with digital elements to establish vulnerability management, provide SBOMs, and notify authorities of actively exploited vulnerabilities within 24 hours.

DCA - Docker Certified Associate Exam Practice Test

DCA - Docker Certified Associate Exam Practice Test

DCA Regulatory Compliance & Legal Framework 4