DCA Regulatory Compliance & Legal Framework 5 — Questions and Answers
Question 1: Which Docker Trusted Registry (DTR) feature enables organizations to enforce policy that only vulnerability-free images can be promoted to production, supporting compliance requirements?
- Image mirroring
- Promotion policies based on image scan results (Correct answer)
- Garbage collection scheduling
- Repository webhooks
Correct answer: Promotion policies based on image scan results
DTR promotion policies allow automated enforcement of quality gates, blocking images with critical vulnerabilities from being promoted to production repositories.
Question 2: The MIT License is considered permissive. What is the primary legal obligation when incorporating MIT-licensed code into a Docker image for commercial distribution?
- Open-source the entire application
- Retain the original copyright notice and license text (Correct answer)
- Pay licensing fees to the original author
- Register the derivative work with the U.S. Copyright Office
Correct answer: Retain the original copyright notice and license text
The MIT License only requires preserving the copyright notice and license text in distributions, with no restrictions on commercial use or proprietary derivatives.
Question 3: An auditor asks for proof that a containerized production environment has no unauthorized configuration changes. Which Docker/Kubernetes approach best satisfies this Infrastructure as Code compliance requirement?
- Manually documenting container configurations after each change
- Using GitOps workflows where all configuration changes are tracked in version control with signed commits (Correct answer)
- Running containers in privileged mode for maximum flexibility
- Allowing operators to exec into containers and make live changes
Correct answer: Using GitOps workflows where all configuration changes are tracked in version control with signed commits
GitOps enforces that all configuration changes flow through version-controlled, auditable pipelines, providing a complete change history satisfying compliance audit requirements.
Question 4: Under ISO 27001, which control category is most relevant when defining how Docker container access should be managed within an ISMS?
- A.7 Human Resource Security
- A.9 Access Control (Correct answer)
- A.12 Operations Security
- A.14 System Acquisition, Development, and Maintenance
Correct answer: A.9 Access Control
ISO 27001 Annex A.9 (Access Control) governs user access management, including permissions to container registries, orchestration platforms, and container runtimes.
Question 5: A company discovers a critical CVE in a base image used across 200 running containers. Under a typical enterprise vulnerability management SLA, what is the FIRST step in the remediation process?
- Immediately stop all affected containers
- Assess the CVE severity and exploitability to determine the applicable remediation SLA tier (Correct answer)
- Rebuild images without informing security teams
- Wait for the next scheduled maintenance window regardless of severity
Correct answer: Assess the CVE severity and exploitability to determine the applicable remediation SLA tier
Risk-based vulnerability management requires assessing CVE severity (CVSS) and exploitability first to correctly prioritize and apply the appropriate SLA-driven remediation timeline.
Question 6: Which Docker runtime security tool specifically generates and enforces Seccomp profiles to limit syscalls available to containers, supporting compliance with least-privilege requirements?
- Docker Scout
- Falco
- docker/default Seccomp profile or custom profiles with --security-opt seccomp (Correct answer)
- Docker Bench for Security
Correct answer: docker/default Seccomp profile or custom profiles with --security-opt seccomp
Docker's default Seccomp profile blocks ~44 dangerous syscalls, and custom profiles via --security-opt seccomp enforce granular syscall restrictions for least-privilege compliance.
Question 7: A GDPR Data Protection Impact Assessment (DPIA) is being conducted for a new Docker-based analytics platform. When is a DPIA legally required under GDPR Article 35?
- Only when processing data of more than 1 million users
- When processing is likely to result in high risk to individuals' rights, such as large-scale profiling or systematic monitoring (Correct answer)
- Whenever Docker containers are deployed in EU data centers
- Only for healthcare and financial data regardless of scale
Correct answer: When processing is likely to result in high risk to individuals' rights, such as large-scale profiling or systematic monitoring
GDPR Article 35 mandates a DPIA before processing that is likely to result in high risk, including large-scale profiling, systematic monitoring, or processing sensitive categories of data.
DCA Regulatory Compliance & Legal Framework 5
Which Docker Trusted Registry (DTR) feature enables organizations to enforce policy that only vulnerability-free images can be promoted to production, supporting compliance requirements?