DCA Risk Assessment & Management 2

Question 1

A security team discovers that several Docker containers are running with the `--privileged` flag in production. What is the PRIMARY risk this introduces?

Accepted Answer

Containers gain access to all host devices and can escape the container isolation boundary

Answer

The `--privileged` flag grants the container nearly all capabilities of the host kernel, allowing potential container escape and full host compromise.

Question 2

When assessing risk in a Docker Swarm deployment, which component is considered the most critical to protect because its compromise affects the entire cluster?

Accepted Answer

Manager nodes, which control cluster state and secret distribution

Answer

Swarm manager nodes hold the cluster's Raft consensus state, orchestrate workloads, and distribute secrets, making them the highest-value target.

Question 3

An organization wants to reduce the attack surface of its container images. Which practice BEST achieves this goal?

Accepted Answer

Using minimal or distroless base images and removing unnecessary packages

Answer

Minimal or distroless images contain only the application and its runtime dependencies, eliminating unused tools that attackers could exploit.

Question 4

Which Docker feature allows you to enforce mandatory access controls by restricting the system calls a container can make to the host kernel?

Accepted Answer

Seccomp profiles

Answer

Seccomp (Secure Computing Mode) profiles define an allowlist or blocklist of Linux system calls available to a container, reducing kernel attack surface.

Question 5

A developer accidentally pushed a Docker image containing a hardcoded database password to a public registry. What is the CORRECT remediation approach?

Accepted Answer

Immediately rotate the compromised credential, remove all affected image versions, and audit access logs

Answer

Rotating the credential limits blast radius immediately; removing all image versions prevents further exposure since image layers are immutable and may be cached.

DCA - Docker Certified Associate Exam Practice Test

DCA - Docker Certified Associate Exam Practice Test

DCA Risk Assessment & Management 2