DCA Risk Assessment & Management 3

Question 1

Docker Content Trust (DCT) is enabled in a CI/CD pipeline. What specific risk does it mitigate?

Accepted Answer

Deployment of tampered or unsigned images from a registry

Answer

DCT uses Notary to verify image signatures, ensuring that only images signed by trusted publishers are pulled and run.

Question 2

A security audit finds that the Docker daemon socket `/var/run/docker.sock` is mounted inside several application containers. Why is this classified as a critical risk?

Accepted Answer

It gives the container full control over the Docker daemon, equivalent to root access on the host

Answer

Access to the Docker socket allows a container to issue any Docker API command, including spawning new privileged containers that mount the host filesystem.

Question 3

In a multi-tenant Docker environment, which Linux kernel feature provides the PRIMARY isolation boundary between containers on the same host?

Accepted Answer

Namespaces, which isolate process, network, mount, and user views between containers

Answer

Linux namespaces (pid, net, mnt, uts, ipc, user) create isolated views of system resources for each container, forming the core isolation mechanism.

Question 4

An organization's risk policy requires that no container run as UID 0. Which Dockerfile instruction enforces this at the image level?

Accepted Answer

USER nonroot

Answer

The `USER` instruction sets the default user for subsequent RUN, CMD, and ENTRYPOINT instructions, preventing the container from running as root.

Question 5

Which attack vector is introduced when using the `docker build --network=host` option in an untrusted build environment?

Accepted Answer

The build context can access host network resources, allowing exfiltration or SSRF via build steps

Answer

Host networking during build gives RUN instructions unrestricted access to the host's network interfaces, enabling data exfiltration or lateral movement.

DCA - Docker Certified Associate Exam Practice Test

DCA - Docker Certified Associate Exam Practice Test

DCA Risk Assessment & Management 3