DCA Risk Assessment & Management 4

Question 1

When conducting a risk assessment for Docker daemon exposure, which configuration change MOST reduces the network attack surface of the daemon?

Accepted Answer

Configuring the daemon to listen only on a Unix socket and requiring mutual TLS for any TCP exposure

Answer

Unauthenticated TCP exposure of the Docker daemon is a critical risk; mutual TLS with client certificates ensures only authorized clients can connect remotely.

Question 2

A container workload requires reading from `/etc/passwd` on the host. An assessor flags this as high risk. What mitigation maintains functionality while reducing risk?

Accepted Answer

Mount the file as a read-only bind mount (`--mount type=bind,source=/etc/passwd,target=/etc/passwd,readonly`)

Answer

A read-only bind mount grants the container access to the specific file without allowing writes or granting broader host filesystem permissions.

Question 3

In a Docker environment, what does the term 'image provenance' refer to in the context of supply chain risk?

Accepted Answer

The verified chain of custody showing where an image was built, by whom, and from what source

Answer

Image provenance tracks the build origin, build process, and signing chain, allowing consumers to verify the image was produced by a trusted, untampered pipeline.

Question 4

Which cgroup-based Docker flag prevents a container from consuming excessive CPU and impacting other workloads on the same host?

Accepted Answer

`--cpu-shares` or `--cpus`

Answer

`--cpus` sets a hard CPU quota and `--cpu-shares` sets relative weight, both using Linux cgroups to prevent a container from monopolizing CPU resources.

Question 5

An assessor recommends enabling AppArmor profiles for Docker containers. What category of risk does this specifically address?

Accepted Answer

Unauthorized file system access and process execution within the container

Answer

AppArmor profiles use mandatory access control to restrict which files, directories, and executables a container process can access, limiting exploit impact.

DCA - Docker Certified Associate Exam Practice Test

DCA - Docker Certified Associate Exam Practice Test

DCA Risk Assessment & Management 4