DCA Risk Assessment & Management 5

Question 1

A risk assessment identifies that Docker build cache is being shared across multiple teams in a CI environment. What is the primary security concern?

Accepted Answer

A malicious or compromised build from one team could poison the shared cache and inject artifacts into other teams' images

Answer

Cache poisoning allows a tampered layer to be reused by subsequent builds, silently introducing malicious code into images built by other teams.

Question 2

Which command correctly audits the Linux capabilities granted to a running Docker container to assess privilege escalation risk?

Accepted Answer

`docker inspect <container> --format '{{.HostConfig.CapAdd}}'`

Answer

`docker inspect` reads the container's HostConfig, which shows added and dropped Linux capabilities configured at container start time.

Question 3

A security team wants to enforce that all containers in a Swarm cluster run only images from a trusted internal registry. Which control implements this at the cluster level?

Accepted Answer

Deploying an admission control policy or image signing enforcement that rejects images from untrusted registries

Answer

Admission controllers or policy engines (e.g., OPA, Notary enforcement) intercept API requests cluster-wide and reject non-compliant image sources before scheduling.

Question 4

What risk is introduced by running long-lived, stateful data directly inside a container's writable layer rather than in a Docker volume?

Accepted Answer

Data loss on container removal, since the writable layer is destroyed when the container is deleted

Answer

A container's writable layer is ephemeral and tied to the container's lifecycle; data not stored in a named volume is permanently lost when the container is removed.

Question 5

An organization's compliance requirement mandates that all Docker container activity be auditable. Which daemon-level configuration enables system-call-level audit logging for containers?

Accepted Answer

Enabling Linux Audit (`auditd`) rules on `/usr/bin/docker` and the Docker socket

Answer

Adding auditd rules for the Docker binary, daemon socket, and relevant directories captures privileged operations at the kernel audit subsystem level for compliance.

DCA - Docker Certified Associate Exam Practice Test

DCA - Docker Certified Associate Exam Practice Test

DCA Risk Assessment & Management 5