Docker Certified Associate (DCA) — Questions and Answers

Question 1: A company must demonstrate that only authorized users accessed container registries during an audit. Which Docker Enterprise feature primarily supports this requirement?

Image scanning with Snyk
Docker Content Trust (DCT)
Role-Based Access Control (RBAC) with audit logs in Docker Trusted Registry (Correct answer)
Automated container restarts via orchestration

Correct answer: Role-Based Access Control (RBAC) with audit logs in Docker Trusted Registry

DTR's RBAC combined with audit logs provides a record of who accessed which images and when, satisfying access control audit requirements.

Question 2: A project calls for containers to share the same network namespace so they can communicate over localhost. Which Docker run option achieves this?

docker run --network=shared --name=sidecar
docker run --network=container:<name_or_id> (Correct answer)
docker run --ipc=container:<name_or_id>
docker run --pid=container:<name_or_id>

Correct answer: docker run --network=container:<name_or_id>

The --network=container: option joins a new container to an existing container's network namespace, sharing the same network interfaces.

Question 3: What does the 'docker system prune -a' command remove, and what QA risk does it carry?

All containers regardless of state; may delete running services
Only stopped containers; low risk
Only dangling images; no risk to tagged images
All unused images including those not linked to a container, risking removal of cached base images needed for CI builds (Correct answer)

Correct answer: All unused images including those not linked to a container, risking removal of cached base images needed for CI builds

'-a' extends the prune to all unused images (not just dangling ones), which can delete base images cached for faster CI builds if no container references them.

Question 4: Which Docker Trusted Registry (DTR) feature enables organizations to enforce policy that only vulnerability-free images can be promoted to production, supporting compliance requirements?

Image mirroring
Repository webhooks
Promotion policies based on image scan results (Correct answer)
Garbage collection scheduling

Correct answer: Promotion policies based on image scan results

DTR promotion policies allow automated enforcement of quality gates, blocking images with critical vulnerabilities from being promoted to production repositories.

Question 5: A Docker swarm cluster is shared between development and production workloads. What professional concern should be raised?

Development workloads improve production performance by sharing the warm cache
Mixing dev and production on the same cluster creates blast-radius and compliance risks that require strong isolation controls or separate clusters (Correct answer)
Shared clusters reduce costs and are always acceptable
There is no concern if network policies are in place

Correct answer: Mixing dev and production on the same cluster creates blast-radius and compliance risks that require strong isolation controls or separate clusters

Mixing dev and production workloads risks a dev misconfiguration affecting production and often violates compliance requirements for environment separation.

Question 6: What is the name of the default overlay network created automatically when a Docker Swarm is initialized?

swarm_default
host
docker_gwbridge
ingress (Correct answer)

Correct answer: ingress

Docker Swarm creates the `ingress` overlay network during `docker swarm init` to support the routing mesh for published service ports.

Question 7: An operations stakeholder asks how to be notified of Docker daemon events in real time. Which command should you recommend?

docker stats
docker events (Correct answer)
docker inspect
docker top

Correct answer: docker events

`docker events` streams real-time events from the Docker daemon including container lifecycle and network events.

Question 8: What command retrieves the join token needed to add a worker node to an existing Swarm?

docker swarm token --worker
docker swarm worker-token
docker swarm join-token worker (Correct answer)
docker node add --token worker

Correct answer: docker swarm join-token worker

`docker swarm join-token worker` outputs the full `docker swarm join` command with the token required for a worker to join.

Question 9: You want to capture a single snapshot of container stats without streaming continuously. Which flag achieves this?

--no-stream (Correct answer)
--once
--single
--snapshot

Correct answer: --no-stream

`docker stats --no-stream` outputs one set of stats and exits instead of continuously streaming.

Question 10: What is the role of the IPAM driver in Docker networking?

Ingress Proxy and Access Module for Swarm
IP Address Management for allocating IPs and subnets to networks and containers (Correct answer)
Internal Port Access Mapping for published services
Image and Package Asset Management

Correct answer: IP Address Management for allocating IPs and subnets to networks and containers

IPAM (IP Address Management) is responsible for allocating IP addresses and subnets to Docker networks and their connected containers.

Question 11: What command is used to backup Docker containers among the list below?

docker save
none of the above
docker tar -cvf
docker export (Correct answer)

Correct answer: docker export

The docker export command is used to export the contents of a Docker container's filesystem as a tar archive. It allows you to create a snapshot of the container's filesystem at a specific point in time.

Question 12: Which Docker runtime security tool specifically generates and enforces Seccomp profiles to limit syscalls available to containers, supporting compliance with least-privilege requirements?

Docker Bench for Security
docker/default Seccomp profile or custom profiles with --security-opt seccomp (Correct answer)
Falco
Docker Scout

Correct answer: docker/default Seccomp profile or custom profiles with --security-opt seccomp

Docker's default Seccomp profile blocks ~44 dangerous syscalls, and custom profiles via --security-opt seccomp enforce granular syscall restrictions for least-privilege compliance.

Question 13: What is the purpose of DNS resolution in user-defined Docker networks?

To expose container ports to the host
To route traffic between Docker hosts
To assign IP addresses to containers
To allow containers to communicate using container names as hostnames (Correct answer)

Correct answer: To allow containers to communicate using container names as hostnames

User-defined networks include an embedded DNS server that allows containers to resolve each other by container name.

Question 14: Which command shows detailed information about a Docker network including its connected containers?

docker network inspect my-network (Correct answer)
docker network show my-network
docker network status my-network
docker network detail my-network

Correct answer: docker network inspect my-network

The `docker network inspect` command displays detailed JSON-formatted information about a network, including configuration and connected containers.

Question 15: When executing a Swarm stack deployment, which command deploys or updates all services defined in a Compose file to the Swarm?

docker swarm apply -f docker-compose.yml <stack_name>
docker compose up --swarm -f docker-compose.yml
docker service create --compose-file docker-compose.yml
docker stack deploy -c docker-compose.yml <stack_name> (Correct answer)

Correct answer: docker stack deploy -c docker-compose.yml <stack_name>

The 'docker stack deploy -c <file> <stack>' command deploys a multi-service application to Docker Swarm using a Compose v3 file.

Question 16: A --memory-reservation flag is set lower than --memory for a container. What does this mean operationally?

The container will be OOM-killed at the reservation threshold
The reservation is a soft limit Docker uses when the host is under memory pressure (Correct answer)
The container will never use more than the reservation amount
Reservation and hard limit must always be equal

Correct answer: The reservation is a soft limit Docker uses when the host is under memory pressure

Memory reservation is a soft guarantee; Docker tries to reclaim memory from the container down to this level when the host needs it.

Question 17: What is a dashboard in DCA data reporting?

A tool used only by IT departments
A physical control panel in an office
A written report submitted monthly to management
A visual display of key metrics and data points for at-a-glance monitoring of performance (Correct answer)

Correct answer: A visual display of key metrics and data points for at-a-glance monitoring of performance

A dashboard provides a consolidated visual display of important metrics, KPIs, and data trends, enabling stakeholders to quickly assess performance status and identify areas needing attention.

Question 18: Why is data visualization important in DCA reporting?

It makes complex data patterns and relationships easier to understand and communicate (Correct answer)
Visual data always replaces the need for written analysis
It is purely decorative with no analytical value
Charts are required by law in all professional reports

Correct answer: It makes complex data patterns and relationships easier to understand and communicate

Data visualization translates complex datasets into visual formats (charts, graphs, maps) that highlight patterns, trends, and outliers, making information more accessible and actionable for diverse audiences.

Question 19: What does 'routing mesh' mean in Docker Swarm networking?

A process for encrypting overlay network traffic
A DNS round-robin load balancing technique
Any Swarm node can accept requests on a published port and route them to a service container (Correct answer)
A method for assigning static IPs to Swarm services

Correct answer: Any Swarm node can accept requests on a published port and route them to a service container

Swarm's routing mesh allows any node to accept incoming connections on a published port and route them to a service task on any node.

Question 20: Which Docker capability should be dropped to comply with CIS Docker Benchmark recommendations for minimizing container attack surface?

CAP_NET_BIND_SERVICE when the container does not need to bind privileged ports (Correct answer)
CAP_CHOWN when the container needs to change file ownership
Only kernel-level capabilities need to be dropped
ALL capabilities should be retained by default for application compatibility

Correct answer: CAP_NET_BIND_SERVICE when the container does not need to bind privileged ports

The CIS Benchmark recommends dropping unneeded capabilities; CAP_NET_BIND_SERVICE is often unnecessary and should be removed when containers don't bind to ports below 1024.

Question 21: Docker Hub's Terms of Service for free accounts includes rate limiting on image pulls. Which organizational compliance concern does this primarily raise?

PCI DSS cardholder data exposure
Supply chain reliability and availability risk for production CI/CD pipelines (Correct answer)
GDPR data residency violations
SOC 2 encryption requirement violations

Correct answer: Supply chain reliability and availability risk for production CI/CD pipelines

Rate limiting on free Docker Hub accounts can disrupt CI/CD pipelines and production deployments, creating operational risk and potential SLA compliance failures.

Question 22: Which Docker resource constraint flag limits the proportion of CPU cycles a container can use relative to other containers?

--cpuset-cpus
--cpu-period
--cpus
--cpu-shares (Correct answer)

Correct answer: --cpu-shares

--cpu-shares sets a relative weight for CPU scheduling when multiple containers compete for CPU time.

Question 23: A release manager asks how to roll back a Docker Swarm service update that introduced errors. Which command should you use?

docker service rollback <service> (Correct answer)
docker swarm revert <service>
docker rollback service <service>
docker service update --rollback <service>

Correct answer: docker service rollback <service>

`docker service rollback <service>` reverts a service to its previous configuration in Docker Swarm.

Question 24: Which command removes a Docker network?

docker network rm my-network (Correct answer)
docker remove network my-network
docker network delete my-network
docker network destroy my-network

Correct answer: docker network rm my-network

The `docker network rm` command removes one or more Docker networks by name or ID.

Question 25: What is an internal control in DCA financial management?

A remote control for office equipment
A method for controlling employee behavior
A technique for controlling room temperature
A process designed to provide reasonable assurance about the reliability of financial reporting and compliance (Correct answer)

Correct answer: A process designed to provide reasonable assurance about the reliability of financial reporting and compliance

Internal controls are policies, procedures, and practices designed to safeguard assets, ensure accurate financial reporting, promote operational efficiency, and ensure compliance with laws and regulations.

Question 26: Which of the subsequent patterns would prevent any Python byte-code files from being copied during the building of a Docker image?

**.pyc
*.pyc
/*.pyc
**/*.pyc (Correct answer)

Correct answer: **/*.pyc

Docker provides a special wildcard string ** that matches any number of folders in addition to Go's filepath. Match rules (including zero). For instance, **/*.go will exclude all files with the.go extension that are present in any directory, including the build context's root.

Question 27: A risk model classifies the Docker host's kernel as a shared resource. Which threat does this shared-kernel architecture create that hypervisor-based virtualization does not?

A kernel vulnerability exploited inside one container can potentially affect all containers and the host (Correct answer)
The shared kernel prevents more than 256 containers from running simultaneously on one host
Containers on the same host cannot share CPU cache lines, causing cache misses
Docker containers cannot run on hosts with SELinux enabled

Correct answer: A kernel vulnerability exploited inside one container can potentially affect all containers and the host

Because all containers share the host kernel, a kernel exploit (e.g., container escape CVE) can compromise the entire host and all co-located containers simultaneously.

Question 28: What does the `PIDS` column in `docker stats` output represent?

Total number of Docker processes on the host
Number of paused containers
Process ID of the container's init process
Number of processes or threads running inside the container (Correct answer)

Correct answer: Number of processes or threads running inside the container

The `PIDS` column shows how many processes or threads are currently running inside that container.

Question 29: What is change management in DCA technology operations?

A structured process for evaluating, approving, and implementing changes to minimize risk (Correct answer)
Making any changes immediately without review or documentation
A method for changing employee passwords monthly
A process for replacing all legacy systems at once

Correct answer: A structured process for evaluating, approving, and implementing changes to minimize risk

IT change management ensures that all changes to systems and infrastructure are evaluated for risk, properly approved, tested, documented, and implemented in a controlled manner to minimize service disruption.

Question 30: What is the purpose of a communication plan in DCA project management?

To eliminate the need for meetings entirely
To define what information is shared, with whom, when, and through which channels (Correct answer)
To ensure only managers can communicate project status
To reduce the total amount of communication within a team

Correct answer: To define what information is shared, with whom, when, and through which channels

A communication plan establishes a structured approach to information sharing, defining the content, audience, frequency, channels, and responsible parties for each type of project communication.

Question 31: A risk assessment identifies that Docker build cache is being shared across multiple teams in a CI environment. What is the primary security concern?

Shared build cache prevents Docker Content Trust from verifying image signatures
A malicious or compromised build from one team could poison the shared cache and inject artifacts into other teams' images (Correct answer)
Build cache sharing disables layer deduplication in the image registry
Shared cache increases build times because of cache invalidation conflicts

Correct answer: A malicious or compromised build from one team could poison the shared cache and inject artifacts into other teams' images

Cache poisoning allows a tampered layer to be reused by subsequent builds, silently introducing malicious code into images built by other teams.

Question 32: What security benefit does enabling user namespace remapping in Docker provide?

Enables SSH key-based access to running containers
Maps the container's root user (UID 0) to an unprivileged UID on the host (Correct answer)
Allows multiple host users to share a single running container
Creates an isolated user database for each container

Correct answer: Maps the container's root user (UID 0) to an unprivileged UID on the host

User namespace remapping maps the container's root UID to a non-privileged host UID, significantly reducing the risk if a process escapes the container.

Question 33: Which Linux feature does Docker use to filter the system calls a container can make to the kernel?

Namespaces
Seccomp (Correct answer)
AppArmor
SELinux

Correct answer: Seccomp

Docker uses seccomp (secure computing mode) profiles to restrict which system calls a container process can invoke.

Question 34: Which `docker inspect` format filter extracts only the container's IP address from the default bridge network?

--format '{{.Config.IP}}'
--format '{{.Network.IP}}'
--format '{{.Bridge.IP}}'
--format '{{.NetworkSettings.IPAddress}}' (Correct answer)

Correct answer: --format '{{.NetworkSettings.IPAddress}}'

`{{.NetworkSettings.IPAddress}}` is the correct Go template path to extract the container IP from bridge network settings.

Question 35: Which command sets the availability of a Swarm node named 'node1' to 'drain'?

docker node drain node1
docker node update --availability drain node1 (Correct answer)
docker node set --drain node1
docker swarm drain node1

Correct answer: docker node update --availability drain node1

`docker node update --availability drain node1` prevents new tasks from being scheduled on the node and reschedules existing tasks elsewhere.

Question 36: Which 'docker system df' output column tells you how much disk space could be reclaimed by pruning?

SHARED SIZE
ACTIVE
SIZE
RECLAIMABLE (Correct answer)

Correct answer: RECLAIMABLE

The RECLAIMABLE column shows how much disk space would be freed if unused images, containers, and volumes were removed.

Question 37: An SRE team wants to communicate resource constraints to developers. Which Docker flag limits a container's CPU usage?

--max-cpu
--cpu-limit
--cpus (Correct answer)
--cpu-cap

Correct answer: --cpus

The `--cpus` flag specifies the number of CPUs available to the container as a decimal value.

Question 38: Which open-source license requires that derivative works be distributed under the same license terms as the original software?

MIT License
Apache 2.0 License
GNU GPL (Copyleft) (Correct answer)
BSD 2-Clause License

Correct answer: GNU GPL (Copyleft)

The GNU GPL is a copyleft license that requires derivative works to be released under the same GPL terms.

Question 39: Which 'docker stats' metric is most useful for detecting a memory leak in a containerized application?

NET I/O
BLOCK I/O
MEM USAGE / LIMIT trending upward over time (Correct answer)
CPU %

Correct answer: MEM USAGE / LIMIT trending upward over time

A steadily increasing MEM USAGE value that approaches the LIMIT over time is the classic signature of a memory leak in a container.

Question 40: During execution planning, a team needs containers to communicate using service names as hostnames within a Docker Compose application. What enables this?

Service name DNS only works when --network=host is specified
Containers must use --add-host flags to register each other's names
Docker Compose automatically creates a network where service names resolve as DNS hostnames (Correct answer)
An external DNS server must be configured and referenced in each service

Correct answer: Docker Compose automatically creates a network where service names resolve as DNS hostnames

Docker Compose creates a default bridge network with embedded DNS so each service name resolves to the correct container IP.

Question 41: An organization's risk policy requires that no container run as UID 0. Which Dockerfile instruction enforces this at the image level?

ENTRYPOINT ["/bin/sh"]
USER nonroot (Correct answer)
VOLUME /data
EXPOSE 8080

Correct answer: USER nonroot

The `USER` instruction sets the default user for subsequent RUN, CMD, and ENTRYPOINT instructions, preventing the container from running as root.

Question 42: Which Docker Swarm feature automatically replaces a failed service task on a healthy node?

Task rescheduling via the reconciliation loop (Correct answer)
Service constraints
Node drain followed by manual restart
Manual 'docker service scale' intervention

Correct answer: Task rescheduling via the reconciliation loop

Swarm's manager continuously reconciles desired vs actual state and schedules new tasks to replace failed ones on healthy nodes automatically.

Question 43: How do you scale a replicated service named 'web' to 5 replicas in Docker Swarm?

docker swarm scale --service web --replicas 5
docker service scale web 5
docker service scale web=5 (Correct answer)
docker service update --replicas 5 web

Correct answer: docker service scale web=5

`docker service scale web=5` is the correct syntax, using `name=count` format to set the desired replica count.

Question 44: Which command connects a running container to an additional network?

docker container network add my-network my-container
docker network join my-network my-container
docker attach network my-network my-container
docker network connect my-network my-container (Correct answer)

Correct answer: docker network connect my-network my-container

The `docker network connect` command attaches a running container to an existing network.

Question 45: A Docker image includes a library licensed under LGPL. What obligation does this create for a company distributing a proprietary application using that image?

The entire application must be open-sourced under LGPL
The company must purchase a commercial license from the library maintainer
The LGPL library source code must be made available, but the proprietary application code can remain closed (Correct answer)
No obligations exist because the library is inside a container

Correct answer: The LGPL library source code must be made available, but the proprietary application code can remain closed

LGPL allows linking proprietary software with LGPL libraries as long as the LGPL library source (or object files enabling relinking) is made available.

Question 46: Which port publishing flag maps host port 8080 to container port 80?

--port 8080-80
-p 80:8080
-p 8080:80 (Correct answer)
-P 8080:80

Correct answer: -p 8080:80

The `-p 8080:80` flag maps host port 8080 to container port 80 using the host:container format.

Question 47: What does the `--network host` flag do when running a container?

Creates a new isolated network
Connects the container to a bridge network
Disables all networking
Shares the host's network namespace with the container (Correct answer)

Correct answer: Shares the host's network namespace with the container

The `--network host` flag removes network isolation between the container and the Docker host.

Question 48: An architect wants to communicate the difference between published ports and exposed ports to developers. Which statement is accurate?

-p only works between containers, not to the host
EXPOSE documents intent but does not publish; -p actually maps the port to the host (Correct answer)
EXPOSE and -p are functionally identical
EXPOSE automatically publishes the port externally

Correct answer: EXPOSE documents intent but does not publish; -p actually maps the port to the host

EXPOSE is metadata documenting which ports the container listens on, while -p actually binds the port to the host network interface.

Question 49: When the `json-file` log driver is configured with `max-size=10m` and `max-file=3`, what happens when logs exceed 10MB?

Logging stops until the file is cleared
Logs are compressed in place
The container is paused
The log file rotates and old files are deleted when count exceeds 3 (Correct answer)

Correct answer: The log file rotates and old files are deleted when count exceeds 3

Docker rotates the log file at `max-size` and keeps only `max-file` rotated files, deleting the oldest.

Question 50: With Docker Content Trust, you can use _________ to confirm the publisher and integrity of any data you receive from a registry over any channel.

a container
digital signatures (Correct answer)
end to end encryption
symmetric key encryption

Correct answer: digital signatures

The use of digital signatures is appropriate since they may be used to confirm the reliability of both publishers and material utilizing the public private key encryption architecture.

Question 51: You want `docker logs` to follow output in real time, similar to `tail -f`. Which flag do you use?

--stream
--watch
--live
--follow (Correct answer)

Correct answer: --follow

`docker logs --follow` (or `-f`) continuously streams new log output as the container produces it.

Question 52: A company's Docker Compose file for a payment application contains hardcoded database credentials. Which regulatory framework is most directly violated?

COPPA (Children's Online Privacy Protection Act)
ADA (Americans with Disabilities Act)
DMCA (Digital Millennium Copyright Act)
PCI DSS Requirement 8 (Identify and Authenticate Access to System Components) (Correct answer)

Correct answer: PCI DSS Requirement 8 (Identify and Authenticate Access to System Components)

PCI DSS Req 8 prohibits use of shared or default credentials and requires unique IDs; hardcoded credentials in compose files violate these authentication requirements.

Question 53: What is a corrective action plan in DCA compliance?

A plan to correct individual employee behavior problems
A documented strategy to address compliance deficiencies and prevent their recurrence (Correct answer)
A marketing strategy to increase organizational sales
A plan for renovating office facilities and spaces

Correct answer: A documented strategy to address compliance deficiencies and prevent their recurrence

A corrective action plan outlines specific steps including root cause analysis, remediation activities, responsible parties, timelines, and measures to prevent recurrence.

Question 54: What is the default network driver created when Docker is installed on a Linux host?

macvlan
overlay
bridge (Correct answer)
host

Correct answer: bridge

Docker creates a default `bridge` network (docker0) on installation, used by containers unless another network is specified.

Question 55: When running containers in a multi-tenant Docker environment, which security standard is most critical for ethical isolation?

Running all containers as root for maximum compatibility
Sharing the same Docker network for all tenants to simplify management
Mounting the host filesystem into tenant containers for performance
Enforcing namespace isolation, network segmentation, and resource quotas per tenant (Correct answer)

Correct answer: Enforcing namespace isolation, network segmentation, and resource quotas per tenant

Multi-tenant environments require strict namespace isolation, network segmentation, and resource quotas to prevent one tenant from affecting another.

Docker Certified Associate (DCA)

The Docker Certified Associate exam validates skills in containerization using Docker, covering orchestration, image management, networking, security, installation, and storage. It is administered by Mirantis and targets intermediate-level Docker practitioners.

Questions

90 min

Time Limit

65%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds