Docker Certified Associate (DCA) — Questions and Answers

Question 1: Which `docker events` filter would show only container die events?

--filter type=container --filter event=die (Correct answer)
--filter status=die
--filter action=die
--filter event=die

Correct answer: --filter type=container --filter event=die

Combining `--filter type=container` and `--filter event=die` precisely targets container die events.

Question 2: A --memory-reservation flag is set lower than --memory for a container. What does this mean operationally?

The container will be OOM-killed at the reservation threshold
The container will never use more than the reservation amount
The reservation is a soft limit Docker uses when the host is under memory pressure (Correct answer)
Reservation and hard limit must always be equal

Correct answer: The reservation is a soft limit Docker uses when the host is under memory pressure

Memory reservation is a soft guarantee; Docker tries to reclaim memory from the container down to this level when the host needs it.

Question 3: Which network driver assigns a MAC address and connects containers directly to the physical network?

macvlan (Correct answer)
bridge
overlay
host

Correct answer: macvlan

The macvlan network driver assigns a unique MAC address to each container, making it appear as a physical device on the network.

Question 4: Which of the following commands can automatically add the extracted content into the image and accept a tar file as an argument?

None of the above
ADD and COPY
ADD (Correct answer)
COPY

Correct answer: ADD

The functions of the Dockerfile commands COPY and ADD are comparable. They enable you to add files to a Docker image from a specific place. <br> COPY requires a source and a destination. Only local files or directories from your host—the computer creating the Docker image—can be copied into the actual Docker image. <br> You can accomplish that with ADD as well, but it also supports two additional sources. First, rather than using a local file or directory, you can use a URL. The second option is to directly extract a tar file from the source into the destination.

Question 5: What is a dashboard in DCA data reporting?

A physical control panel in an office
A visual display of key metrics and data points for at-a-glance monitoring of performance (Correct answer)
A tool used only by IT departments
A written report submitted monthly to management

Correct answer: A visual display of key metrics and data points for at-a-glance monitoring of performance

A dashboard provides a consolidated visual display of important metrics, KPIs, and data trends, enabling stakeholders to quickly assess performance status and identify areas needing attention.

Question 6: What does 'routing mesh' mean in Docker Swarm networking?

Any Swarm node can accept requests on a published port and route them to a service container (Correct answer)
A method for assigning static IPs to Swarm services
A DNS round-robin load balancing technique
A process for encrypting overlay network traffic

Correct answer: Any Swarm node can accept requests on a published port and route them to a service container

Swarm's routing mesh allows any node to accept incoming connections on a published port and route them to a service task on any node.

Question 7: A stakeholder requests that external clients communicate with a containerized web service on port 443. Which Docker flag publishes this port correctly?

-p 443:443 (Correct answer)
-e PORT=443
--port-map 443
--expose 443

Correct answer: -p 443:443

The `-p host_port:container_port` flag publishes a container port to the host, making it accessible externally.

Question 8: An organization's compliance requirement mandates that all Docker container activity be auditable. Which daemon-level configuration enables system-call-level audit logging for containers?

Enabling Linux Audit (`auditd`) rules on `/usr/bin/docker` and the Docker socket (Correct answer)
Setting `log-driver: json-file` in `/etc/docker/daemon.json`
Configuring `--log-opt max-size` for each container
Using `docker events` to stream real-time daemon events to a file

Correct answer: Enabling Linux Audit (`auditd`) rules on `/usr/bin/docker` and the Docker socket

Adding auditd rules for the Docker binary, daemon socket, and relevant directories captures privileged operations at the kernel audit subsystem level for compliance.

Question 9: Why is documentation critical in DCA regulatory compliance?

It is optional for experienced professionals in the field
It is only needed for annual tax filing purposes
It provides evidence of compliance and creates a defensible record of activities (Correct answer)
It creates unnecessary paperwork with no practical value

Correct answer: It provides evidence of compliance and creates a defensible record of activities

Documentation provides verifiable evidence that regulatory requirements have been met, supports audit processes, and creates a defensible record if compliance is ever questioned.

Question 10: An operations team needs to communicate volume usage to a storage stakeholder. Which command lists all Docker volumes on a host?

docker info --volumes
docker inspect volumes
docker ps --volumes
docker volume ls (Correct answer)

Correct answer: docker volume ls

`docker volume ls` lists all volumes managed by Docker on the local host.

Question 11: A developer accidentally pushed a Docker image containing a hardcoded database password to a public registry. What is the CORRECT remediation approach?

Immediately rotate the compromised credential, remove all affected image versions, and audit access logs (Correct answer)
Add a `.dockerignore` file and rebuild the image without pushing
Change the image tag from `latest` to a random string to obscure the image
Delete only the specific layer containing the secret, then re-push the image

Correct answer: Immediately rotate the compromised credential, remove all affected image versions, and audit access logs

Rotating the credential limits blast radius immediately; removing all image versions prevents further exposure since image layers are immutable and may be cached.

Question 12: Which `docker system` subcommand displays disk usage broken down by images, containers, and volumes?

docker system info
docker system inspect
docker system usage
docker system df (Correct answer)

Correct answer: docker system df

`docker system df` reports disk usage for images, containers, local volumes, and build cache.

Question 13: Which practice ensures Docker image build reproducibility, which is required for software supply chain compliance frameworks like SLSA?

Pinning base images to immutable digests (SHA256) in Dockerfiles (Correct answer)
Rebuilding images without version constraints to get latest security patches automatically
Storing Dockerfiles in developer workstations rather than version control
Using mutable tags like 'latest' for all base images

Correct answer: Pinning base images to immutable digests (SHA256) in Dockerfiles

Pinning to SHA256 digests ensures the exact same base image is used in every build, enabling reproducibility as required by SLSA provenance requirements.

Question 14: In a Dockerfile, which instruction sets environment variables that persist into the running container?

ARG
RUN
ENV (Correct answer)
LABEL

Correct answer: ENV

`ENV` sets environment variables that are available both during the build and at container runtime.

Question 15: A project manager wants to enforce that all production services use only images from a trusted registry. Which Docker feature supports this at the Swarm level?

Firewalling all other registries at the host level is the only option
Docker Content Trust (DCT) enforces signed image verification before deployment (Correct answer)
Docker Swarm's --image-verify flag blocks unsigned images
Docker registry mirrors redirect all pull requests to the trusted registry

Correct answer: Docker Content Trust (DCT) enforces signed image verification before deployment

Docker Content Trust uses Notary to verify image signatures, preventing unsigned or tampered images from running.

Question 16: What is active listening in DCA professional communication?

Taking notes without making any eye contact
Waiting for your turn to speak without processing content
Hearing words while multitasking on other activities
Fully concentrating on the speaker, understanding their message, and providing thoughtful feedback (Correct answer)

Correct answer: Fully concentrating on the speaker, understanding their message, and providing thoughtful feedback

Active listening involves fully focusing on the speaker, processing their message, asking clarifying questions, and providing thoughtful responses that demonstrate understanding and engagement.

Question 17: Which Docker runtime security tool specifically generates and enforces Seccomp profiles to limit syscalls available to containers, supporting compliance with least-privilege requirements?

docker/default Seccomp profile or custom profiles with --security-opt seccomp (Correct answer)
Docker Scout
Falco
Docker Bench for Security

Correct answer: docker/default Seccomp profile or custom profiles with --security-opt seccomp

Docker's default Seccomp profile blocks ~44 dangerous syscalls, and custom profiles via --security-opt seccomp enforce granular syscall restrictions for least-privilege compliance.

Question 18: Which command lists all nodes currently participating in a Docker Swarm?

docker cluster list
docker ps --swarm
docker node ls (Correct answer)
docker swarm nodes

Correct answer: docker node ls

`docker node ls` lists every node in the Swarm along with its role, status, and availability.

Question 19: What ethical obligation exists when a Docker professional transitions to a new employer and has knowledge of the former employer's container infrastructure?

They may replicate the former employer's architecture since it is general technical knowledge
They must maintain confidentiality of proprietary configurations, credentials, and internal architecture details (Correct answer)
They are free to use any container images they personally built for the former employer
They can share the former employer's Dockerfiles if they improve them

Correct answer: They must maintain confidentiality of proprietary configurations, credentials, and internal architecture details

Professional ethics and most employment agreements require maintaining confidentiality of proprietary technical information after departure.

Question 20: A QA engineer wants to verify that a Docker image's layers are reproducible given the same Dockerfile and context. Which build feature helps achieve reproducible builds?

BuildKit's --secret flag
BuildKit's build caching with fixed base image digests pinned in FROM (Correct answer)
docker build --compress
docker build --squash

Correct answer: BuildKit's build caching with fixed base image digests pinned in FROM

Pinning the base image by digest (e.g., FROM ubuntu@sha256:...) ensures the exact same base is used every time, making builds reproducible across environments.

Question 21: What is the purpose of a quality audit in DCA practice?

To determine employee salaries and bonuses
To market services to new clients
To systematically evaluate whether quality standards and procedures are being followed (Correct answer)
To calculate annual revenue projections

Correct answer: To systematically evaluate whether quality standards and procedures are being followed

Quality audits systematically examine whether established quality standards, procedures, and requirements are being implemented effectively, identifying non-conformances and improvement opportunities.

Question 22: Which of the commands can be used to view an IPv4 network's subnet?

docker network info
docker network is
docker network inspect (Correct answer)
docker info network

Correct answer: docker network inspect

"docker network inspect" is an authorized command to examine a certain network

Question 23: What happens to containers connected to the 'none' network driver?

They share the host network stack
They use a bridge connection
They have no network access (Correct answer)
They are connected to all available networks

Correct answer: They have no network access

The none network driver completely disables all networking for the container.

Question 24: Which command removes a Docker network?

docker remove network my-network
docker network rm my-network (Correct answer)
docker network destroy my-network
docker network delete my-network

Correct answer: docker network rm my-network

The `docker network rm` command removes one or more Docker networks by name or ID.

Question 25: Which command shows the history of layers in a Docker image, including the size of each layer?

docker image diff
docker inspect --layers
docker history (Correct answer)
docker image layers

Correct answer: docker history

`docker history <image>` lists each layer, the command that created it, and its uncompressed size.

Question 26: To export Prometheus-compatible metrics from the Docker daemon, which configuration option must be enabled?

"metrics": true in daemon.json
"experimental": true and "metrics-addr" (Correct answer)
"log-driver": "prometheus"
"telemetry": "prometheus"

Correct answer: "experimental": true and "metrics-addr"

Enabling experimental mode and setting `metrics-addr` in `daemon.json` exposes a Prometheus metrics endpoint.

Question 27: A company's Docker Compose file for a payment application contains hardcoded database credentials. Which regulatory framework is most directly violated?

ADA (Americans with Disabilities Act)
PCI DSS Requirement 8 (Identify and Authenticate Access to System Components) (Correct answer)
DMCA (Digital Millennium Copyright Act)
COPPA (Children's Online Privacy Protection Act)

Correct answer: PCI DSS Requirement 8 (Identify and Authenticate Access to System Components)

PCI DSS Req 8 prohibits use of shared or default credentials and requires unique IDs; hardcoded credentials in compose files violate these authentication requirements.

Question 28: Which command shows detailed information about a Docker network including its connected containers?

docker network detail my-network
docker network inspect my-network (Correct answer)
docker network show my-network
docker network status my-network

Correct answer: docker network inspect my-network

The `docker network inspect` command displays detailed JSON-formatted information about a network, including configuration and connected containers.

Question 29: Which log driver sends Docker container logs directly to a syslog endpoint?

json-file
syslog (Correct answer)
journald
gelf

Correct answer: syslog

The `syslog` log driver forwards container logs to a syslog server using RFC 5424 format over UDP, TCP, or TLS.

Question 30: Which port publishing flag maps host port 8080 to container port 80?

-P 8080:80
-p 8080:80 (Correct answer)
-p 80:8080
--port 8080-80

Correct answer: -p 8080:80

The `-p 8080:80` flag maps host port 8080 to container port 80 using the host:container format.

Question 31: A developer wants to enforce that no container in a Swarm service runs as root. Which mechanism enforces this at the orchestration level?

Dockerfile USER instruction
A Swarm config file with user constraints
Docker Swarm --user flag on service create (Correct answer)
AppArmor profile attached to the service

Correct answer: Docker Swarm --user flag on service create

The '--user' flag on 'docker service create' overrides the image default and ensures all tasks in the service run as the specified non-root user.

Question 32: Which command correctly creates a Docker secret named 'db_password' with the value 'mysecret'?

docker secret add db_password mysecret
echo 'mysecret' | docker secret create db_password - (Correct answer)
docker create secret --name db_password --value mysecret
docker secret set db_password mysecret

Correct answer: echo 'mysecret' | docker secret create db_password -

Docker secrets are created by piping the secret value to `docker secret create <name> -`, where the dash reads from stdin.

Docker Certified Associate (DCA)

The Docker Certified Associate exam validates skills in containerization using Docker, covering orchestration, image management, networking, security, installation, and storage. It is administered by Mirantis and targets intermediate-level Docker practitioners.

Questions

35 min

Time Limit

65%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds