Docker Certified Associate (DCA) — Questions and Answers

Question 1: What does running a container with the `--privileged` flag do?

Makes the container filesystem read-only
Grants the container almost all Linux capabilities and access to host devices (Correct answer)
Runs the container process as root on the host filesystem
Enables Docker Content Trust for that container

Correct answer: Grants the container almost all Linux capabilities and access to host devices

The `--privileged` flag grants the container nearly all the same access to the host as native processes running outside containers.

Question 2: A team uses 'docker diff' on a running container. What does this command reveal that supports quality assurance?

Differences between the container image and the latest registry version
The network configuration delta from the base image
Files added, changed, or deleted inside the container's writable layer at runtime (Correct answer)
Differences between two image tags

Correct answer: Files added, changed, or deleted inside the container's writable layer at runtime

'docker diff' lists filesystem changes (A=added, C=changed, D=deleted) in the container's writable layer compared to the image, helping identify unexpected runtime mutations.

Question 3: What does the `--format` flag in `docker stats` allow you to do?

Output stats as JSON automatically
Customize the output columns using Go templates (Correct answer)
Filter containers by resource threshold
Set the refresh interval

Correct answer: Customize the output columns using Go templates

`--format` accepts Go template strings to select and arrange which stats fields are displayed.

Question 4: What is the primary purpose of a code of ethics in DCA practice?

To establish professional standards of conduct and guide ethical decision-making (Correct answer)
To define office hours and schedules
To determine salary structures
To set pricing for services

Correct answer: To establish professional standards of conduct and guide ethical decision-making

A code of ethics provides a framework of professional values and behavioral standards that guides practitioners in ethical decisions while maintaining public trust.

Question 5: What does enabling Docker's 'live-restore' daemon option improve from a quality/availability standpoint?

It allows containers to continue running even when the Docker daemon is stopped or restarted (Correct answer)
It enables rolling restarts of containers during daemon upgrades only
It keeps image layers in RAM for faster pull times
It automatically restores containers from a registry backup on crash

Correct answer: It allows containers to continue running even when the Docker daemon is stopped or restarted

'live-restore' keeps containers running when the daemon goes down for maintenance or upgrades, reducing unplanned downtime during daemon updates.

Question 6: What is scope creep in DCA project management?

The process of reducing project deliverables
Uncontrolled expansion of project scope without corresponding adjustments to time, cost, and resources (Correct answer)
A technique for incrementally adding features
The natural growth of a project within planned parameters

Correct answer: Uncontrolled expansion of project scope without corresponding adjustments to time, cost, and resources

Scope creep occurs when new requirements or features are added without formal evaluation and approval, leading to schedule delays, budget overruns, and resource strain.

Question 7: What is the recommended best practice for handling sensitive configuration data in Docker containers?

Embed them directly in the container image layers during build
Pass them with the -e flag at container runtime
Store them in a Dockerfile ENV instruction
Use Docker secrets or an external secrets manager (Correct answer)

Correct answer: Use Docker secrets or an external secrets manager

Docker secrets or external secrets managers are recommended because they avoid exposing sensitive data in image layers, environment variables, process listings, or `docker inspect` output.

Question 8: In Docker Swarm, which network is automatically created to handle load balancing for published service ports?

A macvlan network
A default bridge network
An ingress overlay network (Correct answer)
A host network

Correct answer: An ingress overlay network

Docker Swarm automatically creates an ingress overlay network to implement the routing mesh for published ports.

Question 9: A project calls for containers to share the same network namespace so they can communicate over localhost. Which Docker run option achieves this?

docker run --network=container:<name_or_id> (Correct answer)
docker run --ipc=container:<name_or_id>
docker run --network=shared --name=sidecar
docker run --pid=container:<name_or_id>

Correct answer: docker run --network=container:<name_or_id>

The --network=container: option joins a new container to an existing container's network namespace, sharing the same network interfaces.

Question 10: Which command shows detailed information about a Docker network including its connected containers?

docker network inspect my-network (Correct answer)
docker network detail my-network
docker network status my-network
docker network show my-network

Correct answer: docker network inspect my-network

The `docker network inspect` command displays detailed JSON-formatted information about a network, including configuration and connected containers.

Question 11: A project requires containers to be automatically restarted if they crash, but not if stopped manually. Which restart policy should be configured?

--restart=always
--restart=on-failure
--restart=unless-stopped (Correct answer)
--restart=no

Correct answer: --restart=unless-stopped

The 'unless-stopped' policy restarts crashed containers automatically but respects an explicit manual stop, unlike 'always'.

Question 12: What does the '--iidfile' flag in 'docker build' help with in a CI/CD quality pipeline?

It tags the image with the commit hash automatically
It writes the Dockerfile instructions to a file for auditing
It saves the image ID to a file so downstream pipeline steps can reference the exact built image (Correct answer)
It generates an SBOM and writes it to the specified file

Correct answer: It saves the image ID to a file so downstream pipeline steps can reference the exact built image

'--iidfile' writes the resulting image ID to a file, allowing subsequent CI steps to reference the precise image digest rather than a mutable tag.

Question 13: What is the default network driver used when you create a container without specifying a network?

none
host
overlay
bridge (Correct answer)

Correct answer: bridge

Docker uses the bridge network driver by default when no network is specified at container creation.

Question 14: What is a compliance audit in DCA practice?

A routine customer satisfaction survey
A systematic review verifying adherence to regulatory requirements and policies (Correct answer)
A financial profit and loss assessment
An annual employee performance evaluation

Correct answer: A systematic review verifying adherence to regulatory requirements and policies

A compliance audit systematically examines adherence to external regulations, internal policies, and industry standards, identifying gaps and recommending corrective actions.

Question 15: In Docker Swarm, what is a 'task'?

A configuration file defining service parameters
A running container instance that is part of a service (Correct answer)
A health check performed on service containers
A scheduled cron job running periodically in the cluster

Correct answer: A running container instance that is part of a service

A task is the atomic scheduling unit in Swarm — it represents a single running container that belongs to a service.

Question 16: How are Docker secrets passed to a container in Swarm mode?

Embedded in the container image layer
As files mounted under /run/secrets/ inside the container (Correct answer)
Via the docker run -e flag at service creation
As environment variables visible in docker inspect

Correct answer: As files mounted under /run/secrets/ inside the container

Docker secrets are mounted as in-memory tmpfs files at /run/secrets/<secret_name> inside the container, never exposed in environment variables or image layers.

Question 17: What is the function of 'docker service rollback' compared to 'docker service update --rollback'?

Only 'docker service update --rollback' can revert image changes
They are identical commands with different syntax
'docker service rollback' reverts to the previous service spec; '--rollback' is used to configure rollback parameters (Correct answer)
'docker service rollback' deletes the service and redeploys from a snapshot

Correct answer: 'docker service rollback' reverts to the previous service spec; '--rollback' is used to configure rollback parameters

'docker service rollback' is a dedicated command that immediately reverts the service to its previous configuration, while '--rollback' in update sets rollback policy parameters.

Question 18: Which Linux kernel feature does Docker primarily use to isolate container processes from the host system?

namespaces (Correct answer)
seccomp
capabilities
cgroups

Correct answer: namespaces

Linux namespaces provide isolation for PIDs, network interfaces, mount points, users, and other system resources between containers and the host.

Question 19: What does residual risk mean in DCA risk management?

Risk that only affects residual materials or waste
The remaining risk after all control measures have been implemented (Correct answer)
The risk of a project going over budget
The initial risk before any assessment is performed

Correct answer: The remaining risk after all control measures have been implemented

Residual risk is the level of risk that remains after all practical control measures have been applied. Some residual risk is usually accepted as it may not be feasible to eliminate all risk entirely.

Question 20: Which Docker command runs a container's built-in health check immediately and returns the result without waiting for the interval?

docker exec <container> healthcheck
docker inspect --health
docker run --health-cmd with --health-interval=0
There is no way to trigger a health check on demand (Correct answer)

Correct answer: There is no way to trigger a health check on demand

Docker does not provide a direct command to trigger a HEALTHCHECK on demand; you must exec into the container and run the check command manually.

Question 21: Why is documentation critical in DCA regulatory compliance?

It is only needed for annual tax filing purposes
It creates unnecessary paperwork with no practical value
It provides evidence of compliance and creates a defensible record of activities (Correct answer)
It is optional for experienced professionals in the field

Correct answer: It provides evidence of compliance and creates a defensible record of activities

Documentation provides verifiable evidence that regulatory requirements have been met, supports audit processes, and creates a defensible record if compliance is ever questioned.

Question 22: What lvm mode should a host in production use when using the devicemapper as a storage driver?

loop-lvm
direct-lvm (Correct answer)
overlay
zfs

Correct answer: direct-lvm

It is intended for usage in production to employ direct-lvm mode.

Question 23: What is a milestone in DCA project management?

A significant event or deliverable marking progress at a key point in the project timeline (Correct answer)
A physical marker at a construction site every mile
A daily task that must be completed by each team member
An optional checkpoint that can be skipped if needed

Correct answer: A significant event or deliverable marking progress at a key point in the project timeline

Milestones are significant checkpoints or achievements in a project timeline that mark the completion of major deliverables, phase transitions, or critical decision points.

Question 24: Why is regular review important in DCA risk management?

Risk assessments remain valid indefinitely once completed
Reviews are only needed after incidents occur
Regulations prohibit reviewing risks more than annually
Because conditions change and new risks emerge requiring updated assessments (Correct answer)

Correct answer: Because conditions change and new risks emerge requiring updated assessments

Regular reviews ensure risk assessments remain current as conditions change, new hazards emerge, operations evolve, and lessons from incidents or near-misses are incorporated into updated controls.

Question 25: What format is used to define a custom seccomp profile for a Docker container?

An INI-style configuration file
A JSON profile file (Correct answer)
A YAML configuration file
A Docker Compose extension file

Correct answer: A JSON profile file

Docker seccomp profiles are defined in JSON format, specifying the default action and the list of allowed or denied system calls.

Question 26: Which metric is NOT reported by `docker stats`?

Network I/O
Number of open file descriptors (Correct answer)
CPU percentage
Memory usage and limit

Correct answer: Number of open file descriptors

`docker stats` reports CPU %, memory, network I/O, and block I/O but does not show open file descriptor counts.

Question 27: Which log driver sends container logs directly to a syslog server?

syslog (Correct answer)
fluentd
gelf
json-file

Correct answer: syslog

The `syslog` log driver forwards container log messages to a syslog-compatible server.

Question 28: A team wants to prevent 'latest' tags from being deployed to production Swarm services. Which approach enforces this policy?

Use Docker Content Trust and only sign versioned tags
Configure Swarm with --no-latest flag
Set DOCKER_TAG=latest in the daemon config
Use image pinning in stack files with explicit digest references (Correct answer)

Correct answer: Use image pinning in stack files with explicit digest references

Referencing images by digest in stack compose files ensures exactly the tested image is deployed, preventing accidental 'latest' mutations.

Question 29: What is the purpose of DNS resolution in user-defined Docker networks?

To assign IP addresses to containers
To allow containers to communicate using container names as hostnames (Correct answer)
To expose container ports to the host
To route traffic between Docker hosts

Correct answer: To allow containers to communicate using container names as hostnames

User-defined networks include an embedded DNS server that allows containers to resolve each other by container name.

Question 30: What is the Docker container's default container format?

LXD
Application Container Image (ACI)
libcontainer (Correct answer)
None of the above

Correct answer: libcontainer

Libcontainer is a library developed by the Docker project (now part of the Open Container Initiative) that provides a native interface to manage containerization features in various operating systems. It is responsible for creating and managing containers, isolating their resources, and setting up namespaces, control groups, and other operating system-level constructs to provide secure and isolated environments for running applications. Libcontainer acts as an abstraction layer between Docker and the underlying operating system, allowing Docker to work with different containerization technologies depending on the host system. It supports multiple container runtimes such as Docker's own runtime, runc, as well as other container runtimes compliant with the Open Container Initiative (OCI) runtime specifications.

Question 31: Which network driver assigns a MAC address and connects containers directly to the physical network?

macvlan (Correct answer)
host
bridge
overlay

Correct answer: macvlan

The macvlan network driver assigns a unique MAC address to each container, making it appear as a physical device on the network.

Question 32: You need to time-limit `docker events` to only show events that occurred in a specific window. Which flags accomplish this?

--from and --to
--since and --until (Correct answer)
--begin and --finish
--start and --end

Correct answer: --since and --until

`docker events --since` and `--until` bound the time range of events returned.

Question 33: What command creates a user-defined bridge network named 'my-network'?

docker network add my-network
docker create network my-network
docker network create --driver bridge my-network (Correct answer)
docker network init my-network

Correct answer: docker network create --driver bridge my-network

The `docker network create --driver bridge my-network` command creates a user-defined bridge network.

Question 34: How can a running container on a Linux host be interpreted?

a file
an application
a program
a process (Correct answer)

Correct answer: a process

On a Linux host, a running container can be interpreted as a collection of isolated processes with their own filesystem, network stack, and resource constraints. Containers on Linux are implemented using kernel features such as namespaces and cgroups, which provide process and resource isolation.

Question 35: A Dockerfile HEALTHCHECK reports 'unhealthy' but the container keeps running. What is the default Docker behavior in this situation?

Docker automatically restarts the container
Docker pauses the container until it becomes healthy
The container continues running; orchestrators like Swarm may reschedule it (Correct answer)
Docker stops and removes the container

Correct answer: The container continues running; orchestrators like Swarm may reschedule it

Docker itself does not stop an unhealthy standalone container; it is up to orchestrators (Swarm, Kubernetes) to act on the unhealthy status.

Question 36: What is change management in DCA technology operations?

A structured process for evaluating, approving, and implementing changes to minimize risk (Correct answer)
A method for changing employee passwords monthly
A process for replacing all legacy systems at once
Making any changes immediately without review or documentation

Correct answer: A structured process for evaluating, approving, and implementing changes to minimize risk

IT change management ensures that all changes to systems and infrastructure are evaluated for risk, properly approved, tested, documented, and implemented in a controlled manner to minimize service disruption.

Question 37: A container's health check is reporting `unhealthy`. Which command gives you the detailed health check output history?

docker events --filter health
docker logs --health <container>
docker stats <container>
docker inspect <container> (Correct answer)

Correct answer: docker inspect <container>

`docker inspect` includes a `Health` field with the last five health check results and their output.

Question 38: Which `docker run` option configures a container to use a specific DNS server?

--nameserver
--dns (Correct answer)
--resolve
--dns-server

Correct answer: --dns

The `--dns` flag in `docker run` specifies a custom DNS server IP address for the container.

Question 39: What does the `--cap-drop ALL` flag do when running a container?

Removes the container from all networks
Drops all Linux capabilities from the container process (Correct answer)
Prevents the container from forking child processes
Disables all bind-mounted volumes

Correct answer: Drops all Linux capabilities from the container process

The `--cap-drop ALL` flag removes all Linux capabilities from the container, which can then be selectively restored with `--cap-add`.

Question 40: When planning the execution environment, a developer wants to override the default command of a Docker image at runtime without modifying the Dockerfile. Which approach is correct?

docker run --entrypoint-override myimage /bin/bash
docker run --cmd '/bin/bash' myimage
docker run --override CMD myimage /bin/bash
docker run myimage <new_command> appends to ENTRYPOINT and replaces CMD (Correct answer)

Correct answer: docker run myimage <new_command> appends to ENTRYPOINT and replaces CMD

Arguments passed after the image name in 'docker run' replace the default CMD; use --entrypoint to override ENTRYPOINT instead.

Question 41: Which of the aforementioned commands should be used to establish a MySQL 5.4 database container?

docker create --name database --image mysql:5.4
docker run --name database mysql:5.4
docker run --name database --image mysql:5.4
docker create --name database mysql:5.4 (Correct answer)

Correct answer: docker create --name database mysql:5.4

The docker create --name database mysql:5.4 command creates a Docker container with the name "database" based on the mysql:5.4

Question 42: What is the purpose of Docker Content Trust (DCT)?

To control user access to Docker registries
To scan images for OS vulnerabilities
To sign and verify the authenticity and integrity of Docker images (Correct answer)
To encrypt container-to-container traffic

Correct answer: To sign and verify the authenticity and integrity of Docker images

Docker Content Trust uses digital signatures via The Update Framework (TUF) to verify the integrity and publisher of Docker images.

Question 43: What is trend analysis in DCA reporting?

Examining data over time to identify patterns, directions, and changes in performance (Correct answer)
Predicting the exact future with complete certainty
Comparing a single data point to a historical average
Analyzing current fashion trends in the industry

Correct answer: Examining data over time to identify patterns, directions, and changes in performance

Trend analysis examines historical data across multiple time periods to identify patterns, direction of change, and rate of change, helping predict future performance and inform strategic decisions.

Question 44: You want `docker logs` to follow output in real time, similar to `tail -f`. Which flag do you use?

--stream
--watch
--follow (Correct answer)
--live

Correct answer: --follow

`docker logs --follow` (or `-f`) continuously streams new log output as the container produces it.

Question 45: What does the `--network host` flag do when running a container?

Disables all networking
Creates a new isolated network
Shares the host's network namespace with the container (Correct answer)
Connects the container to a bridge network

Correct answer: Shares the host's network namespace with the container

The `--network host` flag removes network isolation between the container and the Docker host.

Question 46: A QA engineer wants to verify that a Docker image's layers are reproducible given the same Dockerfile and context. Which build feature helps achieve reproducible builds?

BuildKit's build caching with fixed base image digests pinned in FROM (Correct answer)
docker build --compress
BuildKit's --secret flag
docker build --squash

Correct answer: BuildKit's build caching with fixed base image digests pinned in FROM

Pinning the base image by digest (e.g., FROM ubuntu@sha256:...) ensures the exact same base is used every time, making builds reproducible across environments.

Question 47: What does return on investment (ROI) measure in DCA financial analysis?

The number of employees in the organization
The total revenue of an organization
The gain or loss generated relative to the amount of money invested (Correct answer)
The physical return of purchased goods

Correct answer: The gain or loss generated relative to the amount of money invested

ROI measures the efficiency of an investment by comparing the net gain or loss to the initial investment cost, expressed as a percentage. It helps compare the profitability of different investment options.

Question 48: Which process's output will the docker attach command make available on the terminal as standard output?

FROM
EXPOSE
RUN
ENTRYPOINT/CMD (Correct answer)

Correct answer: ENTRYPOINT/CMD

The output of a process executed via the ENTRYPOINT or CMD instructions in a Docker container will be available on the terminal as standard output when using the docker attach command. When you attach to a running container using docker attach, it connects your terminal to the container's standard input, output, and error streams (stdin, stdout, stderr). This allows you to interact with the container and see the output produced by processes running inside. If the Dockerfile specifies an ENTRYPOINT or CMD instruction that launches a process, the output generated by that process will be sent to the container's stdout. When you use docker attach to connect to the container, you will see the process's output displayed on your terminal.

Question 49: What security benefit does enabling user namespace remapping in Docker provide?

Creates an isolated user database for each container
Maps the container's root user (UID 0) to an unprivileged UID on the host (Correct answer)
Enables SSH key-based access to running containers
Allows multiple host users to share a single running container

Correct answer: Maps the container's root user (UID 0) to an unprivileged UID on the host

User namespace remapping maps the container's root UID to a non-privileged host UID, significantly reducing the risk if a process escapes the container.

Question 50: If the docker engine does not serve as a manager node for the docker swarm, how may overlay networks be created?

False
True (Correct answer)

Correct answer: True

In the event that the docker engine is a component of a swarm, overlay networks may exist. Therefore, being a manager node in a swarm is a requirement for creating an overlay network. The following problem occurs when we attempt to create overlay networks from a non-manager node: ubuntu@ip-10-0-1-11:~$ docker network create -d overlay test-network Daemon error message: Unable to build a multi-host network from a worker node. Please build the network starting with a manager node.

Question 51: What format does `docker inspect` use to output container metadata by default?

YAML
XML
TOML
JSON (Correct answer)

Correct answer: JSON

`docker inspect` outputs container metadata as a JSON array by default.

Question 52: Which practice best reduces the attack surface of a production Docker image for a compiled Go application?

Use the official golang:latest image as the final stage
Add all debugging tools for incident response
Use a multi-stage build and copy only the binary into a 'FROM scratch' final image (Correct answer)
Use Alpine Linux with all packages installed

Correct answer: Use a multi-stage build and copy only the binary into a 'FROM scratch' final image

A 'FROM scratch' final stage containing only the statically compiled binary eliminates all OS packages, reducing CVE exposure to nearly zero.

Question 53: Which command shows real-time resource usage statistics for all running containers?

docker inspect --live
docker monitor
docker stats (Correct answer)
docker ps --stats

Correct answer: docker stats

`docker stats` streams live CPU, memory, network I/O, and block I/O metrics for running containers.

Question 54: What is stakeholder mapping in DCA practice?

Tracking competitor locations on a city map
Mapping customer demographic data by region
Identifying all parties with an interest in a project and assessing their influence and expectations (Correct answer)
Creating a geographical map of office locations

Correct answer: Identifying all parties with an interest in a project and assessing their influence and expectations

Stakeholder mapping identifies everyone affected by or interested in a project, then categorizes them by influence level, interest, and expectations to develop targeted communication and engagement strategies.

Question 55: What are potential consequences of non-compliance in DCA practice?

A simple verbal warning with no follow-up
Automatic contract renewal regardless of violations
No consequences if the violation is not discovered
Fines, license revocation, legal liability, and reputational damage (Correct answer)

Correct answer: Fines, license revocation, legal liability, and reputational damage

Non-compliance can result in monetary fines, suspension or revocation of professional licenses, civil or criminal liability, and lasting damage to professional reputation.

Docker Certified Associate (DCA)

The Docker Certified Associate exam validates skills in containerization using Docker, covering orchestration, image management, networking, security, installation, and storage. It is administered by Mirantis and targets intermediate-level Docker practitioners.

Questions

35 min

Time Limit

65%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

training.mirantis.com — Test delivery, eligibility, fees, passing score, renewal, retake policy, score release, time limit, score validity · verified Oct 2026