DCA practice questions and answers

Correct answer: A — tmpfs mount

A tmpfs mount is backed by RAM, which suits short-lived sensitive data that must not persist. Bind mounts and both volume types write to the host filesystem.

Correct answer: A — Docker Content Trust

Content Trust uses Notary signatures so the client refuses unsigned or tampered images when enabled. Compose profiles select which services run, buildx bake orchestrates builds, and contexts switch which engine the CLI targets.

Correct answer: A — Use a scoped, short-lived token with push access only to the specific repository

A narrowly scoped, short-lived token means a leak affects one repository for a limited time. Administrator credentials, committed secrets, and shared credentials all maximise the damage of a single leak.

Correct answer: A — --constraint 'node.labels.region == eu'

Placement constraints match node attributes and labels to decide where tasks may run. A service label is metadata on the service, an environment variable is passed to the container, and a network attachment does not influence placement.

Correct answer: A — docker service scale web=6

docker service scale sets the desired replica count for a replicated service, and docker service update --replicas does the same. Container run creates a standalone container, node update changes node properties, and stack rm removes a stack.

Correct answer: A — docker image prune

image prune deletes dangling images, and with the all flag it removes any image not used by a container. The container, volume, and network prune commands clean up those object types instead.

Correct answer: A — overlay

Overlay networks span hosts using VXLAN so swarm services communicate across the cluster. bridge is single-host, host shares the node's network namespace, and none disables networking.

Correct answer: A — unless-stopped

unless-stopped restarts the container on daemon start except when the user stopped it deliberately. no never restarts, on-failure only restarts after a non-zero exit, and always-off is not a valid policy.

Correct answer: A, B — --update-parallelism · --update-delay

Parallelism sets how many tasks update at once and delay sets the pause between batches, which together define the rollout pace. Publish, mount, and label options change the service definition rather than the update strategy.

Correct answer: A — /etc/docker/daemon.json

daemon.json is the engine's configuration file for daemon-level settings. There is no config.yml at that path, the user-level config.json stores CLI settings such as registry credentials, and the containerd defaults file configures a different component.

Correct answer: A — Create the overlay network with the --opt encrypted flag

The encrypted option enables IPSec encryption of the VXLAN data plane between nodes, whereas control plane traffic is always encrypted. CLI TLS protects the client connection, the bridge driver is single-host, and host mode publishing changes ingress rather than encrypting east-west traffic.

Correct answer: A — --update-failure-action rollback on the service

Setting the failure action to rollback makes swarm return to the previous service definition when the configured failure ratio is exceeded. Removing and recreating loses the previous spec, demote changes a manager to a worker, and leave removes the node from the swarm.

Correct answer: A — -p 8080:80

The publish flag takes host port first and container port second. The reversed form publishes the wrong mapping, expose only documents a port without publishing it, and link is a deprecated container connection feature.

Correct answer: A — docker service ps web

docker service ps lists each task with its desired state, current state, node, and any error. service ls summarises services, node ls lists swarm nodes, and image ls lists images.

Correct answer: A, B — A digest identifies exact image content and does not change · A tag is a mutable pointer that can be moved to different content

Digests are content hashes and are stable, while tags are human-friendly labels that can be repointed. Tags therefore give no content guarantee, digests do not change on pull, and one image can carry many tags.

Correct answer: A — Registry image scanning integrated into the push workflow

Scanning at push time inventories image contents and matches them against vulnerability databases, so findings are known before anything is deployed. stats shows live resource usage, system df reports disk usage, and inspect prints object metadata.

Correct answer: A, B — They map a specific host path into the container, so the host directory structure matters · They are useful in development for live-reloading source code

Bind mounts attach an exact host path, which makes them convenient for local development but dependent on the host's layout. They are not engine-managed, they are not portable between differently laid out hosts, and volumes are the recommended production choice.

Correct answer: A — A multi-stage build that copies only the compiled artefact into a minimal final stage

Multi-stage builds discard everything from earlier stages except what is explicitly copied forward, so build tooling never reaches the shipped image. Cleaning package caches helps a little but leaves the tools installed, and VOLUME and HEALTHCHECK serve unrelated purposes.

Correct answer: A, B — Enable live restore so containers keep running during a daemon restart · Configure log rotation limits on the default logging driver

Live restore avoids workload downtime during engine upgrades and log rotation prevents disk exhaustion. An unencrypted TCP socket is remote root access, broad docker group membership is equivalent to root on the host, and removing resource limits invites noisy neighbours.

Correct answer: A — By the other container's name, because Docker provides DNS resolution on user-defined networks

User-defined bridge networks include an embedded DNS server so container names resolve automatically, unlike the legacy default bridge. Publishing ports is for external access, and host networking is not required for container-to-container traffic.

Correct answer: A — User namespace remapping configured with userns-remap in the daemon settings

User namespace remapping means UID 0 inside the container corresponds to an unprivileged UID on the host, so an escape lands with limited rights. Privileged mode removes protections, restart policies govern lifecycle, and host mode publishing concerns networking.

Correct answer: A — docker swarm join-token worker

join-token prints the full join command including the worker token. node inspect shows node details, service create deploys a service, and unlock-key relates to autolock rather than joining.

Correct answer: A — drain

Setting availability to drain evicts running tasks and blocks new scheduling, which is what you do before maintenance. Active is the normal state, pause blocks new tasks but leaves existing ones running, and ready is a node status rather than an availability setting.

Correct answer: A, B — --cap-drop ALL with selective --cap-add · --read-only with tmpfs mounts for writable paths

Dropping capabilities and running with a read-only root filesystem both narrow what a compromised process can do. Privileged mode, mounting the host root, and sharing the host PID namespace each give a container a direct path to the host.

Correct answer: A — ENTRYPOINT sets the executable that always runs, while CMD supplies default arguments that a docker run argument can override

ENTRYPOINT defines the fixed command and CMD provides overridable defaults, which is why they are often used together. They are not interchangeable, CMD does not take precedence over ENTRYPOINT, and ENTRYPOINT has no stage restriction.

Correct answer: A — The anonymous volume is removed along with the container

The -v flag removes anonymous volumes associated with the container, which is why named volumes are preferred for data you intend to keep. Volumes are not renamed, promoted to named volumes, or pushed anywhere.

Correct answer: A — ENV, EXPOSE, and LABEL create metadata rather than filesystem content

ENV, EXPOSE, and LABEL record configuration and documentation in the image manifest without adding files. RUN, COPY, and ADD all write content into the filesystem.

Correct answer: A — .dockerignore

.dockerignore excludes paths from the build context, which speeds builds and prevents secrets or artefacts being copied in. .gitignore affects version control, the Compose override file adjusts service definitions, and daemon.json configures the engine.

Correct answer: A — Docker config

Swarm configs mount non-sensitive files into service tasks and are versioned in the swarm's Raft store. Secrets are for sensitive material, volumes provide persistent storage, and networks connect containers.

Correct answer: A — json-file with max-size and max-file options, or a remote driver such as syslog

Log rotation options bound the on-disk size, and a remote driver moves logs off the node entirely. Unbounded json-file is the problem, and turning logging off removes the diagnostics you need during incidents.

Correct answer: A — docker tag myapp:1.0 registry.example.com/team/myapp:1.0

The registry host is part of the image reference, so tagging with the full name is what lets docker push target that registry. commit creates an image from a container, save writes an image archive, and export writes a container filesystem archive.

Correct answer: A — A volume driver plugin specified when creating the volume

Volume plugins let third-party or built-in drivers provide storage from external systems while presenting a normal volume to containers. The storage driver handles image and container layers, tmpfs is memory-backed, and .dockerignore filters the build context.

Correct answer: A — mode=host publishing

Host mode publishing binds the port directly on nodes that run a task and skips the ingress routing mesh. Ingress mode is the routing mesh, a bridge network is single-host, and global mode changes replica placement rather than publishing behaviour.

Correct answer: A — save writes an image with all its layers and metadata, while export writes a container's flattened filesystem without history

save archives an image including layers and tags so it can be loaded elsewhere, while export flattens a container's filesystem and loses layer history and metadata. Their subjects are not reversed, the archives differ, and export specifically drops history.

Correct answer: A, B — Managers also act as workers by default unless their availability is set to drain · An odd number of managers is recommended to maintain quorum

Managers are schedulable by default and an odd manager count gives the best fault tolerance for a given size. Managers can run tasks, adding managers increases Raft coordination overhead rather than throughput, and one manager is a single point of failure.

Correct answer: A — docker stack deploy -c docker-compose.yml myapp

docker stack deploy reads a Compose file and creates the corresponding swarm services, networks, and configs. docker compose up runs containers on a single engine, service create does not accept a Compose file, and join-token prints the token for adding nodes.

Correct answer: A, B — It is the recommended default storage driver on modern Linux kernels · It uses copy-on-write, so writing to a file in a lower layer copies it into the container layer

overlay2 is the default on current kernels and uses copy-on-write so modifications land in the writable container layer. Image layers stay read-only, no dedicated block device is required, and layer sharing between images is one of its benefits.

Correct answer: A — Shared or networked storage exposed through a volume driver available on all nodes

Local volumes do not follow a task to another node, so persistence across rescheduling requires storage reachable from every node through a suitable driver. Local volumes, per-node bind mounts, and tmpfs all leave the data behind or discard it.

Correct answer: A — docker network inspect <name>

network inspect returns the IPAM configuration and the list of attached containers with their addresses. ls only lists networks, port shows published mappings for one container, and stats shows resource usage.

Correct answer: A — docker info

docker info reports daemon configuration and runtime state, including storage driver and swarm membership. version prints client and server versions, inspect returns details of a specific object, and ps lists containers.

Correct answer: A — Enable TLS with mutual certificate authentication on the TCP endpoint

Mutual TLS ensures only clients holding a trusted certificate can reach the daemon, which is essential because socket access is root-equivalent. Unauthenticated TCP exposure, sharing the socket over a file share, and disabling authentication all hand out host root.

Correct answer: A — docker system df

system df breaks down reclaimable and active space per object type. stats shows live CPU and memory per container, info summarises engine configuration, and events streams daemon events.

Correct answer: A — COPY only copies local files, while ADD additionally handles remote URLs and automatic archive extraction

ADD has extra behaviours around URLs and tar extraction, which is why COPY is preferred when those behaviours are not wanted. Their roles are not reversed, they are not identical, and COPY works in any stage.

Correct answer: A — docker swarm init

docker swarm init creates the swarm and makes the local node its first manager. join adds a node to an existing swarm, promote changes an existing worker to a manager, and stack deploy deploys services once a swarm exists.

Correct answer: A — Because the user can start a privileged container that mounts the host filesystem

Access to the daemon socket means the user can run a container with the host root mounted and full privileges, which is root by another route. The group is not an alias for root, the daemon runs as root rather than as the caller, and members do not need sudo.

Correct answer: A, B — Copy dependency manifests and install dependencies before copying the rest of the source · Order instructions so the least frequently changing layers come first

The cache invalidates from the first changed layer onward, so putting stable steps early and installing dependencies before copying source keeps expensive layers reusable. Copying everything first invalidates the cache on any source change, and changing the base image each build defeats caching entirely.

Correct answer: A — macvlan

macvlan gives each container a MAC address on the physical network, which suits legacy applications expecting to be directly on the LAN. bridge and overlay use virtual networks with NAT or tunnelling, and none disables networking.

Correct answer: A — --cpus=1 --memory=512m

cpus sets a hard CPU quota and memory sets a hard memory limit. cpu-shares is a relative weight rather than a limit, ulimits are per-process limits with different semantics, and a reservation is a soft target while disabling OOM kill is dangerous.

Correct answer: A — Docker secrets, mounted into the task's in-memory filesystem

Swarm secrets are stored encrypted in the Raft log, sent over mutual TLS, and exposed to tasks in a memory-backed filesystem. Environment variables are visible in service inspection, bind mounts leave the secret on disk, and build arguments end up in image history.

Correct answer: A — A named volume

Named volumes are managed by the engine, live outside the container lifecycle, and are the recommended persistence mechanism. The writable layer is deleted with the container, tmpfs is memory-backed and ephemeral, and image layers are read-only.

Correct answer: A, B — The container shares the host's network namespace and its ports bind directly on the host · There is no network isolation between the container and the host

Host networking removes the separate namespace, so the container binds host ports directly and gains no network isolation. Publishing is unnecessary and ignored, platform behaviour differs outside Linux, and the container uses the host's addresses rather than its own.

Correct answer: A — Any node in the swarm accepts traffic on that port and forwards it to a task, even if no task runs locally

The routing mesh makes the published port reachable on every node and load balances into the service's tasks. Restricting to task-bearing nodes is host mode publishing, host-header routing is a layer 7 proxy feature, and overlay data encryption is opt-in.

Correct answer: A, B — Nodes communicate over mutual TLS with automatically rotated certificates · The swarm can be autolocked so the Raft log encryption key is not stored on disk unencrypted

Swarm establishes a certificate authority and uses mutual TLS with rotation, and autolock protects the Raft encryption key at rest. Control plane traffic is encrypted by default, a manager join token grants manager privileges, and secrets are encrypted in the Raft log.

Correct answer: A — Global mode

A global service places one task per eligible node and adds tasks automatically as nodes join. Replicated mode runs a fixed number of tasks anywhere in the swarm, and rollback and detached are not service modes.

Correct answer: A — Three, because a quorum is more than half the managers

Swarm managers use Raft, which requires a majority to elect a leader and commit changes, so five managers tolerate two failures and need three available. Two or one is below quorum, and requiring all five would provide no fault tolerance at all.