Free DCA: Docker Certified Associate (DCA) Exam Questions and Answers

An administrator wants to use Go templates when creating a swarm service with `docker service create`. Does each of the following command fragments use templates in a way that the command supports? 1. `--hostname="{{.Node.Hostname}}-{{.Task.Slot}}"` 2. `--label tier={{.Service.Name}}` 3. `--env NODE_ID={{.Node.ID}}`

Answer each statement, then reveal.

1. `--hostname="{{.Node.Hostname}}-{{.Task.Slot}}"`YesNo
2. `--label tier={{.Service.Name}}`YesNo
3. `--env NODE_ID={{.Node.ID}}`YesNo

An administrator initializes a swarm with `docker swarm init` and adds no extra security options. Is each of the following statements true for the resulting cluster? 1. Communication between swarm nodes is secured with mutual TLS. 2. Traffic between containers on an overlay network is encrypted on the data plane. 3. The first manager acts as the root certificate authority for the swarm.

Answer each statement, then reveal.

1. Communication between swarm nodes is secured with mutual TLS.YesNo
2. Traffic between containers on an overlay network is encrypted on the data plane.YesNo
3. The first manager acts as the root certificate authority for the swarm.YesNo

A swarm has three manager nodes and two worker nodes, all with availability set to active. An administrator must run exactly one task of a monitoring agent image on every node, including any node that joins the swarm later. Which command meets this requirement?

• AA. docker service create --name agent --mode global --constraint node.role==worker monitoring-agent:2.1
• BB. docker service create --name agent --mode global monitoring-agent:2.1
• CC. docker service create --name agent --replicas 5 monitoring-agent:2.1
• DD. docker service create --name agent --mode replicated --replicas-max-per-node 1 monitoring-agent:2.1

A container named web is attached to two user-defined bridge networks, frontend and backend. Considering the Container Network Model, is each of the following statements correct? 1. The container has one endpoint for each network it is attached to. 2. The network configuration of the container, including its interfaces and routing table, is held in a single sandbox. 3. The IPAM driver is responsible for creating the virtual Ethernet pair that connects the container to each network.

Answer each statement, then reveal.

1. The container has one endpoint for each network it is attached to.YesNo
2. The network configuration of the container, including its interfaces and routing table, is held in a single sandbox.YesNo
3. The IPAM driver is responsible for creating the virtual Ethernet pair that connects the container to each network.YesNo

An administrator runs `docker run -d --memory 512m --cpus 1.5 --pid=host app1:3.0` on a host that must also pull images from a private registry at registry.example.com:5000 that uses a certificate from an internal CA. Is each of the following statements correct? 1. The 512 MB memory limit is enforced by control groups. 2. The `--cpus 1.5` limit is enforced through the user namespace. 3. Placing the CA certificate at /etc/docker/certs.d/registry.example.com:5000/ca.crt lets the daemon trust that registry.

Answer each statement, then reveal.

1. The 512 MB memory limit is enforced by control groups.YesNo
2. The `--cpus 1.5` limit is enforced through the user namespace.YesNo
3. Placing the CA certificate at /etc/docker/certs.d/registry.example.com:5000/ca.crt lets the daemon trust that registry.YesNo

An image named tool:1 is built from this Dockerfile. FROM alpine:3.19 WORKDIR /app COPY server /app/server VOLUME /app/data EXPOSE 8080 ENTRYPOINT ["/app/server"] CMD ["--port", "8080"] Is each of the following statements correct? 1. Running `docker run tool:1 --port 9090` starts /app/server with the argument `--port 9090`. 2. The `EXPOSE 8080` instruction publishes port 8080 on the Docker host when a container starts. 3. A container started without the `-v` option gets an anonymous volume mounted at /app/data. 4. Because ENTRYPOINT uses the exec form, /app/server runs as a child of /bin/sh -c.

Answer each statement, then reveal.

1. Running `docker run tool:1 --port 9090` starts /app/server with the argument `--port 9090`.YesNo
2. The `EXPOSE 8080` instruction publishes port 8080 on the Docker host when a container starts.YesNo
3. A container started without the `-v` option gets an anonymous volume mounted at /app/data.YesNo
4. Because ENTRYPOINT uses the exec form, /app/server runs as a child of /bin/sh -c.YesNo

Is each of the following statements about the built-in Docker network drivers correct? 1. The bridge driver connects containers that run on different Docker hosts. 2. The macvlan driver lets a container appear on the physical network with its own MAC address. 3. The none driver gives a container a loopback interface and no external network connectivity.

Answer each statement, then reveal.

1. The bridge driver connects containers that run on different Docker hosts.YesNo
2. The macvlan driver lets a container appear on the physical network with its own MAC address.YesNo
3. The none driver gives a container a loopback interface and no external network connectivity.YesNo

Is each of the following statements about listing and inspecting images correct? 1. `docker images --filter dangling=true` lists images that have no tag and are not referenced by another image. 2. `docker image inspect --format '{{.Size}}' nginx:latest` reports the image size in megabytes. 3. `docker image inspect --format '{{json .Config.Env}}' nginx:latest` prints the environment variables of the image as JSON. 4. `docker images --filter since=nginx:latest` lists images created after nginx:latest.

Answer each statement, then reveal.

1. `docker images --filter dangling=true` lists images that have no tag and are not referenced by another image.YesNo
2. `docker image inspect --format '{{.Size}}' nginx:latest` reports the image size in megabytes.YesNo
3. `docker image inspect --format '{{json .Config.Env}}' nginx:latest` prints the environment variables of the image as JSON.YesNo
4. `docker images --filter since=nginx:latest` lists images created after nginx:latest.YesNo

Which of the following statements about deploying a stack with docker stack deploy are true? For each statement, select Yes or No. 1. The command docker stack deploy -c docker-compose.yml shop creates the services defined in the compose file as part of a stack named shop. 2. The build: key of a service in the compose file is used to build the image on each node during deployment. 3. The command must be run against a swarm manager node. 4. The compose file must be passed with the -f flag.

Answer each statement, then reveal.

1. The command docker stack deploy -c docker-compose.yml shop creates the services defined in the compose file as part of a stack named shop.YesNo
2. The build: key of a service in the compose file is used to build the image on each node during deployment.YesNo
3. The command must be run against a swarm manager node.YesNo
4. The compose file must be passed with the -f flag.YesNo

An image named checker is built from the following Dockerfile. FROM alpine:3.19 RUN apk add --no-cache curl WORKDIR /app COPY check.sh . ENTRYPOINT ["./check.sh"] CMD ["--quiet"] Which of the following statements are true? For each statement, select Yes or No. 1. Running docker run checker --verbose executes ./check.sh --verbose. 2. Running docker run checker --verbose executes ./check.sh --quiet --verbose. 3. The RUN instruction installs curl each time a container is started from the image. 4. The file check.sh is placed at /app/check.sh in the image.

Answer each statement, then reveal.

1. Running docker run checker --verbose executes ./check.sh --verbose.YesNo
2. Running docker run checker --verbose executes ./check.sh --quiet --verbose.YesNo
3. The RUN instruction installs curl each time a container is started from the image.YesNo
4. The file check.sh is placed at /app/check.sh in the image.YesNo