Latest 2023 Realistic Verified DCA Dumps - 100% Free DCA Exam Dumps
Get 2023 Updated Free Docker DCA Exam Questions and Answer
Docker Certified Associate (DCA) exam is a certification program offered by Docker, Inc. that validates the skills and knowledge of IT professionals in using Docker technology. DCA exam is designed to test the candidates' expertise in Docker's core concepts, including containerization, image creation, orchestration, networking, and security. The DCA exam is intended for individuals who have a basic understanding of Docker and want to demonstrate their proficiency in using Docker in a professional setting.
NEW QUESTION # 44
Which one of the following commands will result in the volume being removed automatically once the container
has exited?
- A. 'docker run --rm -v /foo busybox'
- B. 'docker run --del -v /foo busybox'
- C. 'docker run --remove -v /foo busybox'
- D. 'docker run --read-only -v /foo busybox'
Answer: A
NEW QUESTION # 45
Which statement is true about DTR garbage collection?
- A. Garbage collection removes unused volumes from cluster nodes
- B. Garbage collection removes unreferenced image layers from DTR's backend storage.
- C. Garbage collection removes exited containers from cluster nodes.
- D. Garbage collection removes DTR images that are older than a configurable of days
Answer: B
NEW QUESTION # 46
Can this set of commands identify the published port(s) for a container?
Solution. 'docker container inspect", docker port'
- A. No
- B. Yes
Answer: B
Explanation:
Explanation
This set of commands can identify the published port(s) for a container. The docker container inspect command shows low-level information about a container in JSON format. This information includes the network settings of the container, such as the port bindings and exposed ports. The docker port command shows the public port(s) that are mapped to a private port inside the container. By using these two commands, you can identify the published port(s) for a container. References:
https://docs.docker.com/engine/reference/commandline/container_inspect/,
https://docs.docker.com/engine/reference/commandline/port/
NEW QUESTION # 47
The output of which command can be used to find the architecture and operating system an image is compatible with?
- A. docker image info <image-id>
- B. docker image inspect --filter {{.Architecture}} {{.OS}} ' <image-id>
- C. docker image ls <image-id>
- D. docker image inspect --format {{.Architecture}} {{.OS}} ' <image-id>
Answer: D
NEW QUESTION # 48
Will this Linux kernel facility limit a Docker container's access to host resources, such as CPU or memory?
Solution: seccomp
- A. No
- B. Yes
Answer: A
Explanation:
Explanation
Using seccomp does not limit a Docker container's access to host resources, such as CPU or memory.
Seccomp is a Linux kernel facility that allows filtering system calls made by a process. It can be used to enhance the security and isolation of a container by restricting its access to certain system calls. However, it does not affect the resource allocation or consumption of a container. References:
https://docs.docker.com/engine/security/seccomp/,
https://www.kernel.org/doc/html/v4.14/userspace-api/seccomp_filter.html
NEW QUESTION # 49
Seven managers are in a swarm cluster.
Is this how should they be distributed across three datacenters or availability zones?
Solution: 5-1-1
- A. No
- B. Yes
Answer: A
NEW QUESTION # 50
Which of the following statements is true about secrets?
- A. Secrets can be modified after they are created.
- B. Secrets can be created using standard input (STDIN) and a file.
- C. Secrets can be created from any node in the cluster.
- D. Secret are stored unencrypted on manager nodes.
Answer: B
NEW QUESTION # 51
You configure a local Docker engine to enforce content trust by setting the environment variable
DOCKER_CONTENT_TRUST=1.
If myorg/myimage: 1.0 is unsigned, does Docker block this command?
Solution: docker service create myorg/myimage:1.0
- A. No
- B. Yes
Answer: A
NEW QUESTION # 52
During development of an application meant to be orchestrated by Kubemetes, you want to mount the /data directory on your laptop into a container.
Will this strategy successfully accomplish this?
Solution. Create a Persistent VolumeClaim requesting storageClass:"" (which defaults to local storage) and hostPath and use this to populate a volume in a pod.
- A. No
- B. Yes
Answer: B
Explanation:
Explanation
This strategy does successfully mount the /data directory on your laptop into a container. Creating a persistentVolumeClaim requesting storageClass:"" (which defaults to local storage) and hostPath and using this to populate a volume in a pod is a valid way to mount a host directory into a container in Kubernetes. A persistentVolumeClaim is a request for storage by a user or an application. A persistentVolume is an abstraction that represents a piece of storage in the cluster. A storageClass is a type of storage with a specific provisioner and parameters. A hostPath volume allows you to mount a file or directory from the host node's filesystem into your pod. A local volume allows you to mount local storage devices such as disks or partitions into your pod. By creating a persistentVolumeClaim with storageClass:"" and hostPath, you are requesting a piece of storage that is backed by a hostPath volume on the node where the pod is scheduled. By using this persistentVolumeClaim to populate a volume in a pod, you are mounting the host directory into the container in the pod. References: https://kubernetes.io/docs/concepts/storage/persistent-volumes/,
https://kubernetes.io/docs/concepts/storage/storage-classes/,
https://kubernetes.io/docs/concepts/storage/volumes/#hostpath,
https://kubernetes.io/docs/concepts/storage/volumes/#local
NEW QUESTION # 53
In the context of a swarm mode cluster, does this describe a node?
Solution. an instance of the Docker CLI connected to the swarm
- A. No
- B. Yes
Answer: A
Explanation:
Explanation
An instance of the Docker CLI connected to the swarm does not describe a node in the context of a swarm mode cluster. A node is a physical or virtual machine that runs the Docker Engine and participates in the swarm. A node can have one of two roles: manager or worker. Manager nodes maintain the cluster state and orchestrate tasks. Worker nodes execute tasks assigned by manager nodes. An instance of the Docker CLI connected to the swarm is a client that can interact with the swarm using commands such as docker service, docker node, docker stack, etc. A client can connect to any manager node in the swarm using the --host or -H flag. References: https://docs.docker.com/engine/swarm/key-concepts/#nodes-and-services,
https://docs.docker.com/engine/swarm/swarm-tutorial/#use-docker-for-mac-or-docker-for-windows
NEW QUESTION # 54
One of several containers in a pod is marked as unhealthy after failing its livenessProbe many times. Is this the action taken by the orchestrator to fix the unhealthy container?
Solution: The unhealthy container is restarted.
- A. No
- B. Yes
Answer: B
Explanation:
Explanation
The unhealthy container is restarted by the orchestrator to fix the unhealthy container, because this is the default behavior of Kubernetes when a container fails its livenessProbe. According to the official documentation, Kubernetes will kill and restart the container if it does not become healthy after a certain number of failures.
References:
https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/#define-a-li
NEW QUESTION # 55
Is this a function of UCP?
Solution: scans images to detect any security vulnerability
- A. No
- B. Yes
Answer: A
Explanation:
Explanation
Scanning images to detect any security vulnerability is not a function of UCP. UCP stands for Universal Control Plane, which is a web-based user interface for managing Docker Enterprise clusters and applications.
UCP does not provide image scanning capabilities, but it integrates with Docker Trusted Registry (DTR), which does offer image scanning as part of its security features. References: https://docs.docker.com/ee/ucp/,
https://docs.docker.com/ee/dtr/user/manage-images/scan-images-for-vulnerabilities/
NEW QUESTION # 56
How do you configure Docker engine to use a registry that is not configured with TLS certificates from a trusted CA?
- A. Set and export the IGNORE_TLS environment variable on the command line
- B. Set INSECURE_REGISTRY in the '/etc/docker/default' configuration file
- C. Pass the '--insecure.-registry' flag to the daemon at run time
- D. Set IGNORE_TLS in the 'daemon.json' configuration file.
Answer: C
NEW QUESTION # 57
You configure a local Docker engine to enforce content trust by setting the environment variable DOCKER_CONTENT_TRUST=1.
If myorg/myimage: 1.0 is unsigned, does Docker block this command?
Solution: docker service create myorg/myimage:1.0
- A. No
- B. Yes
Answer: B
Explanation:
Explanation
Docker will block this command, because docker service create requires content trust to be enabled by default and will not pull or run unsigned images. According to the official documentation, docker service create is one of the commands that verify content trust by default and will fail if the image is not signed or if the signing key is not trusted.
References: https://docs.docker.com/engine/security/trust/#using-docker-content-trust-in-docker-engine
https://docs.docker.com/engine/reference/commandline/service_create/#extended-description
NEW QUESTION # 58
Is this statement correct?
Solution: A Dockerfile provides instructions for building a Docker image
- A. No
- B. Yes
Answer: B
Explanation:
Explanation
This statement is correct. A Dockerfile provides instructions for building a Docker image. A Dockerfile is a text document that contains all the commands a user could call on the command line to assemble an image.
Using docker build, you can create an automated build that executes several command-line instructions in succession. References: https://docs.docker.com/engine/reference/builder/,
https://docs.docker.com/engine/reference/commandline/build/
NEW QUESTION # 59
Some Docker images take time to build through a Continuous Integration environment. You want to speed up builds and take advantage of build caching.
Where should the most frequently changed part of a Docker image be placed in a Dockerfile?
- A. at the bottom of the Dockerfile
- B. in the ENTRYPOINT directive
- C. after the FROM directive
- D. at the top of the Dockerfile
Answer: A
NEW QUESTION # 60
After creating a new service named 'http', you notice that the new service is not registering as healthy. How do you view the list of historical tasks for that service by using the command line?
- A. 'docker inspect http'
- B. 'docker service inspect http'
- C. 'docker service ps http'
- D. 'docker ps http'
Answer: B
NEW QUESTION # 61
Will this Linux kernel facility limit a Docker container's access to host resources, such as CPU or memory?
Solution: cgroups
- A. No
- B. Yes
Answer: B
Explanation:
Explanation
Using cgroups does limit a Docker container's access to host resources, such as CPU or memory. Cgroups are a Linux kernel feature that allow grouping and managing processes and their resource consumption. They can be used to limit, account, and isolate the resource usage of a container, such as CPU time, memory, disk I/O, network bandwidth, etc. References: https://docs.docker.com/config/containers/resource_constraints/,
https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v1/index.html
NEW QUESTION # 62
You configure a local Docker engine to enforce content trust by setting the environment variable DOCKER_C0NTENT_TRUST=l. If myorg/myimage: 1.0 is unsigned, does Docker block this command?
Solution. docker image build, from a Dockeflle that begins FROM myorg/myimage: l1.0
- A. No
- B. Yes
Answer: B
Explanation:
Explanation
Docker blocks this command if you configure a local Docker engine to enforce content trust by setting the environment variable DOCKER_CONTENT_TRUST=1 and if myorg/myimage:1.0 is unsigned. Content trust is a feature that allows you to use digital signatures to verify the integrity and publisher of specific image tags.
When you enable content trust, you can only pull, run, or build with trusted images. If an image tag is unsigned, Docker will block any command that attempts to use it. This includes docker image build, from a Dockerfile that begins FROM myorg/myimage:1.0, if myorg/myimage:1.0 is unsigned. References:
https://docs.docker.com/engine/security/trust/,
https://docs.docker.com/engine/reference/commandline/image_build/
NEW QUESTION # 63
Are these conditions sufficient for Kubernetes to dynamically provision a persistentVolume, assuming there are no limitations on the amount and type of available external storage?
Solution: A default provisioner is specified, and subsequently a persistentVolumeClaim is created.
- A. No
- B. Yes
Answer: A
NEW QUESTION # 64
What is the docker command to find the current logging driver for a running container?
- A. docker config
- B. docker inspect
- C. docker stats
- D. docker info
Answer: B
NEW QUESTION # 65
A server is running low on disk space. What command can be used to check the disk usage of images, containers, and volumes for Docker engine?
- A. 'docker system df'
- B. 'docker system prune'
- C. 'docker system ps'
- D. 'docker system free'
Answer: A
NEW QUESTION # 66
Is this a supported user authentication method for Universal Control Plane?
Solution. SAML
- A. No
- B. Yes
Answer: B
Explanation:
Explanation
SAML is a supported user authentication method for Universal Control Plane (UCP). SAML (Security Assertion Markup Language) is an open standard for exchanging authentication and authorization data between parties, such as an identity provider and a service provider. UCP supports SAML as an external authentication backend, which allows users to log in to UCP using their existing credentials from a SAML identity provider, such as Okta, Ping Identity, OneLogin, etc. UCP also supports other external authentication backends, such as LDAP and Active Directory. References:
https://docs.docker.com/ee/ucp/admin/configure/external-auth/,
https://docs.docker.com/ee/ucp/admin/configure/saml/
NEW QUESTION # 67
You want to create a container that is reachable from its host's network.
Does this action accomplish this?
Solution. Use either EXPOSE or -publish to access the container on the bridge network.
- A. No
- B. Yes
Answer: A
Explanation:
Explanation
Using either EXPOSE or --publish to access the container on the bridge network does not create a container that is reachable from its host's network. EXPOSE and --publish are options that specify which ports on the container should be exposed or published to the outside world. They do not affect which network the container is connected to. By default, Docker creates and connects containers to a bridge network, which is an internal network that isolates containers from each other and from the host. To create a container that is reachable from its host's network, you need to use --network host option, which connects the container to the host's network stack. References: https://docs.docker.com/engine/reference/builder/#expose,
https://docs.docker.com/engine/reference/run/#expose-incoming-ports,
https://docs.docker.com/network/bridge/, https://docs.docker.com/network/host/
NEW QUESTION # 68
......
DCA Dumps PDF and Test Engine Exam Questions: https://actualanswers.pass4surequiz.com/DCA-exam-quiz.html