Free Practice Questions for Docker DCA Exam

Docker’s bridge network allows containers connected to the same bridge network to communicate, while providing isolation from containers that aren’t connected to that bridge network1.By using thenetwork attachcommand, you can connect a container to the bridge network, making it reachable from the host’s network12.However, it’s important to note that containers on the default bridge network can only access each other by IP addresses, unless you use the--linkoption, which is considered legacy2.For better isolation and automatic DNS resolution between containers, it’s recommended to use user-defined bridge networks12.

 Deleting the image and the image repository from Docker Trusted Registry will not completely delete the image from disk. This is because deleting a repository or a tag only removes the reference to the image, but not the image itself. The image is still stored as a blob on the disk, and can be accessed by its digest1. To completely delete the image from disk, you need to enable the deletion feature in the registry configuration, and then use the API to delete the image by its manifest2. Alternatively, you can manually delete the image files from the registry storage directory, but this is not recommended3. After deleting the image, you also need to run the garbage collector to reclaim the disk space4. References:

Docker Registry HTTP API V2

How to delete images from a private docker registry?

Remove docker image in registry by removing files/folders on server

Garbage collection

 = The correct command to list all nodes in a swarm cluster from the command line is docker node ls, not docker swarm nodes. The docker node command allows you to manage nodes in a swarm, such as listing, inspecting, updating, or removingnodes1. The docker swarm command allows you to manage the swarm itself, such as initializing, joining, leaving, or updating the swarm2. References:

Manage nodes in a swarm | Docker Docs

Manage a swarm | Docker Docs

= Authentication is not a type of Linux kernel namespace that provides container isolation. Namespaces are a feature of the Linux kernel that partitions kernel resources such that one set of processes sees one set of resources and another set of processes sees a different set of resources. Docker uses six different namespaces to isolate containersfrom the host and from each other: PID, USER, UTS, IPC, MNT, and NET12. Authentication is not one of them. Authentication is a process of verifying the identity of a user or a system, which is usually done by using credentials such as passwords, tokens, or certificates. Authentication does not directly affect the isolation of containers, although it can be used to control access to them. References:

Docker security | Docker Docs

Securing Docker Containers with Linux Kernel Features | Infosec

 Adding all the resources to the default namespace is not a way to accomplish this, because it would not isolate the resources for each application. Instead, the teams should use namespaces, which are a mechanism to organize resources in a Kubernetes cluster. Namespaces provide a scope for names of resources and a way to attach authorization and policy to a subset of the cluster. By creating a separate namespace for each application, the teams can ensure that their resources are grouped together and not accessible by other teams or applications.

 = The command kubectl get pods --all-namespaces -label env=development is not valid because it has a syntax error. The correct syntax for listing pods with a specific label is kubectl get pods --all-namespaces --selector label=value or kubectl get pods --all-namespaces -l label=value. The error in the command is:

The option flag for specifying the label selector is --selector or -l, not -label. For example, -label env=development should be --selector env=development or -l env=development.

The correct command for listing all the pods in the cluster that are labeled as env: development is:

kubectl get pods --all-namespaces --selector env=development

This command will display the name, status, restarts, and age of the pods that have the label env: development in all namespaces.

 Labels | Kube by Example : kubectl Cheat Sheet | Kubernetes

Node taints are a way to mark nodes in a Swarm cluster so that they can repel or attract certain containers based on their tolerations. By applying node taints to the nodes that are designated for development or production, the company can ensure that only the containers that have the matching tolerations can be scheduled on those nodes. This way, the security policy requirements can be met. Node taints are expressed as key=value:effect, where the effect can be NoSchedule, PreferNoSchedule, or NoExecute. For example, to taint a node for development only, one can run:

kubectl taint nodes node1 env=dev:NoSchedule

This means that no container will be able to schedule onto node1 unless it has a toleration for the taint env=dev:NoSchedule. To add a toleration to a container, one can specify it in the PodSpec. For example:

tolerations:

- key: "env"

operator: "Equal"

value: "dev"

effect: "NoSchedule"

This toleration matches the taint on node1 and allows the container to be scheduled on it. References:

Taints and Tolerations | Kubernetes

Update the taints on one or more nodes in Kubernetes

A Complete Guide to Kubernetes Taints & Tolerations