Free Practice Questions for Docker DCA Exam

Docker uses cgroups, a Linux kernel feature, to limit the resources a container can use.This includes CPU and memory resources12.For instance, Docker can limit a container’s CPU usage to the equivalent of a single CPU core on the Docker host system2.Similarly, Docker can limit a container’s memory usage1.However, to use these features, the Docker host must have cgroup memory and swap accounting enabled1.Therefore, cgroups can indeed limit a Docker container’s access to host resources such as CPU and memory12.

The statement is correct. In the provided Kubernetes YAML, it’s defined that traffic sent to the IP of this service on port 8080 will be routed to port 80 in a random pod with the label app: nginx. This is because it’s a ClusterIP service type which is meant for internal communication within the cluster, and it uses selectors to route traffic to the correct pods. References: Docker Certified Associate Guide, DCA Prep Guide

= This is not a way to configure the Docker engine to use a registry without a trusted TLS certificate. There is no such option as IGNORE_TLS in the daemon.json configuration file. The daemon.json file is used to configure various aspects of the Docker engine, such as logging, storage, networking, and security1. To use a registry without a trusted TLS certificate, you need to either add the certificate to the trusted root certificates of the system, or configure the Docker engine to allow insecure registries2. To add the certificate to the trusted root certificates, you need to copy the certificate file to the /etc/docker/certs.d// directory on every Docker host2. To configure the Docker engine to allow insecure registries, you need to add the registry hostname or IP address to the “insecure-registries” array in the daemon.json file3. For example:

{ “insecure-registries” : [“myregistry.example.com:5000”] }

Note that using insecure registries is not recommended, as it exposes you to potential man-in-the-middle attacks and data corruption3. You should always use a registry with a trusted TLS certificate, or use Docker Content Trust to sign and verify your images4. References:

Daemon configuration file | Docker Docs

Verify repository client with certificates | Docker Docs

Test an insecure registry | Docker Docs

Content trust in Docker | Docker Docs

= This is not how the seven managers should be distributed across three datacenters or availability zones. A swarm cluster is a group of Docker hosts that are running in swarm mode and act as managers or workers1. A manager node is responsible for maintainingthe swarm state and orchestrating the services2. A swarm cluster needs a quorum of managers to operate, which means a majority of managers must be available and able to communicate with each other3.

The problem with distributing the seven managers as 4-2-1 is that it creates a split-brain scenario, where the cluster can lose the quorum if one datacenter or availability zone fails. For example, if the datacenter with four managers goes down, the remaining three managers will not have enough votes to form a quorum, and the cluster will stop functioning. Similarly, if the datacenter with one manager goes down, the cluster will lose the tie-breaking vote and will not be able to elect a leader4.

A better way to distribute the seven managers across three datacenters or availability zones is to use 3-2-2, which ensures that the cluster can tolerate the failure of any one datacenter or availability zone and still maintain the quorum. For example, if the datacenter with three managers goes down, the remaining four managers will have enough votes to form a quorum and elect a leader. Similarly, if the datacenter with two managers goes down, the remaining five managers will have enough votes to form a quorum and elect a leader4. References:

Swarm mode overview | Docker Docs

Administer and maintain a swarm of Docker Engines | Docker Docs

Raft consensus in swarm mode | Docker Docs

Docker Swarm: How to distribute managers across availability zones? - Stack Overflow

= Docker will block the command docker image inspect myorg/myimage: 1.0 if the image tag is unsigned and the environment variable DOCKER_CONTENT_TRUST is set to 1. This is because Docker Content Trust (DCT) enables the verification of the integrity and publisher of Docker images using digital signatures1. When DCT is enabled, Docker will only pull, run, or inspect images that have a valid signature2. If the image tag is not signed, Docker will reject the command and display an error message, such as No valid trust data for 1.03. To inspect an unsigned image, you need to either disable DCT by setting DOCKER_CONTENT_TRUST to 0, or use the --disable-content-trust flag with the command. References:

Content trust in Docker | Docker Docs

Enable and disable content trust in Docker | Docker Docs

Docker Content Trust: What It Is and How It Secures Container Images

[docker image inspect | Docker Docs]

Creating a Dockerfile for each environment, specifying ports and Docker secrets for certificates is not a way to provision configuration to containers at runtime. A Dockerfile is a text document that contains all the commands a user could call on the command line to assemble an image1. A Dockerfile is used to build an image, not to run a container. Once an image is built, the configuration specified in the Dockerfile cannot be changed at runtime. To provision configuration to containers at runtime, you need to use a different mechanism, such as environment variables, command-line arguments, or config maps234. References:

Dockerfile reference | Docker Docs

Environment variables in Compose | Docker Docs

Override the default command | Docker Docs

Configuration management with Containers | Kubernetes

The command docker Is -a does not list all nodes in a swarm cluster from the command line, but rather lists all containers, both running and stopped, on the current node1. To list all nodes in a swarm cluster, you need to use the command docker node ls from a manager node2. This command shows the node ID, hostname, status, availability, and manager status for each nodein the swarm2. You can also use the --filter option to filter the output based on various criteria2. References: Docker Documentation, docker node ls

The networkPolicy will block the traffic from a pod bearing the tier: backend label, to a pod bearing the tier: frontend label. The networkPolicy specifies that only pods with the tier: frontend label can access the pods with the app: guestbook-api and tier: backend labels on port 801. Any other traffic to the backend pods will be denied by default2. Therefore, a request issued from a pod bearing the tier: backend label, to a pod bearing the tier: frontend label will be blocked by the networkPolicy. References: Connect a Frontend to a Backend Using Services), Network Policies)

 In the context of a swarm mode cluster, an instance of the Docker engine participating in the swarm is indeed a node1. A node can be either a manager or a worker, depending on the role assigned by the swarm manager2. A manager node handles the orchestration and management of the swarm, while a worker node executes the tasks assigned by the manager2. A node can join or leave a swarm at any time, and the swarm manager will reconcile the desired state of the cluster accordingly1. References:

1: Swarm mode overview | Docker Docs

2: Manage nodes in a swarm | Docker Docs