Free Practice Questions for Docker DCA Exam

 = The configuration will not achieve fault tolerance for managers in a swarm, because it does not have enough managers to form a quorum. A quorum is the minimum number of managers that must be available to agree on values and maintain the consistent state of the swarm. The quorum is calculated as (N/2)+1, where N is the number of managers in the swarm. For example, a swarm with 3 managers has a quorum of 2, and a swarm with 5 managers has a quorum of 3. Having only two managers, one active and one passive, means that the quorum is also 2. Therefore, if one manager fails or becomes unavailable, the swarm will lose the quorum and will not be able to process any requests or schedule any tasks. To achieve fault tolerance, a swarm should have an odd number of managers, at least 3, and no more than 7. This way, the swarm can tolerate the loss of up to (N-1)/2 managers and still maintain the quorum and the cluster state. References:

Administer and maintain a swarm of Docker Engines

Raft consensus in swarm mode

How nodes work

 = The command docker container inspect nginx will display a list of volumes for the specific container named nginx. The output of the command will include a section called “Mounts” that shows the source, destination, mode, type, and propagation of each volume mounted in the container1. For example, the following output shows that the container nginx has two volumes: one is a bind mount from the host’s /var/log/nginx directory to the container’s /var/log/nginx directory, and the other is an anonymous volume created by Docker at /var/lib/docker/volumes/… and mounted to the container’s /etc/nginx/conf.d directory2.

"Mounts": [

{

"Type": "bind",

"Source": "/var/log/nginx",

"Destination": "/var/log/nginx",

"Mode": "rw",

"RW": true,

"Propagation": "rprivate"

},

{

"Type": "volume",

"Name": "f6eb3dfdd57b7e632f6329a6d9bce75a1e8ffdf94498e5309c6c81a87832c28d",

"Source": "/var/lib/docker/volumes/f6eb3dfdd57b7e632f6329a6d9bce75a1e8ffdf94498e5309c6c81a87832c28d/_data",

"Destination": "/etc/nginx/conf.d",

"Driver": "local",

"Mode": "",

"RW": true,

"Propagation": ""

}

]

docker container inspect

List volumes of Docker container

 = The solution will not configure a Docker container to export container logs to the logging solution, such as Splunk. The command docker system events --filter splunk is not a valid command to send logs to a remote destination. The --filter option for docker system events only accepts the following keys: container, daemon, event, image, label, network, plugin, type, and volume1. splunk is not a valid key for filtering events. To configure a Docker container to export container logs to a logging solution, such as Splunk, you need to use the --log-driver and --log-opt options when creating or running the container2. For example, to use the Splunk logging driver, you can use the following command:

docker run --log-driver=splunk --log-opt splunk-token=176FCEBF-4CF5-4EDF-91BC-703796522D20 --log-opt splunk-url=https://splunkhost:8088 ...

This command will send the container logs to the Splunk HTTP Event Collector (HEC) endpoint specified by the splunk-url option, using the authentication token provided by the splunk-token option3. You can also use other logging drivers, such as syslog, fluentd, gelf, etc., depending on your logging solution4. References:

1: docker system events | Docker Docs

2: Configure logging drivers | Docker Docs

3: Splunk logging driver | Docker Docs

4: Supported logging drivers | Docker Docs

Yes, thedocker portcommand can be used to identify the published ports for a running container. It shows the mapping between the host ports and the container’s exposed ports. Thedocker network inspectcommand can also provide information about the network settings of the container, including port mappings. However, it’s important to note thatdocker network inspectrequires the network’s name or ID as an argument, not the container’s. Therefore, to get the network details of a specific container, you would first need to identify the network the container is connected to. These commands, when used appropriately, can help you identify the published ports for a container.

 Label constraints can be used to schedule containers to meet the security policy requirements. Label constraints are a way to specify which nodes a service can run on based on the labels assigned to the nodes. Labels are key-value pairs that can be attached to any node in the swarm. For example, you can label nodes as development or production depending on their intended use. Then, you can use the --constraint option when creating or updating a service to filter the nodes based on their labels. For example, to run a service only on development nodes, you can use:

docker service create --constraint'node.labels.environment == development'...

To run a service only on production nodes, you can use:

docker service create --constraint'node.labels.environment == production'...

This way, you can ensure that development and production containers run on separate nodes in the swarm, as required by the security policy. References:

Using placement constraints with Docker Swarm

Multiple label placement constraints in docker swarm

Machine constraints in Docker swarm

How can set service constraint to multiple value

= The command ‘docker service create -name dns-cache -p 53:53/udp dns-cache’ is not correct and will not create a swarm service that only listens on port 53 using the UDP protocol. There are two errors in the command:

The option -name should be --name with two dashes, otherwise it will be interpreted as a short option -n followed by an argument ame1.

The option -p or --publish will publish the service port to the host port, which means the service will be reachable from outside the swarm2. To create a service that only listens on the internal network, you need to use the --publish-add option with the mode=ingress flag3.

The correct command should be:

docker service create --name dns-cache --publish-add mode=ingress,target=53,published=53,protocol=udp dns-cache

docker service create | Docker Docs

Publish ports on the host | Docker Docs

Publish a port for a service | Docker Docs

The networking drivers that allow you to enable multi-host network connectivity between containers are bridge, macvlan, ipvlan, and overlay. These drivers create networks that can span multiple Docker hosts, and therefore enable containers on different hosts to communicate with each other. The other drivers, such as host, user-defined, and none, create networks that are either isolated or limited to a single host. Here is a brief overview of each driver and how it supports multi-host networking:

•bridge: The bridge driver creates a network that connects containers on the same host using a Linux bridge. However, it can also be used to create a network that connects containers across multiple hosts using an external key-value store, such as Consul, Etcd, or ZooKeeper. This feature is deprecated and not recommended, as it requires manual configuration and has some limitations. The preferred driver for multi-host networking is overlay1.

•macvlan: The macvlan driver creates a network that assigns a MAC address to each container, making it appear as a physical device on the network. This allows the containers to communicate with other devices on the same network, regardless of the host they are running on. The macvlan driver can also use 802.1q trunking to create sub-interfaces and isolate traffic between different networks2.

•ipvlan: The ipvlan driver creates a network that assigns an IP address to each container, making it appear as a logical device on the network. This allows the containers to communicate with other devices on the same network, regardless of the host they are running on. The ipvlan driver can also use different modes, such as l2, l3, or l3s, to control the routing and isolation of traffic between different networks3.

•overlay: The overlay driver creates a network that connects multiple Docker daemons together using VXLAN tunnels. This allows the containers to communicate across different hosts, even if they are on different networks. The overlay driver also supports encryption, load balancing, and servicediscovery. The overlay driver is the default and recommended driver for multi-host networking, especially for Swarm services4.

= The conditions are sufficient for Kubernetes to dynamically provision a persistentVolume, because they include a default storageClass and a persistentVolumeClaim. A storageClass defines which provisioner should be used and what parameters should be passed to that provisioner when dynamic provisioning is invoked. A persistentVolumeClaim requests a specific size, access mode, and storageClass for the persistentVolume. If a persistentVolume that satisfies the claim exists or can be provisioned, the persistentVolumeClaim is bound to that persistentVolume. A default storageClass means that any persistentVolumeClaim that does not specify a storageClass will use the default one. Therefore, the conditions in the question are enough to enable dynamic provisioning of storage volumes on-demand. References:

Dynamic Volume Provisioning | Kubernetes

Persistent volumes and dynamic provisioning | Google Kubernetes Engine …

The command docker run -v /data:/mydata -mode readonly ubuntu will not mount the host’s /data1 directory to the ubuntu container in read-only mode. The commandhas several errors that prevent it from working correctly. First, the host directory should be /data1 instead of /data, as specified in the question. Second, the option flag should be --mode instead of -mode, and it should be placed before the image name. Third, the mode value should be ro instead of readonly, as per the Docker documentation1. The correct command should be docker run -v /data1:/mydata --mode ro ubuntu, which will mount the host’s /data1 directory as a read-only volume at /mydata inside the container1. References:

docker run | Docker Docs