Free DCA sample questions

Correct answers: Enable user namespace remapping (`userns-remap`) on the Docker daemon.; Configure containers to run their main process as a non-root user.

Correct answer: Create a Kubernetes Secret containing the credentials and inject them into the pod as environment variables or a mounted volume.

Kubernetes Secrets are the standard, secure way to handle sensitive information like passwords, tokens, and keys. They are stored in the cluster (often base64 encoded, but can be encrypted at rest) and can be easily updated without rebuilding images. They can be exposed to pods as environment variables or mounted as files, isolating sensitive data from the application image and configuration files. ConfigMaps are for non-sensitive configuration data. Baking credentials into an image is a major security vulnerability.

Correct answer: 1. `docker network create -d overlay isolated-net` 2. `docker service create --network isolated-net --name webapp myapp:1.0` 3. `docker service create --network isolated-net --name database mydb:1.0`

To achieve complete isolation, you should create a dedicated overlay network (`isolated-net`). Then, create both services and attach them ONLY to this network. Crucially, you must NOT publish any ports (`-p` flag) for either service. This ensures that the services can communicate with each other via their service names over the `isolated-net`, but no traffic can reach them from outside the Swarm cluster or from services on other networks.

Correct answer: True

This statement is true. The `COPY` instruction was specifically enhanced for multi-stage builds with the `--from` flag to allow copying files from a named previous stage. The `ADD` instruction, while having more features like URL and tar extraction, does not support the `--from` flag and cannot be used to copy artifacts between build stages.

Correct answer: In the Docker daemon configuration file (`/etc/docker/daemon.json`).

To set a default logging driver for all containers on a host, the configuration must be applied to the Docker daemon itself. This is done by modifying the `daemon.json` file (typically located at `/etc/docker/daemon.json` on Linux) to include the logging driver and its options. For example: `{"log-driver": "splunk", "log-opts": {"splunk-token": "..."}}`. This ensures any container started without a specific `--log-driver` flag will inherit the daemon's default.

Correct answer: Using multiple `FROM` instructions to create a multi-stage build.

A multi-stage build, which uses multiple `FROM` instructions in a single Dockerfile, is the standard and most efficient way to solve this. The first stage (e.g., `FROM golang:1.19 as builder`) can be used to install dependencies and build the binary. A subsequent stage (e.g., `FROM alpine:latest`) can then use `COPY --from=builder /app/binary /app/binary` to copy ONLY the compiled artifact into a clean, minimal base image. This ensures the final image does not contain any build-time dependencies, resulting in a significantly smaller size.

Correct answer: docker node update --availability drain

The command `docker node update --availability drain ` is specifically designed for this purpose. Setting the availability to `drain` does two things: 1) it prevents the scheduler from assigning new tasks to the node, and 2) it gracefully stops and reschedules any existing tasks from that node onto other available nodes in the cluster. `pause` only prevents new tasks but leaves existing ones running. `active` is the normal state. `rm` is for removing the node from the swarm entirely.

Correct answer: The container is using a logging driver other than `json-file` or `journald`.

The `docker logs` command is only functional for containers that use the `json-file` or `journald` logging drivers. If the Docker daemon or the specific container is configured to use a different driver (e.g., `splunk`, `syslog`, `gelf`), the logs are sent directly to the specified endpoint and are not stored in a way that `docker logs` can access. The other options are less likely; even a quickly exiting container would produce some log output if it used the default driver, and an application logging to a file would not prevent `docker logs` from showing startup errors sent to stdout/stderr before file logging began.

Correct answer: docker service create --mode global --constraint 'node.labels.region == us-east' my-image

To run a task on every eligible node, you must use `--mode global`. To restrict this deployment to only the nodes with a specific label, you must add a `--constraint`. The correct syntax for constraining based on a node label is `'node.labels.LABEL == VALUE'`. Combining `--mode global` with the appropriate constraint ensures the service runs one task on every node that matches the criteria, and only on those nodes.

Correct answer: Use the `--dns=10.10.5.5` flag with the `docker run` command.

The `docker run` command provides a `--dns` flag specifically to specify custom DNS servers for the container to use. By default, a container inherits the DNS settings from the host's `/etc/resolv.conf`. To override this and point to a specific internal DNS server, the `--dns` flag is the correct and direct method. The other options are incorrect; `--add-host` is for static host entries (like a `/etc/hosts` file), `--ip` sets the container's IP, and `-p` is for port mapping.