DCA sample questions with answers

DCA sample questions

Docker Certified Associate (DCA), Mirantis (Docker Enterprise Platform Business).

1. Question 1

   Domain: Orchestration

   Which placement constraint keeps a service's tasks off manager nodes?

   1. --constraint node.type!=manager
   2. --constraint node.role==worker
   3. --constraint node.labels.role==worker
   4. --constraint engine.role==worker
   Show the answer

   Answer: B. --constraint node.role==worker

   node.role is a built-in node attribute whose value is manager or worker, so node.role==worker schedules tasks only on workers. node.labels.role would only work if someone had added a custom label called role, and node.type is not a supported attribute.

   Checked against: https://docs.docker.com/reference/cli/docker/service/create/#constraint

2. Question 2

   Domain: Orchestration

   A swarm has three managers. Two of them suffer disk failures and will not come back; the third is healthy and the worker nodes are fine.

   What is the state of the swarm now?

   1. Running tasks continue, but scaling, updates and node joins are blocked until quorum is restored
   2. All services stop immediately because workers can no longer reach a leader
   3. The remaining manager automatically becomes a single-manager swarm and continues normally, so no action is needed
   4. Workers elect one of themselves as a temporary manager to restore quorum
   Show the answer

   Answer: A. Running tasks continue, but scaling, updates and node joins are blocked until quorum is restored

   When quorum is lost, running tasks continue on their nodes, but the swarm cannot perform management tasks, so you cannot scale, update or add nodes. The surviving manager does not silently reform the cluster; you recover it with docker swarm init --force-new-cluster, and workers never take part in manager elections.

   Checked against: https://docs.docker.com/engine/swarm/admin_guide/#recover-from-losing-the-quorum

3. Question 3

   Domain: Orchestration

   Which command lists the tasks of the stack shop, including the node each task runs on and its current state?

   1. docker stack services shop
   2. docker stack ls shop
   3. docker service ls --stack shop
   4. docker stack ps shop
   Show the answer

   Answer: D. docker stack ps shop

   docker stack ps lists every task in the stack with its node, desired state and current state, which is where failed or pending tasks show up. docker stack services lists the services and their replica counts but not individual tasks, and docker stack ls only lists stacks.

   Checked against: https://docs.docker.com/reference/cli/docker/stack/ps/

4. Question 4

   Domain: Image Creation, Management, and Registry

   Which Dockerfile instruction automatically extracts a local .tar.gz archive from the build context into the destination directory?

   1. COPY
   2. RUN
   3. ADD
   4. VOLUME
   Show the answer

   Answer: C. ADD

   ADD recognises local tar archives in common compression formats and extracts them into the destination, and it can also fetch remote URLs. COPY copies the archive file as-is, which is why COPY is preferred when you do not want that extra behaviour.

   Checked against: https://docs.docker.com/reference/dockerfile/#add

5. Question 5

   Domain: Image Creation, Management, and Registry

   Which Dockerfile-based technique produces a single-layer image while keeping CMD and other settings declared in the Dockerfile?

   1. Adding a final RUN rm -rf / step to merge earlier layers
   2. Using a single ADD instruction for everything and many RUN lines afterwards
   3. Setting LABEL com.docker.squash=true in the final stage so that the builder merges all earlier layers
   4. A multi-stage build whose final stage is FROM scratch with COPY --from=build / / and then CMD
   Show the answer

   Answer: D. A multi-stage build whose final stage is FROM scratch with COPY --from=build / / and then CMD

   Starting the final stage FROM scratch and copying the whole filesystem from an earlier stage creates one filesystem layer, and instructions such as CMD or ENV in that stage add only metadata. RUN rm cannot merge layers because each RUN adds another layer, and there is no squash label.

   Checked against: https://docs.docker.com/build/building/multi-stage/

6. Question 6

   Domain: Installation and Configuration

   You are deploying MKE on AWS across three availability zones for high availability. Users will reach the UI and API through a single DNS name.

   Which design matches the documented approach?

   1. Three or five MKE managers behind a TCP load balancer passing 443 through to them, with the load balancer's hostname included as a SAN in the MKE certificate
   2. Two MKE managers in an active/passive pair behind an HTTP load balancer that terminates TLS
   3. One MKE manager per availability zone with DNS round-robin and no load balancer
   4. Four MKE managers so that two can fail at the same time
   Show the answer

   Answer: A. Three or five MKE managers behind a TCP load balancer passing 443 through to them, with the load balancer's hostname included as a SAN in the MKE certificate

   MKE's managers form a quorum, so an odd number (three or five) is used, spread across availability zones, with a TCP load balancer forwarding ports 443 and 6443 without terminating HTTPS and health-checking each manager's /_ping endpoint; the load balancer's name is added to the certificate SANs (for example with --san at install). Four managers still tolerate only one failure, and two managers cannot survive the loss of either.

   Checked against: https://docs.mirantis.com/mke/3.4/single/#configure-load-balancing-on-mke

7. Question 7

   Domain: Installation and Configuration

   Which kernel feature does Docker use to limit how much memory and CPU a container can consume?

   1. Namespaces (PID, network, mount and user)
   2. Control groups (cgroups)
   3. Seccomp
   4. Capabilities
   Show the answer

   Answer: B. Control groups (cgroups)

   Control groups account for and limit resources such as memory, CPU and block I/O, and are what --memory and --cpus configure. Namespaces isolate what a container can see (processes, network, mounts) but do not cap resource usage, and seccomp and capabilities restrict what it can do.

   Checked against: https://docs.docker.com/engine/security/#control-groups

8. Question 8

   Domain: Networking

   The app container logs "could not translate host name db". docker network inspect backend lists db but not app, and docker inspect app shows it only on frontend.

   What explains the failure and how do you fix it?

   1. The db container must publish port 5432 with -p before any container on another network can reach it by its name
   2. Container names only resolve after restarting the daemon
   3. The containers are on different networks; connect app to the backend network with docker network connect backend app
   4. The app container needs --privileged to open network connections
   Show the answer

   Answer: C. The containers are on different networks; connect app to the backend network with docker network connect backend app

   Containers can only reach each other directly when they share a network, and names are resolved per network. docker network connect attaches the running app container to backend so it can reach db by name; publishing ports is only needed for access from outside Docker networks.

   Checked against: https://docs.docker.com/reference/cli/docker/network/connect/

9. Question 9

   Domain: Security

   Alice has generated a delegation key pair (alice.pub and the private key in her local trust store) and must be allowed to sign tags in registry.example.com/team/app.

   Which sequence lets Alice sign the tag?

   1. docker trust key generate alice, then docker push --sign registry.example.com/team/app:1.0
   2. docker tag app:1.0 registry.example.com/team/app:1.0-signed
   3. docker trust inspect --add alice registry.example.com/team/app:1.0
   4. docker trust signer add --key alice.pub alice registry.example.com/team/app, then Alice runs docker trust sign registry.example.com/team/app:1.0
   Show the answer

   Answer: D. docker trust signer add --key alice.pub alice registry.example.com/team/app, then Alice runs docker trust sign registry.example.com/team/app:1.0

   A repository owner adds a delegation signer with docker trust signer add and the signer's public key; the signer then uses docker trust sign, which signs and pushes the tag with her delegation private key. docker push has no --sign flag and docker trust inspect only displays trust data.

   Checked against: https://docs.docker.com/engine/security/trust/#signing-images-with-docker-content-trust

10. Question 10

    Domain: Storage and Volumes

    An administrator has created a 20Gi PersistentVolume with access mode ReadWriteOnce, and a database Pod needs persistent storage.

    How does the Pod get the storage?

    1. The Pod names the PV directly under spec.containers[].volumeMounts, and Kubernetes binds it when the Pod is scheduled
    2. The PV is mounted automatically into every Pod in the namespace
    3. The Pod lists a volume with persistentVolumeClaim.claimName pointing to a PVC, which binds to a matching PV
    4. The Pod uses a hostPath volume with the PV's name
    Show the answer

    Answer: C. The Pod lists a volume with persistentVolumeClaim.claimName pointing to a PVC, which binds to a matching PV

    Pods consume persistent storage through a PersistentVolumeClaim: the claim requests size and access mode, Kubernetes binds it to a suitable PersistentVolume, and the Pod references the claim in spec.volumes with persistentVolumeClaim.claimName, then mounts it with volumeMounts. Pods do not reference PVs directly.

    Checked against: https://kubernetes.io/docs/concepts/storage/persistent-volumes/#claims-as-volumes