The Secret Of Docker DCA Question

NEW QUESTION 1
Which flag for a service would allow a container to consume more than 2 GB of memory only when there is no memory contention but would also prevent a container from consuming more than 4GB of memory, in any case?

• A. --limit-memory 2GB --reserve-memory 4GB
• B. --limit-memory 4GB --reserve-memory 2GB
• C. --memory-swap 2GB --limit-memory 4GB
• D. --memory-swap 4GB --limit-memory 2GB

Answer: C

NEW QUESTION 2
Which of the following is true about overlay networks?

• A. Overlay networks are created only on the manager node that you created the overlay networking on
• B. Overlay networks are created on all cluster nodes when you create the overlay network.
• C. Overlay networks are first created on the manager node
• D. Then they are created on the worker nodes once a task is scheduled on the specific worker node.
• E. Overlay networks are only created on the manager nodes.

Answer: B

Explanation:
Explanation

NEW QUESTION 3
What is one way of directly transferring a Docker Image from one Docker host in another?

• A. 'docker push' the image to the IP address of the target host.
• B. 'docker commit' to save the image outside of the Docker filesyste
• C. Then transfer the file over to the target host and 'docker start' to start the container again.
• D. There is no way of directly transferring Docker images between host
• E. A Docker Registry must be used ad an intermediary.
• F. 'docker save' the image to save it as TAR file and copy it over to the target hos
• G. Then use 'docker load' to un-TAR the image back as a Docker image.

Answer: D

NEW QUESTION 4
If installing Docker using devicemapper for storage with the Intent to run production workloads, how should devicemapper be configured

• A. direct-lvm
• B. loop-lvm
• C. overlay-lvm
• D. aufs-lvm

Answer: A

NEW QUESTION 5
How do you configure Docker engine to use a registry that is not configured with TLS certificates from a trusted CA?

• A. Set IGNORE_TLS in the 'daemon.json' configuration file.
• B. Set and export the IGNORE_TLS environment variable on the command line
• C. Set INSECURE_REGISTRY in the '/etc/docker/default' configuration file
• D. Pass the '--insecure.-registry' flag to the daemon at run time

Answer: D

NEW QUESTION 6
After creating a new service named 'http', you notice that the new service is not registering as healthy. How do you view the list of historical tasks for that service by using the command line?

• A. 'docker inspect http'
• B. 'docker service inspect http'
• C. 'docker service ps http'
• D. 'docker ps http'

Answer: C

NEW QUESTION 7
Which set of commands can identify the publishd port(s) for a container? (Choose 1.)

• A. 'docker port inspect', 'docker container inspect'
• B. 'docker container inspect', docker port'
• C. 'docker info','docker network inspect'
• D. 'docker network inspect','docker port'

Answer: B

NEW QUESTION 8
You have created a Docker bridge network on a host with three containers attached, how do you make this containers accessible outside of the host?

• A. Use network attach to access the containers on the bridge network
• B. Use either EXPOSE or --publish to access the containers on the bridge network
• C. Use network connect to access the containers on the bridge network
• D. Use --link to access the containers on the bridge network Correct

Answer: B

NEW QUESTION 9
Which of the following statements is true about secrets?

• A. Secrets can be created from any node in the cluster.
• B. Secrets can be modified after they are created.
• C. Secret are stored unencrypted on manager nodes.
• D. Secrets can be created using standard input (STDIN) and a file.

Answer: D

NEW QUESTION 10
Which of the following is supported by control groups?

• A. Manage certificates
• B. Collect net
• C. Limit CPU usage within a container
• D. Isolate processes in a container

Answer: C

NEW QUESTION 11
Which statement is true about DTR garbage collection?

• A. Garbage collection removes unreferenced image layers from DTR's backend storage.
• B. Garbage collection removes exited containers from cluster nodes.
• C. Garbage collection removes DTR images that are older than a configurable of days
• D. Garbage collection removes unused volumes from cluster nodes

Answer: A

NEW QUESTION 12
The following health check exists in a Dockerfile: 'HEALTCHECK
CMD curl --fail http://localhost/health || exit 1 '
Which of the following describes its purpose?

• A. Defines the action taken when container health fails, which in this case will kill the container with exit status 1
• B. Defines the health check endpoint on the localhost interface for external monitoring tools to monitor the health of the docker engine.
• C. Defines the health check endpoint on the local host interface for containers to monitor the health of the docker engine.
• D. Defines the health check for the containerized application so that the application health can be monitored by the Docker engine

Answer: A

NEW QUESTION 13
What is the purpose of multi-stage builds?

• A. Better logical separation of Dockerfile instructions for better readability
• B. Optimizing images by copying artifacts selectively from previous stages
• C. Better caching when building Docker images
• D. Faster image builds by allowing parallel execution of Docker builds

Answer: B

NEW QUESTION 14
Following the principle of least privilege, which of the following methods can be used to securely grnt access to the specific user to communicate to a Docker engine? (Choose two.)

• A. Utilize the '--host 0.0.0.0:2375' option to the Docker daemon to listen on port 2375 over TCP on all interfaces
• B. Utilize openssl to create TLS client and server certificates, configuring the Docker engine to use with mutual TLS over TCP.
• C. Utilize the '--host 127.0.0.1:2375' option to the Docker daemon to listen on port 2375 over TCP on localhost
• D. Give the user root access to the server to allow them to run Docker commands as root.
• E. Add the user to the 'docker' group on the server or specify the grouè with the '--group' Docker daemon option.

Answer: BE

NEW QUESTION 15
Which one of the following commands will show a list of volumes for a specific container?

• A. 'docker container logs nginx --volumes'
• B. 'docker container inspect nginx'
• C. 'docker volume inspect nginx'
• D. 'docker volume logs nginx --containers'

Answer: B

NEW QUESTION 16
Which of the following commands will ensure that overlay traffic between service tasks is encrypted?

• A. docker service create --network <network-name> --secure <service-name>
• B. docker network create -d overlay --secure <network-name>
• C. docker network create -d overlay -o encrypted=true <network-name>
• D. docker service create --network <network-name> --encrypted <service-name>

Answer: C

NEW QUESTION 17
An application image runs in multiple environments, and each environment uses different certificates and ports, what is the best practice to deploy the containers?

• A. Create a Dockerfile for each environment, specifying ports and ENV variables for certificates.
• B. Create a Dockerfile for each environment, specifying ports and Docker secrets for certificates.
• C. Create images that contain the specific configuration for every environment.
• D. Create a config file for each environment.

Answer: D

NEW QUESTION 18
Which command interactively monitors all container activity in the Docker engine?

• A. docker system logs
• B. docker system events
• C. docker container events
• D. docker container logs

Answer: B

NEW QUESTION 19
When seven managers are in a swarm cluster how would they be distributed across three datacenters or availability zones?

• A. 5-1-1
• B. 3-2-2
• C. 3-3-1
• D. 4-2-1

Answer: B

NEW QUESTION 20
Which of the following commands starts a Redis container and configures it to always restart unless it is explicitly stopped or Docker is restarted?

• A. 'docker run -d --restart-policy unless-stopped redis'
• B. 'docker run -d --restart omit-stopped redis'
• C. 'docker run -d --restart unless-stopped redis'
• D. 'docker run -d --failure omit-stopped redis'

Answer: C

NEW QUESTION 21
Which of the following commands is used to display system-wide Docker configuration on a host?

• A. docker info
• B. docker status
• C. docker inspect
• D. docker system

Answer: A

NEW QUESTION 22
The output of which command can be used to find the architecture and operating system an image is compatible with?

• A. docker image inspect --filter {{.Architecture}} {{.OS}} ' <image-id>
• B. docker image ls <image-id>
• C. docker image inspect --format {{.Architecture}} {{.OS}} ' <image-id>
• D. docker image info <image-id>

Answer: C

NEW QUESTION 23
A user is having problems running Docker. Which of the following will start Docker in debug mode?

• A. Set the debug key to true in the 'daemon.json' file.
• B. Start the 'dockerd' process manually with the '--logging' flag set to debug
• C. Set the logging key to debug in the 'daemon.json' file.
• D. Start the 'dockerd' process manually with the '--raw-logs' flag set to debug

Answer: A

NEW QUESTION 24
Wha is the purpose of Docker Content Trust?

• A. Signing and verification of image tags
• B. Enabling mutual TLS between the Docker client and server
• C. Docker registry TLS verification and encryption
• D. Indicating an image on Docker Hub is an official image

Answer: A

NEW QUESTION 25
When using the Docker client to push an image to a registry, what environment variable is used to instruct the client to perform signing of the image?

• A. DOCKER_CONTENT_TRUST=1
• B. DOCKER_IMAGE_SIGN=1
• C. DOCKER_PUSH_SIGN=1
• D. NOTARY_ENABLE=1Correct

Answer: A

NEW QUESTION 26
......