Text preview & study summary

Docker DCA - Certified Associate - Orchestration Image Creation Registry Networking Storage Security

A free sample of 5 questions from this quiz, shown in full with answer choices and explanations. No interactivity — everything is visible on this page for study and review.

Want to test your knowledge? Launch the Interactive Exam Simulator

Question 1

A security team requires that containers run with read-only root filesystems to prevent unauthorized writes. A developer implements `docker run --read-only myapp` but the application fails because it needs to write to `/tmp`. What is the correct solution?

Answer choices

  • A. Remove `--read-only` for applications that need write access — it's incompatible with most applications

  • B. Add a `--tmpfs /tmp` mount — this provides an ephemeral, in-memory writable filesystem at `/tmp` while keeping the rest read-only (Correct)

  • C. Mount a named volume at `/tmp` — this provides write access while maintaining root filesystem immutability

  • D. Set `--privileged` flag to allow writes to the read-only filesystem

Explanation

`--tmpfs /tmp` creates an ephemeral, in-memory tmpfs mount at `/tmp` that is writable, while the rest of the container's filesystem remains read-only. This is the recommended pattern: `docker run --read-only --tmpfs /tmp myapp`. Named volumes (option C) would also work for persistent storage but are heavier than tmpfs for temporary data. `--privileged` (option D) grants container access to all host devices and capabilities — it doesn't affect the read-only filesystem policy and is a security anti-pattern.

Question 2

A developer runs `docker exec -it <container_id> bash` but receives the error `OCI runtime exec failed: container is not running`. What does this indicate?

Answer choices

  • A. The container is paused — run `docker unpause <container_id>` first

  • B. The container has stopped or exited — `docker exec` only works on running containers (Correct)

  • C. The bash shell is not installed in the container image

  • D. The container needs `--interactive` flag at creation time to support exec

Explanation

`docker exec` attaches to a running container and executes a command within it. If the container is stopped or has exited, `docker exec` cannot be used. To investigate a stopped container: use `docker logs <container_id>` to see output, `docker inspect <container_id>` to check exit code and status, or `docker start <container_id>` to restart it. Option A (paused container) would show a different error. Option C would show `executable file not found in $PATH`.

Question 3

A team is using Docker Swarm for container orchestration. They deploy a service with `docker service create --replicas 3 --name web nginx:latest`. One of the 3 nodes becomes unavailable. What does Docker Swarm do?

Answer choices

  • A. The service continues with only 2 replicas until the node recovers

  • B. Swarm's reconciliation loop detects the desired state (3 replicas) doesn't match the actual state (2 running) and schedules the missing replica on an available node (Correct)

  • C. The entire service is stopped and must be manually redeployed

  • D. Swarm waits for the unavailable node to recover before rescheduling

Explanation

Docker Swarm maintains a desired state model. The swarm manager continuously reconciles desired state (3 replicas) with actual state. When a node fails, the replicas running on it are lost, and Swarm automatically schedules replacement replicas on healthy nodes. This is a core feature of container orchestration — self-healing. The service continues to serve traffic from the 2 healthy replicas while the 3rd is being rescheduled.

Question 4

A developer creates a Docker network: `docker network create --driver overlay mynet`. Which statement about overlay networks is correct?

Answer choices

  • A. Overlay networks work only on a single Docker host

  • B. Overlay networks span multiple Docker Swarm nodes, enabling containers on different hosts to communicate using their container names as DNS hostnames (Correct)

  • C. Overlay networks require a third-party network plugin like Calico or Flannel

  • D. Overlay networks replace the host network stack and require `--network=host` to be disabled

Explanation

Docker overlay networks use VXLAN encapsulation to create a virtual Layer 2 network spanning multiple Docker Swarm nodes. Containers on different physical hosts but connected to the same overlay network can communicate using container/service names as DNS hostnames (via Docker's built-in DNS). Overlay networks are built into Docker Swarm — no third-party plugin is needed (though plugins like Weave, Calico can replace the default). They require Swarm mode to be active and use ports 4789 (VXLAN) and 7946 (control plane).

Question 5

A Docker Swarm service is deployed with `--update-parallelism 2 --update-delay 30s`. The service has 10 replicas and needs to be updated. Which statement describes the update behavior?

Answer choices

  • A. All 10 replicas are updated simultaneously with a 30-second total timeout

  • B. Updates occur in batches of 2 replicas, with a 30-second pause between each batch — total minimum update time is ~150 seconds for 10 replicas (5 batches × 30s) (Correct)

  • C. 2 replicas are updated per minute (30-second delay means 2 per minute)

  • D. The update pauses after each batch until manual confirmation via `docker service update --continue`

Explanation

`--update-parallelism 2` means 2 replicas are updated simultaneously in each batch. `--update-delay 30s` is the delay BETWEEN batches (not within). For 10 replicas: batch 1 (replicas 1-2) → 30s pause → batch 2 (replicas 3-4) → 30s pause → ... → batch 5 (replicas 9-10). Minimum total: 5 batches × 30s delay = ~150 seconds (plus actual update time for each replica). `--update-order` controls whether new replicas start before old ones stop (`start-first`) or after (`stop-first`, default).