Free Docker DCA Practice Exam with Questions & Answers | Set: 3

The set of commands docker container inspect and docker port cannot identify the published port(s) for a container. The docker container inspect command returns low-level information on a container, such as its ID, name, state, network settings, mounts, etc1. However, it does not show the port mappings between the container and the host2. The docker port command lists the port mappings or a specific mapping for a container, but it requires the container name or ID as an argument3. Therefore, to identify the published port(s) for a container, you need to use both commands together, such as docker port $(docker container inspect -f '{{.Name}}' CONTAINER)4. References:

• docker container inspect | Docker Docs
• How to inspect a running Docker container - Stack Overflow
• docker port | Docker Docs
• List port for Docker container using command line - Stack Overflow

The statement is not correct. A Dockerfile does not store the Docker daemon’s configuration options. A Dockerfile is a text document that contains all the commands a user could call on the command line to assemble an image1. A Dockerfile is used to build images, not to configure the Docker daemon. The Docker daemon’s configuration options are stored in a JSON file, which is usually located at /etc/docker/daemon.json on Linux systems, or C:\ProgramData\docker\config\daemon.json on Windows2. The JSON file allows you to customize the Docker daemon’s behavior, such as enabling debug mode, setting TLS certificates, or changing the data directory2. References: Dockerfile reference), Docker daemon configuration overview)

The user namespace is a Linux kernel namespace that is disabled by default and must be enabled at Docker engine runtime to be used. The user namespace allows the host system to map its own uid and gid to some different uid and gid for containers’ processes. This improves the security of Docker by isolating the user and group ID number spaces, so that a process’s user and group ID can be different inside and outside of a user namespace1. To enable the user namespace, the daemon must start with --userns-remap flag with a parameter that specifies base uid/gid2. All containers are run with the same mapping range according to /etc/subuid and /etc/subgid3. References:

• Isolate containers with a user namespace
• Using User Namespaces on Docker
• Docker 1.10 Security Features, Part 3: User Namespace

= Simultaneously creating and tagging multiple images is not an advantage of multi-stage builds. Multi-stage builds are a feature that allows you to use multiple FROM statements in your Dockerfile, each starting a new stage of the build1. You can selectively copy artifacts from one stage to another, leaving behind everything you don’t want in the final image. This helps you to optimize the size and security of your images, as well as to simplify your build process12. However, multi-stage builds do not create or tag multiple images at once. Each Dockerfile produces one final image, which is the result of the last stage in the Dockerfile1. If you want to create and tag multiple images from a single Dockerfile, you need to use the --target option with the docker build command, and specify the name of the stage you want to build and tag3. References:

• Multi-stage builds | Docker Docs
• What Are Multi-Stage Docker Builds? - How-To Geek
• Stop at a specific build stage | Docker Docs

 Running docker engine activate will upgrade Docker Engine CE to Docker Engine EE. This is a feature that allows you to switch from the Community Edition to the Enterprise Edition without reinstalling Docker or losing any data. You need to have a valid license file and a subscription to Docker EE to use this feature1. Docker EE is a premium version of Docker CE that offers additional features, such as security scanning, image management, and certified plugins23. References:

• Upgrade Docker Engine | Docker Docs
• What is the exact difference between Docker EE (Enterprise Edition), Docker CE (Community Edition) and Docker (Custom Support) - Stack Overflow
• Docker Community Edition or Docker Enterprise Edition - Docker | BoxBoat

 Control Groups (cgroups) are a Linux kernel feature that allow you to limit, modify, or allocate resources as needed1. Docker uses cgroups to isolate the resources used by containers, such as CPU, memory, disk I/O, network, etc2. This means that each container can have its own set of resource limits and constraints, and that the containers cannot interfere with each other or with the host system2. This improves the security, performance, and reliability of the containers and the system as a whole. References:

• Lab: Control Groups (cgroups) | dockerlabs
• Docker run reference | Docker Docs

A Kubernetes node is allocated a /26 CIDR block (64 unique IPs) for its address space. This means that the node can assign up to 64 IP addresses to its resources, such as pods and containers. If every pod on this node has exactly two containers in it, then each pod will need two IP addresses, one for each container. Therefore, the node can support up to 32 pods, since 64 / 2 = 32. The other options are incorrect because they either exceed the available IP addresses or do not account for the number of containers per pod. References:

•CIDR Blocks and Container Engine for Kubernetes - Oracle

•How kubernetes assigns podCIDR for nodes? - Stack Overflow

 Network is a type of Linux kernel namespace that provides container isolation. Network namespaces isolate the system resources associated with networking, such as network interfaces, IP addresses, routing tables, firewall rules, etc. Each network namespace has its own virtual network stack, and processes in different network namespaces can communicate through virtual network devices or tunnels1. Network namespaces are used by Docker to create isolated networks for containers, and allow users to customize the network configuration and connectivity of each container2. References:

• network_namespaces(7) - Linux manual page
• Docker network overview | Docker Documentation

 x.500 is not a supported user authentication method for Universal Control Plane (UCP). UCP supports two types of user authentication methods: built-in and external1. Built-in authentication uses the UCP’s own database to store and verify user credentials. External authentication uses an external LDAP or Active Directory service to manage user accounts and passwords1. x.500 is a standard for directory services, which can be used by LDAP or Active Directory, but it is not a user authentication method by itself2. References:

• User authentication | Docker Docs
• X.500 - Wikipedia

 Capabilities are a Linux kernel feature that allows processes to perform some privileged operations without having the full power of the root user1. Docker uses capabilities to limit the access of containers to host resources, such as CPU or memory2. By default, Docker drops all capabilities except those needed for the container to function properly, using a whitelist approach3. This reduces the risk of a container compromising the host system or other containers. You can also add or remove capabilities to or from a container at runtime, using the --cap-add or --cap-drop options of the docker run command4. This gives you more control over the security and functionality of your containers. References:

• Capabilities | dockerlabs
• Docker run reference | Docker Docs
• Docker Capabilities and no-new-privileges
• Runtime privilege and Linux capabilities | Docker Docs