Pass the Docker Certified Associate DCA Questions and answers with ValidTests

 A liveness probe is a mechanism for indicating your application’s internal health to the Kubernetes control plane. Kubernetes uses liveness probes to detect issues within your pods. When a liveness check fails, Kubernetes restarts the container in an attempt to restore your service to an operational state1. Therefore, the action taken by the orchestrator to fix the unhealthy container is to restart it. References:

Content trust in Docker | Docker Docs

Docker Content Trust: What It Is and How It Secures Container Images

A Practical Guide to Kubernetes Liveness Probes | Airplane

The command docker Is -a does not list all nodes in a swarm cluster from the command line, but rather lists all containers, both running and stopped, on the current node1. To list all nodes in a swarm cluster, you need to use the command docker node ls from a manager node2. This command shows the node ID, hostname, status, availability, and manager status for each nodein the swarm2. You can also use the --filter option to filter the output based on various criteria2. References: Docker Documentation, docker node ls

= The conditions are sufficient for Kubernetes to dynamically provision a persistentVolume, because they include a default storageClass and a persistentVolumeClaim. A storageClass defines which provisioner should be used and what parameters should be passed to that provisioner when dynamic provisioning is invoked. A persistentVolumeClaim requests a specific size, access mode, and storageClass for the persistentVolume. If a persistentVolume that satisfies the claim exists or can be provisioned, the persistentVolumeClaim is bound to that persistentVolume. A default storageClass means that any persistentVolumeClaim that does not specify a storageClass will use the default one. Therefore, the conditions in the question are enough to enable dynamic provisioning of storage volumes on-demand. References:

Dynamic Volume Provisioning | Kubernetes

Persistent volumes and dynamic provisioning | Google Kubernetes Engine …

Docker Content Trust (DCT) is a feature that allows users to verify the integrity and publisher of container images they pull or deploy from a registry server, signed on a Notaryserver1. DCT is enabled by setting the environment variable DOCKER_CONTENT_TRUST=1 on the Docker client. When DCT is enabled, the Docker client will only pull, run, or build images that have valid signatures for a specific tag2. However, DCT does not apply to the docker image import command, which allows users to import an image or a tarball with a repository and tag from a file or STDIN3. Therefore, if myorg/myimage:1.0 is unsigned, Docker will not block the docker image import myorg/myimage:1.0 command, even if DCT is enabled. This is because the docker image import command does not interact with a registry or a Notary server, and thus does not perform any signature verification. However, this also means that the imported image will not have any trust data associated with it, and it will not be possible to push it to a registry with DCT enabled, unless it is signed with a valid key. References:

Content trust in Docker

Automation with content trust

[docker image import]

[Content trust and image tags]

= Scanning images to detect any security vulnerability is a function of UCP. UCP integrates with Docker Trusted Registry (DTR), which is a secure and scalable image storage solution1. DTR has a built-in image scanning feature that checks every layer of every image for known vulnerabilities and displays the results in the UCP web UI2. This helps users to identify and fix any security issues before deploying their applications. UCP also allows users to enforce security policies and only allow running applications that use images that are scanned and free of vulnerabilities3. References:

Docker Trusted Registry | Docker Docs

Scan images for vulnerabilities | Docker Docs

Manage images | Docker Docs

 Deleting the image and the image repository from Docker Trusted Registry will not completely delete the image from disk. This is because deleting a repository or a tag only removes the reference to the image, but not the image itself. The image is still stored as a blob on the disk, and can be accessed by its digest1. To completely delete the image from disk, you need to enable the deletion feature in the registry configuration, and then use the API to delete the image by its manifest2. Alternatively, you can manually delete the image files from the registry storage directory, but this is not recommended3. After deleting the image, you also need to run the garbage collector to reclaim the disk space4. References:

Docker Registry HTTP API V2

How to delete images from a private docker registry?

Remove docker image in registry by removing files/folders on server

Garbage collection

= The command docker logs  will not configure a Docker container to export container logs to the logging solution, such as Splunk. This command only displays the logs of a specific container in the standard output or a file, but does not send them to any external system1. To export container logs to Splunk, you need to use the Docker Logger Drivers, which are plugins that provide logging capabilities for Docker containers2. The Splunk logging driver sends container logs to HTTP Event Collector in Splunk Enterprise and Splunk Cloud3. To use the Splunk logging driver for a specific container, you need to use the command-line flags --log-driver and --log-opt with docker run, and provide the Splunk token and URL as options3. For example:

$ docker run --log-driver=splunk --log-opt splunk-token=VALUE --log-opt splunk-url=VALUE ...

docker logs | Docker Documentation

Logging drivers | Docker Documentation

Splunk logging driver | Docker Documentation

The statement is not correct. A Dockerfile does not store the Docker daemon’s configuration options. A Dockerfile is a text document that contains all the commands a user could call on the command line to assemble an image1. A Dockerfile is used to build images, not to configure the Docker daemon. The Docker daemon’s configuration options are stored in a JSON file, which is usually located at /etc/docker/daemon.json on Linux systems, or C:\ProgramData\docker\config\daemon.json on Windows2. The JSON file allows you to customize the Docker daemon’s behavior, such as enabling debug mode, setting TLS certificates, or changing the data directory2. References: Dockerfile reference), Docker daemon configuration overview)

= Setting INSECURE_REGISTRY in the /etc/docker/default configuration file is one way to configure the Docker engine to use a registry without a trusted TLS certificate. This option tells the Docker daemon to accept insecure connections to the specified registry, bypassing the certificate verification1. However, this method is not recommended, as it exposes the registry and the Docker engine to potential security risks2. A better way to use a registry without a trusted TLS certificate is to add the registry’s CA certificate to the Docker daemon’s trust store, as described in the Docker documentation3 or other online guides4. References:

1: How to build docker registry without SSL

2: Verify repository client with certificates | Docker Docs

3: “docker pull” certificate signed by unknown authority

4: Login to docker registry with client certificate under windows

= The ‘docker inspect’ command returns low-level information on Docker objects, such as containers, images, networks, etc1 It does not show the list of historical tasks for a service. To view the list of tasks for a service, you need to use the ‘docker service ps’ command 2. For example, to see the tasks for the ‘http’ service, you would run ‘docker service ps http’. This would show the ID, name, image, node, desired state, current state, and error of each task 2. References: Docker inspect | Docker Docs, Docker service ps | Docker Docs