I85PREP
⌘ K
BR-ANAC-DOV-MOD-1 study materials
BR-ANAC-DOV-MOD-1 study resources

BR-ANAC-DOV-MOD-1 practice questions

One question at a time. Build your BR-ANAC-DOV-MOD-1 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Orchestration

In Docker, which component is responsible for pulling images and managing the lifecycle of containers on a single host?

  1. The image registry
  2. The containerd shim
  3. The Docker daemon Correct answer.
  4. The Docker CLI

Explanation

The Docker daemon (dockerd) runs on the host and performs the core work of pulling images, creating containers, and managing their lifecycle. The CLI only sends requests to the daemon through the API, and a registry merely stores and serves images.

Question 2Orchestration

Which Docker network driver provides container-to-container communication on a single host while isolating containers from the outside network by default?

  1. macvlan
  2. host
  3. bridge Correct answer.
  4. overlay

Explanation

The bridge driver creates a private internal network on the host and gives containers connectivity to each other while requiring explicit port publishing for external access. The host driver removes network isolation, overlay spans multiple hosts, and macvlan assigns MAC addresses for direct L2 access.

Question 3Orchestration

Which instruction in a Dockerfile is used to declare that a container listens on a specific port at runtime?

  1. BIND
  2. PUBLISH
  3. EXPOSE Correct answer.
  4. LISTEN

Explanation

EXPOSE documents the port the containerized process listens on and is metadata used by tooling. It does not actually publish the port to the host; that requires the -p flag or a compose ports mapping.

Question 4Orchestration

What is the primary purpose of a Docker volume?

  1. To encrypt traffic between containers
  2. To persist data independently of a container's lifecycle Correct answer.
  3. To restrict CPU usage of a container
  4. To speed up image layer downloads

Explanation

Volumes are managed storage areas that outlive individual containers, so data survives container removal and can be shared. They are not related to image transfer speed, network encryption, or CPU limits.

Question 5Orchestration

In Docker Compose, which top-level key defines the services that make up the application?

  1. volumes
  2. secrets
  3. networks
  4. services Correct answer.

Explanation

The services key is where each containerized component is declared, including its image, ports, and dependencies. The volumes, networks, and secrets keys define shared resources rather than the application components themselves.

Question 6Orchestration

Which command builds an image from a Dockerfile in the current directory and tags it as myapp:1.0?

  1. docker build -t myapp:1.0 . Correct answer.
  2. docker run -t myapp:1.0 .
  3. docker commit -t myapp:1.0 .
  4. docker create -t myapp:1.0 .

Explanation

docker build reads the Dockerfile in the given context and the -t flag assigns a repository name and tag. The run and create commands start or prepare containers, and commit snapshots an existing container.

Question 7Orchestration

What does the ENTRYPOINT instruction define in a Docker image?

  1. The working directory for subsequent instructions
  2. The user account the container process runs as
  3. The command executed when the container starts and that receives CMD as arguments Correct answer.
  4. The health check command run periodically

Explanation

ENTRYPOINT sets the executable that runs when the container starts, and any CMD values are appended as default arguments. The user, working directory, and health check are configured by USER, WORKDIR, and HEALTHCHECK respectively.

Question 8Orchestration

Which Docker object is the template from which containers are created?

  1. A volume
  2. An image Correct answer.
  3. A bind mount
  4. A network

Explanation

An image is a read-only template containing the filesystem and metadata used to instantiate containers. Volumes, networks, and bind mounts are runtime resources attached to containers, not templates.

Question 9Orchestration

A team wants a container to automatically restart whenever it exits with a non-zero code, but not when it is stopped manually. Which restart policy should they use?

  1. on-failure Correct answer.
  2. always
  3. no
  4. unless-stopped

Explanation

The on-failure policy restarts a container only when it exits with a non-zero status, which matches the requirement. The always and unless-stopped policies also restart after clean exits, and no disables restarts entirely.

Question 10Orchestration

A developer needs to copy application source into an image while excluding node_modules and local log files. Which mechanism should be used?

  1. A .dockerignore file in the build context Correct answer.
  2. A VOLUME declaration in the Dockerfile
  3. A RUN rm command after the COPY
  4. An ENV variable listing excluded paths

Explanation

A .dockerignore file excludes matching paths from the build context so they are never sent to the daemon or copied into the image. Deleting files after COPY still transfers them in an earlier layer, and VOLUME or ENV do not filter build context contents.

Question 11Orchestration

Why does placing frequently changing COPY instructions after dependency installation steps improve build performance?

  1. It forces the daemon to rebuild all layers from scratch
  2. It allows Docker to reuse cached layers for unchanged dependencies Correct answer.
  3. It compresses the final image more aggressively
  4. It encrypts the dependency layers for security

Explanation

Docker caches each layer and invalidates the cache from the first changed instruction onward. Keeping stable dependency installation earlier means source changes only rebuild later layers, reusing cached dependency layers.

Question 12Orchestration

A container needs to read a configuration value at runtime without baking it into the image. Which approach best supports this?

  1. Add the value as a LABEL in the image
  2. Hardcode the value in the Dockerfile with ENV
  3. Pass the value at runtime using environment variables or a mounted config file Correct answer.
  4. Include the value in the image tag name

Explanation

Runtime environment variables or mounted configuration files let the same image run in different environments without rebuilding. Baking values into the image, labels, or tag names ties configuration to a specific build artifact.

Question 13Orchestration

Two containers must communicate over a user-defined bridge network by container name. What must be true for name resolution to work?

  1. Both containers must be attached to the same user-defined network Correct answer.
  2. Both containers must share a volume
  3. Both containers must run with --network host
  4. Both containers must publish the same host port

Explanation

User-defined bridge networks include an embedded DNS server that resolves container names, but only for containers attached to that same network. Publishing ports, host networking, or shared volumes do not provide name-based resolution.

Question 14Orchestration

What is the effect of a multi-stage Docker build?

  1. It duplicates the final image for redundancy
  2. It runs the application in several containers simultaneously
  3. It builds the image on multiple hosts in parallel
  4. It separates build dependencies from the final runtime image to reduce size Correct answer.

Explanation

Multi-stage builds use multiple FROM stages so compilers and build tools can be discarded, copying only artifacts into a slim final stage. This reduces image size and attack surface rather than running multiple containers or parallel hosts.

Question 15Orchestration

Which command shows the log output of a running container named web?

  1. docker inspect web
  2. docker top web
  3. docker logs web Correct answer.
  4. docker stats web

Explanation

docker logs retrieves the stdout and stderr output captured from a container. The inspect, stats, and top commands return configuration, resource usage, and process listings respectively.

Question 16Orchestration

A container exits immediately after starting, and the image defines CMD ["nginx", "-g", "daemon off;"]. Which investigation step is most direct?

  1. Rebuild the image with a new base
  2. Run docker logs on the container to read its error output Correct answer.
  3. Change the restart policy to always
  4. Increase the container memory limit

Explanation

When a container exits quickly, its captured stdout and stderr usually reveal the startup failure, so reading logs is the most direct diagnostic. Resource changes, restart policies, or base image changes address symptoms without identifying the cause.

Question 17Orchestration

In Docker Compose, which key ensures that a service starts only after another service has started?

  1. depends_on Correct answer.
  2. links
  3. profiles
  4. extends

Explanation

depends_on expresses startup ordering between services so the dependent service starts after its dependency. It does not wait for readiness unless a health condition is specified, and links, extends, and profiles serve other purposes.

Question 18Orchestration

Which statement best describes the relationship between an image layer and a running container's writable layer?

  1. The writable layer is unique per container and discarded when the container is removed Correct answer.
  2. The writable layer replaces all read-only layers at runtime
  3. The writable layer is stored inside the image and persists after removal
  4. The writable layer is shared by all containers from the same image

Explanation

Each container gets its own thin writable layer on top of the shared read-only image layers. That writable layer is destroyed with the container unless data is stored in a volume, and it never modifies the underlying image.

Question 19Orchestration

Which Dockerfile instruction reduces the number of image layers by combining multiple shell commands into one?

  1. CMD with a shell string
  2. ADD with multiple sources
  3. RUN with commands joined by && Correct answer.
  4. Multiple separate RUN lines

Explanation

Each RUN instruction creates a layer, so chaining commands with && in a single RUN produces one layer. Separate RUN lines create multiple layers, and CMD or ADD do not consolidate shell steps.

Question 20Orchestration

A service in a Compose file must read a sensitive password without storing it in the image or in the compose file in plaintext. Which Compose feature is designed for this?

  1. A top-level secrets definition mounted into the service Correct answer.
  2. A published port for a password server
  3. A bind mount of the host's entire home directory
  4. An environment variable written directly in the compose file

Explanation

Compose secrets let sensitive data be provided to services at runtime from files or external stores without embedding them in the image or compose file. Plaintext environment variables, broad host mounts, and network services expose the value more widely.

Question 21Orchestration

Which command removes all stopped containers, unused networks, and dangling images in one step?

  1. docker image purge
  2. docker prune --all
  3. docker system prune Correct answer.
  4. docker container clean

Explanation

docker system prune removes stopped containers, unused networks, and dangling images, and can include unused volumes with additional flags. The other forms are not valid Docker commands.

Question 22Orchestration

An application container needs a stable hostname and a fixed IP on a user-defined network so a legacy client can reach it by address. Which approach satisfies this?

  1. Attach the container to the default bridge without options
  2. Create a user-defined network with a defined subnet and assign a static IP via --ip Correct answer.
  3. Use --network host and rely on the host IP
  4. Publish the container port to a random host port

Explanation

Static addressing requires a user-defined network whose subnet is known, after which --ip assigns a fixed address and the container name provides a stable hostname. Host networking, random port publishing, and the default bridge do not provide a controllable fixed container IP.

Question 23Orchestration

A build fails with a permission error when a non-root USER runs a step that writes to an application directory. What is the most correct fix?

  1. Add --privileged to the build command
  2. Disable the USER instruction and rely on the default
  3. Switch the final stage to run as root permanently
  4. Create the directory and set ownership with chown before switching USER Correct answer.

Explanation

Files created by earlier root-owned steps keep root ownership, so the directory must be created or chowned to the runtime user before USER takes effect. Running as root, using privileged mode, or dropping USER weakens security and does not address ownership properly.

Question 24Orchestration

Two Compose services both bind host port 8080, and one fails to start. What is the underlying cause?

  1. The services use the same environment variable name
  2. Only one process can bind a given host port at a time Correct answer.
  3. The two services are on different networks
  4. The images share the same base layer

Explanation

Host ports are a single shared namespace, so only one process can listen on a given address and port at once. Different networks, shared base layers, or duplicate variable names do not cause a port binding conflict.

Question 25Orchestration

A team wants reproducible builds where the same Dockerfile yields identical dependency versions over time. Which practice best supports this?

  1. Use the latest tag for all base and dependency images
  2. Disable layer caching with --no-cache for every build
  3. Pin base image digests and dependency versions explicitly Correct answer.
  4. Rely on the build cache being empty on every host

Explanation

Pinning image digests and explicit dependency versions removes ambiguity about what gets built, producing reproducible results. Using latest tags introduces drift, and disabling cache affects speed rather than version determinism.

Question 26Orchestration

Which Dockerfile instruction sets the working directory for subsequent instructions such as RUN and CMD?

  1. WORKDIR Correct answer.
  2. ENV
  3. LABEL
  4. VOLUME

Explanation

WORKDIR changes the current directory inside the image for all instructions that follow it, and it creates the directory if it does not already exist. ENV sets environment variables, VOLUME declares a mount point, and LABEL attaches metadata, so none of them affect the working path.

Question 27Orchestration

Which command lists only the containers that are currently running?

  1. docker images
  2. docker ps Correct answer.
  3. docker network ls
  4. docker volume ls

Explanation

docker ps shows running containers by default, and adding the -a flag includes stopped ones. The other commands enumerate images, volumes, and networks rather than container state.

Question 28Orchestration

What is the purpose of the EXPOSE instruction in a Dockerfile?

  1. To publish the port to the host automatically
  2. To reserve the port so other containers cannot bind it
  3. To open a firewall rule on the host
  4. To document the port the container intends to listen on Correct answer.

Explanation

EXPOSE records intended listening ports as image metadata so tools and readers know what the application uses. It does not publish anything on the host; publishing requires the -p flag or the ports key in Compose.

Question 29Orchestration

Which command stops a running container named api and then deletes it in a single step?

  1. docker stop api
  2. docker pause api
  3. docker kill api
  4. docker rm -f api Correct answer.

Explanation

docker rm -f forces removal, which stops the container if it is running and then deletes it. docker stop only halts the process, docker kill sends a signal without removing anything, and docker pause freezes the process.

Question 30Orchestration

Which file format does Docker Compose use by default for its service definitions?

  1. INI
  2. XML
  3. YAML Correct answer.
  4. TOML

Explanation

Compose reads a YAML file, conventionally named compose.yaml or docker-compose.yml, that declares services, networks, and volumes. The other formats are not parsed by the Compose CLI.

Question 31Orchestration

What does the docker pull command do?

  1. Rebuilds an image from its Dockerfile
  2. Creates a new container from an image
  3. Uploads a local image to a registry
  4. Downloads an image from a registry to the local image store Correct answer.

Explanation

docker pull fetches the requested image layers from a registry and stores them locally so they can be run. Uploading is done with docker push, while container creation and image builds are separate commands.

Question 32Orchestration

Which instruction in a Dockerfile specifies the base image that later instructions build upon?

  1. ADD
  2. FROM Correct answer.
  3. SHELL
  4. RUN

Explanation

FROM begins each build stage and names the parent image whose filesystem and configuration the stage inherits. RUN executes commands during the build, ADD copies files, and SHELL changes the shell used for shell-form instructions.

Question 33Orchestration

Which command starts an interactive shell inside an already running container named dbg?

  1. docker run -it dbg sh
  2. docker attach dbg sh
  3. docker exec -it dbg sh Correct answer.
  4. docker start -it dbg sh

Explanation

docker exec launches an additional process in a container that is already running, and -it allocates a TTY so the shell is interactive. docker run would create a brand-new container instead of entering the existing one.

Question 34Orchestration

A developer wants the build to fail early if the application directory is missing, before any dependencies are installed. Which Dockerfile technique achieves this?

  1. Set an ENV variable pointing to the directory
  2. Declare the directory with a VOLUME instruction
  3. Add a RUN echo statement that prints the directory path
  4. Copy the application directory in an early COPY step so a missing source aborts the build Correct answer.

Explanation

A COPY instruction fails the build when its source path does not exist, so placing it before dependency installation surfaces the problem immediately. Echo, VOLUME, and ENV do not validate that the source tree is present.

Question 35Orchestration

A team needs to pass a build-time value, such as a version string, into the image without leaving it as a runtime environment variable. Which pair of features should they use?

  1. ENV in the Dockerfile and -e on docker run
  2. LABEL in the Dockerfile and --label on docker build
  3. VOLUME in the Dockerfile and -v on docker run
  4. ARG in the Dockerfile and --build-arg on docker build Correct answer.

Explanation

ARG declares a variable that is only available during the build, and --build-arg supplies its value when docker build runs. ENV values persist into the running container, while LABEL and VOLUME do not carry build-time parameters.

Question 36Orchestration

An application image must run as a non-root user for security. Which Dockerfile sequence correctly creates the user and switches to it?

  1. USER appuser then RUN adduser --system appuser
  2. ENV USER appuser then RUN chmod 777 /
  3. LABEL user=appuser then CMD ["appuser"]
  4. RUN adduser --system appuser then USER appuser Correct answer.

Explanation

The user account must exist before USER switches to it, so the account is created with RUN first and USER follows. Switching before creation fails because the account is not yet defined in the image.

Question 37Orchestration

A service in a Compose file should receive its database password from the host environment at deploy time. Which Compose key accomplishes this?

  1. restart with a policy value
  2. depends_on with a condition
  3. build with an arg list
  4. environment with a value referencing a host variable Correct answer.

Explanation

The environment key can map a variable to a host value such as ${DB_PASSWORD}, so the secret is injected at runtime rather than baked into the image. build, depends_on, and restart control build behavior, startup order, and restart policy respectively.

Question 38Orchestration

What does the docker network create command with the bridge driver produce?

  1. A macvlan network that assigns host MAC addresses
  2. A user-defined bridge network that containers can join for isolated communication Correct answer.
  3. A host network that shares the host's network stack
  4. An overlay network spanning multiple hosts

Explanation

Creating a network with the bridge driver yields a user-defined bridge that provides isolation and built-in DNS resolution between attached containers. Host, overlay, and macvlan drivers are selected explicitly and serve different purposes.

Question 39Orchestration

A developer wants a named volume called data to be mounted at /var/lib/app in a container. Which run flag achieves this?

  1. -v data:/var/lib/app Correct answer.
  2. -p data:/var/lib/app
  3. --mount type=bind,source=data,target=/var/lib/app
  4. -v /var/lib/app

Explanation

The -v flag with a volume name followed by a container path mounts the named volume at that path. A single path creates an anonymous volume, and the bind form requires an absolute host path rather than a volume name.

Question 40Orchestration

A containerized service must always run on a specific host port so an external load balancer can reach it. Which docker run flag publishes container port 3000 to host port 8080?

  1. -p 3000:8080
  2. -p 8080:3000 Correct answer.
  3. --expose 8080:3000
  4. -e 8080:3000

Explanation

The syntax for -p is hostPort:containerPort, so -p 8080:3000 maps host port 8080 to container port 3000. Reversing the order maps the wrong ports, and the other flags do not publish ports at all.

Question 41Orchestration

A team uses docker compose up and later changes the image tag for one service. Which command rebuilds and recreates only the affected service?

  1. docker compose logs <service>
  2. docker compose down
  3. docker compose ps <service>
  4. docker compose up -d --build <service> Correct answer.

Explanation

docker compose up with --build rebuilds images and recreates the named service with the new configuration. The ps and logs subcommands only report state, and down tears down the whole project.

Question 42Orchestration

Which instruction copies a local tar archive into an image and extracts its contents automatically?

  1. ADD Correct answer.
  2. VOLUME
  3. COPY
  4. RUN cp

Explanation

ADD recognizes local tar archives and extracts them into the destination, while COPY transfers files verbatim. Because extraction is implicit, many teams prefer COPY unless archive handling is actually wanted.

Question 43Orchestration

A developer wants to run a one-off maintenance command in a fresh container from image tools:latest and have the container removed automatically when it exits. Which command fits?

  1. docker run --rm tools:latest maintenance-task Correct answer.
  2. docker create --rm tools:latest maintenance-task
  3. docker exec --rm tools:latest maintenance-task
  4. docker run -d tools:latest maintenance-task

Explanation

docker run starts a new container from the image, and --rm deletes it once the process exits. docker exec targets an existing container, and -d detaches without removing anything.

Question 44Orchestration

Which command displays the layers and size of each instruction that produced an image?

  1. docker inspect myimage:1.0
  2. docker stats myimage:1.0
  3. docker diff myimage:1.0
  4. docker history myimage:1.0 Correct answer.

Explanation

docker history lists the instructions that built the image along with the size contributed by each layer. inspect returns full JSON metadata, diff compares a container's filesystem, and stats reports live resource usage.

Question 45Orchestration

A developer needs to see the environment variables and entrypoint that an image will use at runtime. Which command shows this metadata?

  1. docker inspect myimage:1.0 Correct answer.
  2. docker export myimage:1.0
  3. docker top myimage:1.0
  4. docker logs myimage:1.0

Explanation

docker inspect returns the image configuration, including environment variables, entrypoint, and command. logs and top operate on running containers, and export writes a filesystem archive.

Question 46Orchestration

A Compose project defines a custom network so that its services can resolve each other by service name. What must be true for this resolution to work?

  1. The services must run with the host network driver
  2. The services must share a single volume
  3. The services must be attached to the same user-defined network Correct answer.
  4. The services must publish the same host port

Explanation

Docker's embedded DNS resolves service and container names only among containers attached to the same user-defined network. Port publishing, the host driver, and shared volumes do not provide name resolution.

Question 47Orchestration

A build cache is being invalidated on every run even though source files have not changed. Which change most likely restores effective caching?

  1. Copy dependency manifests and install dependencies before copying the full source tree Correct answer.
  2. Combine all instructions into a single RUN command
  3. Add a LABEL with a random value to each build
  4. Move the FROM instruction to the end of the Dockerfile

Explanation

Each instruction invalidates the cache for itself and everything after it, so copying only manifests first lets the dependency layer stay cached when source changes. Reordering FROM or adding random labels would break caching further.

Question 48Orchestration

Two containers on the same user-defined bridge network cannot reach each other by name, although both are running. Which cause is most plausible?

  1. One container was started with the legacy default bridge network instead of the shared user-defined network Correct answer.
  2. Both containers mount the same named volume
  3. Both containers use the same base image
  4. Both containers publish different host ports

Explanation

Name resolution through embedded DNS works only for containers attached to the same user-defined network. A container left on the default bridge has no shared DNS scope with the others, regardless of ports, images, or volumes.

Question 49Orchestration

A team wants the same Compose file to work on developer laptops and in CI, where a bind mount path differs. Which approach keeps the file portable?

  1. Hard-code the absolute path used by the CI runner
  2. Reference an environment variable in the volume source and set it per environment Correct answer.
  3. Remove the volume so the path no longer matters
  4. Duplicate the Compose file with a different path in each copy

Explanation

Compose interpolates variables such as ${SRC_PATH} from the environment or an .env file, so one file can serve multiple environments. Hard-coding or duplicating files creates drift, and removing the volume changes application behavior.

Question 50Orchestration

A multi-stage build copies artifacts from a builder stage into a slim runtime stage. Why does the final image not contain the compilers installed in the builder stage?

  1. Docker deletes compiler packages after the build completes
  2. Only files explicitly copied from the builder stage are included in the final stage Correct answer.
  3. The runtime stage inherits the builder filesystem but hides it
  4. The builder stage is automatically squashed into the final stage

Explanation

Each stage starts from its own base image, and only artifacts referenced by COPY --from are carried into the final stage. The builder's filesystem is discarded, so compilers and build caches never reach the shipped image.