I85PREP
⌘ K
DCA study materials
DCA study resources

Docker Certified Associate (DCA) practice questions

One question at a time. Build your DCA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

In Docker Enterprise Edition, which component provides role-based access control and centralized management of users and teams across multiple Universal Control Plane clusters?

  1. Docker Engine swarm mode
  2. Universal Control Plane (UCP) Correct answer.
  3. Docker Trusted Registry
  4. Docker Compose

Explanation

UCP is the management plane of Docker Enterprise Edition. It exposes the web UI and API for RBAC, team and user management, and cluster administration across nodes. Swarm mode is the orchestration engine underneath, and DTR is the registry.

Question 2Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

Which Docker object is the fundamental unit of deployment in swarm mode and can declare replicas, networks, and secrets for a service?

  1. A Dockerfile
  2. A standalone container
  3. A service Correct answer.
  4. A volume

Explanation

A swarm service is the declarative unit of deployment; the swarm schedules tasks for it and reconciles toward the desired replica count. Standalone containers run on a single engine without this reconciliation. Volumes and Dockerfiles are build or storage artifacts, not deployed units.

Question 3Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

What is the primary purpose of Docker Trusted Registry (DTR) in a Docker Enterprise deployment?

  1. To terminate TLS for published swarm services
  2. To schedule containers across swarm nodes
  3. To store, sign, and scan container images with access control Correct answer.
  4. To build images from Dockerfiles on developer laptops

Explanation

DTR is the private registry component: it stores images, supports content trust signing, integrates image scanning, and enforces access control on repositories. Scheduling is done by the swarm, and building happens with the Engine or BuildKit. TLS termination for services is handled by routing mesh or external load balancers.

Question 4Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

A developer wants to run a single short-lived command in a new container and have it removed automatically when it exits. Which docker run flag accomplishes this?

  1. --detach
  2. --restart=always
  3. --privileged
  4. --rm Correct answer.

Explanation

The --rm flag tells the Engine to delete the container filesystem automatically after the process exits, which suits one-off commands. --detach runs in the background but leaves the container present. --restart=always does the opposite of cleanup, and --privileged only changes permissions.

Question 5Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

Which instruction in a Dockerfile copies files from the build context into the image while also supporting remote URLs and automatic extraction of local tar archives?

  1. RUN
  2. ADD Correct answer.
  3. VOLUME
  4. COPY

Explanation

ADD is the instruction that can fetch remote URLs and auto-extract recognized local tar archives in addition to copying from the build context. COPY only copies local context or stage files. VOLUME declares a mount point and RUN executes commands during the build.

Question 6Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

In Docker Enterprise, which feature lets an administrator enforce that only images signed by trusted publishers can be pulled and run?

  1. Content trust with DTR signing Correct answer.
  2. Docker Content Trust disabled by default
  3. UCP client bundles
  4. Swarm overlay encryption

Explanation

Content trust uses image signing so that only images signed by trusted keys can be pulled or run when enforcement is enabled. DTR stores the signatures and exposes signing policies. Overlay encryption protects network traffic, and client bundles only carry credentials.

Question 7Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

Which command lists the nodes participating in a swarm and shows their availability and manager status?

  1. docker info
  2. docker node ls Correct answer.
  3. docker swarm inspect
  4. docker service ps

Explanation

docker node ls lists swarm nodes with columns for availability, manager status, and engine version. docker service ps shows tasks of a service, docker swarm inspect shows swarm configuration, and docker info shows local engine details.

Question 8Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

What does a multi-stage Dockerfile primarily help accomplish?

  1. Enabling swarm mode on the build host
  2. Running multiple containers from one image
  3. Keeping the final image small by discarding build-time artifacts Correct answer.
  4. Publishing an image to multiple registries at once

Explanation

Multi-stage builds let you compile in one stage and copy only the needed artifacts into a later, smaller stage. The intermediate stages are discarded from the final image. They do not run multiple containers, publish to several registries, or enable swarm mode.

Question 9Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

An operator needs a service to be reachable on port 8080 of every swarm node, regardless of which node runs the task. Which mechanism provides this?

  1. Host-mode port publishing
  2. The swarm routing mesh Correct answer.
  3. A macvlan network
  4. An overlay network without published ports

Explanation

The routing mesh publishes a service port on every swarm node and forwards traffic to a task wherever it runs. Host-mode publishing binds only on nodes running the task. An overlay network without published ports is only reachable inside the swarm, and macvlan gives L2 access but not node-wide ingress.

Question 10Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

Which statement correctly describes the relationship between a swarm service, a task, and a container?

  1. A container owns multiple tasks that form a service
  2. Tasks and services are synonyms in swarm mode
  3. A task contains multiple services, each backed by one container
  4. A service defines desired state, tasks are scheduled units, and each task runs one container Correct answer.

Explanation

A service declares desired state such as replicas and image. The scheduler creates tasks, and each task corresponds to one container instance on a node. Services and tasks are distinct concepts, and containers do not own tasks.

Question 11Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

A container needs to read a credential at runtime without the secret appearing in the image or in docker inspect output. Which Docker Enterprise mechanism fits best?

  1. Swarm secrets mounted into the service Correct answer.
  2. Storing it in a bind-mounted plaintext file in the image
  3. Baking the credential into the image as an ENV instruction
  4. Passing it with docker run -e on the command line

Explanation

Swarm secrets are encrypted at rest in the raft log and delivered to tasks as in-memory files under /run/secrets, so they do not appear in image layers or docker inspect. ENV and -e values are visible in image metadata and container config, and a plaintext file in the image is also exposed.

Question 12Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

Which network driver should be used so that containers on different swarm nodes can communicate directly by service name?

  1. overlay Correct answer.
  2. none
  3. bridge
  4. host

Explanation

Overlay networks span multiple swarm nodes and provide service discovery by name through the embedded DNS. The bridge driver is scoped to a single engine, host removes network isolation on one node, and none disables networking entirely.

Question 13Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

In UCP, a user is a member of a team that has been granted the Restricted Control role on a collection. What does this role allow?

  1. Full administrative control of the entire cluster
  2. Read-only access to all collections
  3. Scheduling and managing services within that collection Correct answer.
  4. Managing only node labels and swarm configs

Explanation

The Restricted Control role grants the ability to deploy and manage services within the granted collection while limiting visibility to that scope. Full cluster administration is the admin role, read-only is View Only, and node or swarm configuration is reserved for higher-privilege roles.

Question 14Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

Which command creates a new swarm with the current node as the first manager?

  1. docker swarm init Correct answer.
  2. docker service create
  3. docker node promote
  4. docker swarm join

Explanation

docker swarm init initializes a new swarm and makes the current engine the first manager, printing join tokens. docker swarm join adds a node to an existing swarm, promote changes a worker to manager, and service create deploys a workload.

Question 15Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

A Dockerfile starts with FROM ubuntu:22.04 and later runs apt-get update in a separate RUN layer. Why can rebuilding later produce stale package indexes?

  1. apt-get update never writes to the image layer
  2. The base image tag is immutable and cannot change
  3. Docker always disables the cache for RUN instructions
  4. Each RUN layer is cached until its instruction text changes, so the cached apt-get update layer is reused Correct answer.

Explanation

Docker layer caching keys on the instruction and its inputs, so an unchanged RUN apt-get update line reuses the old cached layer even when remote repositories have moved on. Combining update and install in one RUN reduces this risk. The cache is not disabled automatically, and mutable tags can point to new content.

Question 16Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

What is the effect of the HEALTHCHECK instruction in a Dockerfile?

  1. It restarts the container whenever the check fails
  2. It blocks the container from starting until the check passes
  3. It records a command the Engine runs periodically to report container health Correct answer.
  4. It replaces the need for a restart policy

Explanation

HEALTHCHECK defines a probe the Engine runs inside the container and reports a health status; it does not restart or gate startup by itself. Restart policies act on process exit, not on health status, and swarm can be configured to act on unhealthy tasks separately.

Question 17Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

An image is pushed to DTR as registry.example.com/app/web:1.0. Which reference should a service use to guarantee it runs the exact signed digest rather than whatever the tag points to later?

  1. registry.example.com/app/web
  2. app/web:latest
  3. registry.example.com/app/web@sha256:<digest> Correct answer.
  4. registry.example.com/app/web:1.0

Explanation

Referencing an image by digest pins the exact content, so retagging cannot change what runs. A tag is a mutable pointer, latest is especially volatile, and a bare name defaults to latest. Digest references are also what content trust verification resolves to.

Question 18Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

Which statement about docker commit is accurate in a Docker Enterprise workflow?

  1. It is the recommended way to produce reproducible production images
  2. It automatically pushes the new image to DTR
  3. It captures container filesystem changes into a new image but records no build history or provenance Correct answer.
  4. It signs the resulting image with content trust

Explanation

docker commit snapshots a container's filesystem into a new image, but the result lacks Dockerfile history and is hard to reproduce or audit. Reproducible images come from Dockerfiles, and commit does not push or sign anything on its own.

Question 19Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

Which volume behavior is correct when a named volume is mounted over a directory that already contains files in the image?

  1. The container cannot start with a non-empty volume target
  2. The volume is populated with the image content on first use if the volume is empty Correct answer.
  3. The mount fails because the directory is not empty
  4. The image content always overwrites the volume

Explanation

When an empty named volume is first mounted onto a directory with existing image content, Docker copies that content into the volume. Subsequent mounts use the volume contents. The mount does not fail, and image content does not overwrite a volume that already holds data.

Question 20Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

A service is deployed with 3 replicas on a 3-node swarm, and one node goes down. What does the swarm manager do?

  1. It reduces the desired replica count to 2
  2. It converts the service to global mode automatically
  3. It reschedules the lost task onto a remaining healthy node Correct answer.
  4. It stops the whole service until the node returns

Explanation

The manager reconciles toward the declared desired state, so when a task is lost it schedules a replacement on an available node with capacity. The service definition is unchanged, global mode is not switched automatically, and the desired count stays at 3.

Question 21Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

In a Docker Enterprise deployment, what is the purpose of a UCP client bundle?

  1. It bundles the Docker Engine binaries for installation
  2. It packages TLS certificates and keys so the Docker CLI can authenticate to UCP and DTR Correct answer.
  3. It contains the swarm join tokens for new workers
  4. It stores the service definitions for backup

Explanation

A client bundle contains the user's certificates and keys plus environment setup so the CLI can securely reach UCP and DTR endpoints. It does not ship Engine binaries, expose join tokens, or hold service definitions; those are separate concerns.

Question 22Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

A Dockerfile uses FROM node:20 AS build, then FROM node:20-slim and COPY --from=build /app/dist /app/dist. What is the result?

  1. The COPY --from instruction is invalid without a named volume
  2. Only the final stage is shipped, containing the copied dist files on the slim base Correct answer.
  3. Both stages are merged into one image with all build dependencies
  4. The build stage is pushed to DTR as a separate image automatically

Explanation

Multi-stage builds keep only the final stage in the resulting image, so build tooling in the earlier stage is discarded. COPY --from pulls artifacts from a named earlier stage. Intermediate stages are not pushed automatically, and COPY --from is valid syntax.

Question 23Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

An administrator wants tasks for a service to run on every node, including nodes added later, for a logging agent. Which service configuration achieves this?

  1. a placement constraint pinning one node
  2. global mode Correct answer.
  3. replicated-job mode
  4. replicated mode with replicas equal to the current node count

Explanation

Global mode schedules exactly one task per node and automatically covers nodes that join later. Replicated mode with a fixed count does not track node membership, replicated-job is for batch completion, and a pinning constraint limits placement rather than spreading to all nodes.

Question 24Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

Content trust is enforced in a DTR repository, and a developer pulls an image tag that has never been signed. What happens?

  1. The pull is refused because the tag has no trusted signature Correct answer.
  2. The pull succeeds but only on manager nodes
  3. The image is pulled and signed automatically by the client
  4. The pull succeeds because tags are always trusted

Explanation

With content trust enforced, the client only accepts images whose tag resolves to a signature from a trusted key. An unsigned tag fails verification and the pull is refused. Signing is an explicit publisher action, and node role does not change trust evaluation.

Question 25Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

A team wants an overlay network where only services explicitly attached can communicate, and they want encryption of traffic between nodes. Which combination is correct?

  1. An overlay network created with --opt encrypted and services attached to it Correct answer.
  2. A bridge network with --opt encrypted
  3. The default ingress network with host publishing
  4. A macvlan network with swarm mode disabled

Explanation

Overlay networks scope communication to attached services, and the encrypted option enables IPsec for traffic between nodes on that network. Bridge networks are single-node, the ingress network handles published ports rather than private service scoping, and macvlan requires swarm-compatible configuration and does not provide this encryption.

Question 26Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

Which Docker object is the immutable, layered template from which containers are created at runtime?

  1. An image Correct answer.
  2. A volume
  3. A service
  4. A network

Explanation

An image is a read-only stack of layers that acts as the template for containers; starting a container adds a thin writable layer on top. Volumes, networks, and services are supporting objects but do not supply the filesystem template.

Question 27Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

Which command displays the layer history and the commands that produced each layer of a local image?

  1. docker diff
  2. docker inspect
  3. docker ps -a
  4. docker history Correct answer.

Explanation

docker history shows the image's layers along with the creating command, size, and layer ID. docker inspect returns full JSON metadata, while docker diff compares a container's filesystem to its image.

Question 28Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

What does the EXPOSE instruction in a Dockerfile actually do?

  1. Publishes the port on the host interface
  2. Documents the port and makes it available for publishing Correct answer.
  3. Opens the port in the host firewall automatically
  4. Creates a load balancer entry for the port

Explanation

EXPOSE is metadata: it records intended ports so that -P or service publishing can use them, but it does not bind anything on the host. Actual host exposure requires -p at run time or a published port on a service.

Question 29Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

Which command removes all stopped containers, unused networks, and dangling images in a single operation?

  1. docker system prune Correct answer.
  2. docker rmi --force
  3. docker rm --all
  4. docker container kill

Explanation

docker system prune cleans stopped containers, unused networks, dangling images, and build cache. It does not remove volumes unless --volumes is added, and it never touches running containers.

Question 30Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

Which storage mechanism is the recommended way to persist database files outside a container's writable layer?

  1. Storing data in an environment variable
  2. A bind mount of the container's overlay directory
  3. A named volume Correct answer.
  4. Writing to /tmp inside the container

Explanation

Named volumes are managed by Docker, survive container removal, and are the standard choice for persistent state such as databases. The writable layer and /tmp are tied to the container lifecycle and are lost when it is removed.

Question 31Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

Which instruction should be used to set an environment variable that is available to the running container process?

  1. RUN
  2. LABEL
  3. ARG
  4. ENV Correct answer.

Explanation

ENV sets environment variables that persist into the running container. ARG only supplies build-time values, LABEL adds metadata, and RUN executes a build step.

Question 32Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

What is the default network driver used when you run a container with docker run and no network is specified?

  1. host
  2. overlay
  3. macvlan
  4. bridge Correct answer.

Explanation

Docker attaches containers to the default bridge network unless another network is specified. The host driver removes network isolation, overlay spans multiple hosts, and macvlan assigns MAC addresses on the physical network.

Question 33Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

Which command copies a file from a running container to the local host filesystem?

  1. docker attach <container> ./file
  2. docker save <container> ./file
  3. docker cp <container>:/path/file ./file Correct answer.
  4. docker export <container> ./file

Explanation

docker cp transfers files between a container and the host in either direction. It works on running or stopped containers and does not require exporting the whole filesystem.

Question 34Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

A Dockerfile copies package.json and runs npm install before copying the rest of the source code. What is the main build benefit of this ordering?

  1. It prevents the build from needing network access
  2. It reduces the final image size by compressing node_modules
  3. It lets the dependency layer be reused from cache when only source files change Correct answer.
  4. It guarantees dependencies are installed at container start time

Explanation

Docker caches each layer keyed on its instruction and inputs. Copying manifests and installing dependencies first means source edits invalidate only later layers, so the expensive install layer is reused.

Question 35Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

A container exits immediately after starting. Which command is most useful for seeing the exit code and the output it produced before terminating?

  1. docker top <container>
  2. docker logs --tail 20 <container>
  3. docker ps
  4. docker inspect --format '{{.State.ExitCode}}' <container> Correct answer.

Explanation

docker inspect with the State.ExitCode template reports both the exit status and state details for a stopped container, complementing docker logs for the captured output. Together they reveal whether the process failed or simply completed.

Question 36Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

Which statement describes how a bind mount differs from a named volume?

  1. A bind mount is stored under Docker's managed directory and is portable across hosts
  2. A bind mount can only be used with swarm services
  3. A bind mount references a host path directly, so it depends on the host's directory layout Correct answer.
  4. A bind mount is deleted automatically when the container is removed

Explanation

Bind mounts map an explicit host path into the container, so the container depends on that path existing and containing the right data. Named volumes are managed by Docker and are more portable across environments.

Question 37Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

A developer needs to build an image for a different CPU architecture than the build host. Which mechanism enables this in modern Docker builds?

  1. Using docker buildx with a --platform flag and a suitable builder Correct answer.
  2. Setting the DOCKER_HOST variable to the target machine
  3. Adding ENV ARCH=arm64 to the Dockerfile
  4. Running docker commit after changing the host kernel

Explanation

Buildx with a multi-platform builder can target another architecture, optionally using emulation, and can also produce multi-arch manifests. DOCKER_HOST only redirects the client to a different daemon.

Question 38Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

In a Compose file, a service declares depends_on for a database service. What does this guarantee?

  1. The application waits until the database is ready to accept connections
  2. The database container is started before the application container Correct answer.
  3. The database port is published on the host automatically
  4. The database is restarted whenever the application restarts

Explanation

depends_on controls start order, not readiness; the application may still start before the database accepts connections. Health checks with a condition, or retry logic in the app, are needed for true readiness gating.

Question 39Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

Which instruction best reduces the number of layers and leftover package cache when installing system packages in a Dockerfile?

  1. RUN apt-get clean
  2. RUN apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/* Correct answer.
  3. RUN apt-get install -y curl
  4. RUN apt-get update

Explanation

Combining update, install, and cache removal in one RUN keeps them in a single layer, so the downloaded lists never persist in the final image. Splitting them across layers leaves the cache in an earlier layer that later deletion cannot shrink.

Question 40Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

What does the USER instruction change in a Dockerfile?

  1. The identity used to run subsequent build steps and the container's default process Correct answer.
  2. The account used by the Docker daemon to mount volumes
  3. The user allowed to pull the image from a registry
  4. The user who owns the image in the registry

Explanation

USER sets the identity for later RUN steps and for the container's default process at start. Running as a non-root user is a common hardening practice because it limits the impact of a compromised process.

Question 41Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

A container must resolve other containers by name on a user-defined bridge network. What makes this name resolution possible?

  1. The default bridge network's legacy link feature
  2. Static IP addresses assigned in the Dockerfile
  3. The embedded DNS server on user-defined networks Correct answer.
  4. The host's /etc/hosts file being edited automatically

Explanation

User-defined bridge networks include an embedded DNS server that resolves container names and network aliases. The default bridge lacks this and historically relied on deprecated links.

Question 42Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

Which practice most directly limits the blast radius if a process inside a container is compromised?

  1. Disabling the HEALTHCHECK instruction
  2. Using the latest tag for base images
  3. Running the container as a non-root user with a read-only root filesystem where possible Correct answer.
  4. Publishing all container ports to the host

Explanation

Dropping root privileges and making the root filesystem read-only reduce what an attacker can modify or access after a compromise. Port exposure and mutable base tags increase risk rather than contain it.

Question 43Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

A service is created with a bind mount to a host path, but tasks on other nodes fail to start. What is the most likely cause?

  1. The host path does not exist on every node where a task is scheduled Correct answer.
  2. Bind mounts require the host network driver
  3. The image does not support bind mounts
  4. The swarm manager blocks bind mounts by default

Explanation

Bind mounts reference paths on the node running the task, so each node must have the data at that path. Named volumes, or shared storage plugins, avoid this node-local dependency.

Question 44Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

Which command shows the resource usage statistics of running containers in a live-updating view?

  1. docker version
  2. docker events
  3. docker info
  4. docker stats Correct answer.

Explanation

docker stats streams CPU, memory, network, and block I/O usage for running containers. docker events reports daemon events, and info and version report configuration and versions.

Question 45Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

What is the purpose of a .dockerignore file?

  1. It excludes files from the build context sent to the daemon Correct answer.
  2. It hides files from the running container at start
  3. It prevents layers from being cached during the build
  4. It restricts which registries an image can be pushed to

Explanation

A .dockerignore file filters the build context, so large or sensitive files such as .git or node_modules are not sent to the daemon. A smaller context speeds builds and avoids leaking secrets into layers.

Question 46Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

An image built on a workstation runs locally but fails in the cluster with an exec format error. What is the most likely explanation?

  1. The image lacks a HEALTHCHECK instruction
  2. The image was built for a different CPU architecture than the cluster nodes Correct answer.
  3. The image tag was not signed with content trust
  4. The container was started without a volume

Explanation

An exec format error typically means the binary architecture does not match the host kernel's architecture, such as an arm64 image on amd64 nodes. Building with the correct --platform or using a multi-arch manifest resolves it.

Question 47Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

A Dockerfile uses a heredoc-style multi-line RUN and a COPY --chmod flag. Which build backend is required for these features?

  1. BuildKit, which is the default in current Docker versions Correct answer.
  2. The classic docker commit workflow
  3. The legacy builder with DOCKER_BUILDKIT=0
  4. The docker export pipeline

Explanation

Features such as COPY --chmod, heredocs, and cache mounts are provided by BuildKit, which is the default builder in current Docker releases. The legacy builder does not understand these syntax extensions.

Question 48Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

A container is started with --memory 512m and no swap limit. What does Docker enforce by default?

  1. Memory is capped at 512m and swap is disabled entirely
  2. Memory is unlimited because swap absorbs the excess
  3. Memory is capped at 512m and the container may use host swap without limit
  4. Memory is capped at 512m and swap is limited to an additional 512m by default Correct answer.

Explanation

When --memory is set without --memory-swap, Docker sets the total memory-plus-swap limit to twice the memory value, so the container can use an equal amount of swap. This behavior is documented and can be overridden explicitly.

Question 49Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

A multi-stage build copies artifacts from a build stage, but the final image still contains compilers. What is the most likely cause?

  1. The final stage declared a USER instruction
  2. The build used BuildKit
  3. The final stage used FROM scratch
  4. The COPY --from reference pointed at the wrong stage or copied the whole build directory Correct answer.

Explanation

Only artifacts explicitly copied from earlier stages appear in the final image. Copying a directory that includes toolchain output, or referencing the wrong stage, pulls unwanted files forward.

Question 50Docker container technologies (Docker Enterprise Edition platform, with Docker Community Edition familiarity)

Which combination correctly describes how a container's writable layer and a mounted volume interact for data durability?

  1. Both the writable layer and named volumes persist indefinitely regardless of removal commands
  2. Both the writable layer and named volumes are deleted together when the container stops
  3. Data in the writable layer survives container removal, while volume data is deleted with the container
  4. Data in the writable layer is removed with the container, while named volume data persists until the volume is removed Correct answer.

Explanation

The writable layer is tied to the container and is discarded when the container is removed, whereas a named volume is a separate object that persists until explicitly deleted. This distinction is why stateful workloads should write to volumes.