Download Dockers Server Ultimate Exam and more Exams Technology in PDF only on Docsity!
Question 1 Which command initializes a new Docker Swarm cluster and makes the current node a manager? A) docker swarm create B) docker swarm init C) docker swarm join D) docker swarm start Answer: B Explanation: docker swarm init bootstraps a new Swarm, designating the executing node as the first manager. Question 2 In a Swarm, what term describes the minimum number of manager nodes that must be online to maintain quorum? A) Replication factor B) Consensus threshold C) Quorum size D) HA level Answer: C Explanation: Quorum size is the count of manager nodes required to achieve consensus; without it the Swarm cannot elect a leader. Question 3 Which Swarm command locks the manager’s encryption keys, requiring a key to unlock the cluster after a reboot? A) docker swarm lock B) docker swarm autolock C) docker swarm protect
D) docker swarm secure Answer: A Explanation: docker swarm lock enables autolock, encrypting manager state; a key must be supplied with docker swarm unlock after restart. Question 4 How can you prevent new tasks from being scheduled on a node while allowing existing tasks to continue running? A) docker node update --availability pause B) docker node update --availability drain C) docker node update --availability active D) docker node update --availability offline Answer: B Explanation: Setting a node’s availability to drain stops scheduling new tasks but leaves current tasks untouched until they finish or are moved. Question 5 Which node label syntax can be used to schedule a service only on nodes labeled region=us-east? A) --constraint node.labels.region==us-east B) --label node.region=us-east C) --node-label region=us-east D) --placement region=us-east Answer: A Explanation: The --constraint flag with node.labels.== filters nodes during service placement.
C) docker service set-replicas myservice 5 D) docker service scale --replicas 5 myservice Answer: B Explanation: docker service update --replicas adjusts the desired replica count for a replicated service. Question 9 How does Docker Swarm perform a rolling update by default? A) All tasks are stopped, then new ones started. B) One task is replaced at a time, respecting the --update-parallelism. C) Half of the tasks are replaced simultaneously. D) Updates are applied only after manual approval. Answer: B Explanation: Swarm updates tasks incrementally; the --update-parallelism flag controls how many tasks are updated concurrently. Question 10 Which flag forces a service rollback to the previous version if the update fails? A) --rollback-on-failure B) --update-failure-action rollback C) --restart-policy on-failure D) --auto-rollback Answer: B Explanation: --update-failure-action rollback tells Swarm to revert to the prior service spec when an update cannot be completed.
Question 11 In Swarm, what is the behavior of a global service? A) Only one replica runs on the entire cluster. B) One replica runs on each node that matches the placement constraints. C) Replicas are distributed evenly across all nodes. D) Global services are deprecated. Answer: B Explanation: A global service creates exactly one task on every eligible node, ensuring uniform deployment. Question 12 Which docker inspect sub-command returns the JSON description of a service named webapp? A) docker inspect service webapp B) docker service inspect webapp --pretty C) docker inspect webapp --type service D) docker service inspect webapp Answer: D Explanation: docker service inspect fetches the low-level service object; --pretty formats it, but the core command is docker service inspect. Question 13 A task remains in the Pending state after a service update. Which is the most common cause? A) Image not found in the registry. B) Node has insufficient CPU resources. C) Service definition contains syntax errors.
Question 16 Which Dockerfile instruction should be used to set environment variables that persist at runtime? A) ENV B) ARG C) LABEL D) EXPOSE Answer: A Explanation: ENV defines environment variables that are baked into the image and available to containers launched from it. Question 17 How does a multi-stage build reduce final image size? A) By compressing each layer with gzip. B) By copying only the necessary artifacts from earlier stages into the final stage. C) By merging all layers into a single layer. D) By deleting the Dockerfile after the build. Answer: B Explanation: Multi-stage builds allow you to compile or install dependencies in an intermediate stage, then copy only the needed binaries into the final image, discarding the rest. Question 18 Which Dockerfile instruction is ignored when a .dockerignore file matches its source path? A) COPY B) ADD C) RUN
D) Both COPY and ADD Answer: D Explanation: Both COPY and ADD respect the .dockerignore patterns; matching files are excluded from the build context. Question 19 What is the purpose of the --cache-from option in docker build? A) To pull a remote image and use its layers as a cache source. B) To disable the build cache entirely. C) To specify a directory that contains cached layers. D) To export the build cache after the build finishes. Answer: A Explanation: --cache-from tells Docker to consider the specified image's layers as potential cache hits, speeding up rebuilds. Question 20 Which command starts a private Docker Registry container listening on port 5000? A) docker run -d -p 5000:5000 --name registry registry: B) docker start registry -p 5000: C) docker launch registry -d -p 5000: D) docker create registry -p 5000: Answer: A Explanation: The official registry image registry:2 runs on port 5000 by default; docker run -d -p 5000:5000 publishes it.
Answer: C Explanation: DCT uses Notary to sign image manifests; Docker verifies signatures before pulling when DCT is enabled. Question 24 Which tool can be integrated with Docker to scan images for known CVEs? A) Docker Scan (Snyk) B) Docker Lint C) Docker Guard D) Docker Shield Answer: A Explanation: Docker Scan (powered by Snyk) inspects image layers for vulnerabilities and reports findings. Question 25 When configuring a Docker daemon, which JSON key disables the default overlay2 storage driver? A) "storage-driver": "none" B) "storage-opts": ["overlay2.disable=true"] C) "storage-driver": "devicemapper" D) "disable-storage": true Answer: C Explanation: Setting "storage-driver": "devicemapper" (or any other supported driver) replaces the default overlay2.
Question 26 On Ubuntu, which package manager command installs Docker Engine Community Edition? A) yum install docker-ce B) apt-get install docker-ce C) dnf install docker-ce D) pacman -S docker-ce Answer: B Explanation: Ubuntu uses apt-get (or apt) to install packages; the Docker CE package is docker-ce. Question 27 Which daemon.json option configures Docker to use the journald logging driver by default? A) {"log-driver":"journald"} B) {"default-logging":"journald"} C) {"logging-driver":"journald"} D) {"log-driver":"json-file"} Answer: A Explanation: The key is "log-driver"; setting it to "journald" makes journald the default logging driver. Question 28 How can you ensure Docker starts automatically after a system reboot on a systemd-based host? A) docker enable --autostart B) systemctl enable docker.service C) chkconfig docker on
Question 31 What is the primary purpose of the Docker overlay network driver? A) To connect containers on the same host only. B) To provide encrypted communication between Swarm nodes. C) To enable multi-host networking for services in a Swarm. D) To assign static IP addresses to containers. Answer: C Explanation: Overlay networks create a virtual L2 network spanning all Swarm nodes, allowing containers on different hosts to communicate as if on the same LAN. Question 32 Which driver is best suited for assigning a physical MAC address to each container, allowing them to appear as separate devices on the physical network? A) bridge B) macvlan C) none D) overlay Answer: B Explanation: macvlan creates a separate MAC for each container, enabling direct L2 connectivity on the host’s network. Question 33 In Docker, what does the ingress routing mesh do? A) It forwards traffic directly to the container’s IP address. B) It load-balances incoming published ports across all nodes in the Swarm.
C) It creates a VPN between Swarm nodes. D) It disables port publishing for services. Answer: B Explanation: The ingress routing mesh receives traffic on a published port on any node and forwards it to a task of the service, providing built-in load balancing. Question 34 Which flag publishes a container port directly on the host without using the routing mesh? A) -p 8080:80 --mode host B) -p 8080:80 --publish-mode host C) --expose 80 --host-mode D) -P --direct Answer: B Explanation: --publish-mode host disables the ingress mesh, binding the port directly to the node’s network namespace. Question 35 How does Docker’s internal DNS resolve the name of a service called db within the same Swarm? A) It queries an external DNS server. B) It resolves to the IP of the manager node. C) It returns a VIP (virtual IP) that load-balances across task IPs. D) It uses the container’s hostname. Answer: C
C) docker volume ls D) docker volume show Answer: C Explanation: docker volume ls displays all volumes; dangling (unused) volumes appear with no “REF” column. Question 39 How can you remove all unused (dangling) volumes in a single command? A) docker volume prune -f B) docker volume clean C) docker system prune --volumes D) docker volume rm --all Answer: A Explanation: docker volume prune deletes volumes not referenced by any container; -f suppresses the confirmation prompt. Question 40 Which mount type stores data only in RAM and disappears when the container stops? A) bind mount B) tmpfs mount C) volume mount D) overlay mount Answer: B
Explanation: tmpfs mounts allocate memory-backed storage; data is lost when the container exits. Question 41 In a Docker Compose file, which top-level key defines a named volume that can be shared between services? A) mounts B) storage C) volumes D) data Answer: C Explanation: The volumes section declares named volumes that services can reference via the volumes key. Question 42 Which command creates a named volume called logs with the default driver? A) docker volume create logs B) docker volume new logs C) docker create volume logs D) docker volume add logs Answer: A Explanation: docker volume create creates a new named volume. Question 43 When using Docker Secrets, how is a secret made available inside a container? A) As an environment variable.
Explanation: User namespace remapping isolates container UIDs/GIDs by mapping them to a non-root range on the host. Question 46 Which of the following is the recommended practice for running containers in production regarding user privileges? A) Always run as root. B) Use the --privileged flag for all containers. C) Run as a non-root user defined in the Dockerfile. D) Disable SELinux to avoid permission issues. Answer: C Explanation: Running containers with a non-root user reduces the impact of a potential container breakout. Question 47 How does Mutual TLS (mTLS) enhance security in a Swarm cluster? A) It encrypts container logs. B) It ensures that both client and server present valid certificates for communication. C) It disables the need for Docker secrets. D) It allows containers to share the same network namespace. Answer: B Explanation: mTLS requires both sides of a connection (e.g., manager-worker) to authenticate with certificates, preventing unauthorized nodes from joining. Question 48 Which Docker command generates a client bundle for a specific user to access a Swarm manager via TLS? A) docker swarm init --autolock
B) docker swarm join-token manager --quiet C) docker swarm ca --rotate D) docker swarm join-token manager --cert-expiry Answer: D Explanation: docker swarm join-token manager --cert-expiry produces a token and the associated TLS certificates for a user; the bundle can be exported via docker swarm join-token manager --quiet combined with docker swarm ca operations. Question 49 Which built-in Docker network driver provides complete isolation, with no external connectivity unless explicitly published? A) bridge B) none C) overlay D) host Answer: B Explanation: The none driver disables all networking; the container has no network interfaces unless manually attached. Question 50 In Docker Enterprise, which component provides Role-Based Access Control (RBAC) for API calls? A) UCP (Universal Control Plane) B) DTR (Docker Trusted Registry) C) Docker Engine daemon D) Docker Swarm manager
