DCA Online Practice Questions and Answers

Correct Answer: B

Correct Answer: A

This statement is correct about this health check definition. A health check is a feature that allows Docker to monitor the health status of a container by running a command in the container periodically. A health check has three parameters: test, interval, and retries. The test parameter specifies the command to run to check the health of the container. The interval parameter specifies how often to run the health check. The retries parameter specifies how many consecutive failures of the health check are needed to mark the container as unhealthy. In this case, the health check runs curl -f http://localhost/ || exit 1 every 10 seconds to test for app health. If this command fails three times in a row, the container is marked as unhealthy.

Correct Answer: A

user is a Linux kernel namespace that is disabled by default and must be enabled at Docker engine runtime to be used. According to the official documentation, user namespace support must be explicitly enabled in two ways: The dockerd daemon must be started with --userns-remap flag. The user or group specified for --userns-remap must have subordinate user and group IDs allocated in /etc/subuid and /etc/subgid files

Correct Answer: A

Docker will block this command, because docker service create requires content trust to be enabled by default and will not pull or run unsigned images. According to the official documentation, docker service create is one of the commands that verify content trust by default and will fail if the image is not signed or if the signing key is not

Correct Answer: A

Using kubectl describe deployment api displays the events table for this object. The kubectl describe command shows detailed information about a resource, including its status and events. This command can be used to troubleshoot a deployment that is not working as expected

Correct Answer: A

Correct Answer: B

Correct Answer: B

Storage is not a type of Linux kernel namespace that provides container isolation. Namespaces are a Linux kernel feature that provide isolation and virtualization of system resources for processes. They can be used to create isolated environments for containers that have their own view of system resources, such as process IDs, user IDs, network interfaces, etc. However, there is no storage namespace in Linux. The types of namespaces that exist are mount (mnt), process ID (pid), network (net), interprocess communication (ipc), user ID (user), control group (cgroup), time (time), and user namespace (uts).

Correct Answer: B

These conditions are not sufficient for Kubernetes to dynamically provision a persistentVolume, because a default provisioner is not enough to determine how to create a persistentVolume. According to the official documentation, you also need to specify a default storageClass or annotate your persistentVolumeClaim with a specific storageClass name.

Correct Answer: A

A physical machine participating in the swarm is a node in the context of a swarm mode cluster. A node is an instance of the Docker engine participating in the swarm. A node can be either a physical machine or a virtual machine. Nodes are either managers or workers. Managers maintain cluster state and manage cluster tasks. Workers execute tasks assigned by managers.

Correct Answer: A

Correct Answer: A

The networkPolicy will block this traffic. A networkPolicy is a Kubernetes resource that defines how pods are allowed to communicate with each other and with other network endpoints. A networkPolicy has two main sections: podSelector and policyTypes. The podSelector selects which pods the networkPolicy applies to. The policyTypes specifies whether the networkPolicy affects ingress (incoming) traffic, egress (outgoing) traffic, or both. In this case, the networkPolicy applies to pods that have a label app: webserver and affects both ingress and egress traffic. The networkPolicy also has two optional sections: ingress and egress. The ingress section defines the rules for allowing ingress traffic to the selected pods. The egress section defines the rules for allowing egress traffic from the selected pods. If either section is missing or empty, it means that no traffic of that type is allowed. In this case, the networkPolicy has an empty ingress section, which means that no ingress traffic is allowed to the pods that have a label app: webserver. Therefore, a request issued from a pod bearing the tier: backend label, to a pod bearing the tier: frontend label will be blocked by this networkPolicy, since it is an ingress traffic to a pod that has a label app: webserver.

Correct Answer: B

PAM is not a supported user authentication method for Universal Control Plane. According to the official documentation, the supported methods are LDAP, Active Directory, SAML 2.0, and local users.

Correct Answer: B

his is not a way to accomplish this, because creating one pod and adding all the resources needed for each application is not a good practice for deploying applications in Kubernetes. According to the official documentation, pods are not intended to run multiple instances of an application or different applications that are tightly coupled. Pods are also not meant to hold resources that are shared across applications, such as secrets or configMaps.

Correct Answer: A

This set of commands can identify the published port(s) for a container. The docker container inspect command shows low-level information about a container in JSON format. This information includes the network settings of the container, such as the port bindings and exposed ports. The docker port command shows the public port(s) that are mapped to a private port inside the container. By using these two commands, you can identify the published port(s) for a container.