[May 09, 2026] Valid DCA Test Answers & Docker DCA Exam PDF [Q29-Q45]

考试助推器 5 月 9, 2026 DCA > Docker 0

给本帖评分

[May 09, 2026] Valid DCA Test Answers & Docker DCA Exam PDF

Realistic DCA Exam Dumps with Accurate & Updated Questions

To prepare for the DCA exam, you need to have a good understanding of Docker technology and its components. You should be familiar with Docker CLI commands, Dockerfile syntax, Docker networking concepts, and container orchestration tools like Docker Compose and Kubernetes. Docker offers a variety of resources to help you prepare for the DCA exam, including training courses, practice exams, and study guides.

NO.29 You configure a local Docker engine to enforce content trust by setting the environment variable DOCKER_CONTENT_TRUST=1.
If myorg/myimage: 1.0 is unsigned, does Docker block this command?
Solution: docker service create myorg/myimage:1.0

是

没有

说明
When content trust is enabled, Docker blocks any command that operates on unsigned images, such as docker service create. This is because Docker Content Trust (DCT) allows users to verify the integrity and publisher of specific image tags, using digital signatures stored on a Notary server. If an image tag is not signed, or the signature cannot be verified, Docker will refuse to pull, run, or build with that image. Therefore, if myorg/myimage:1.0 is unsigned, Docker will block the command docker service create myorg/myimage:1.0 and display an error message. References:
* Content trust in Docker
* Docker Content Trust: What It Is and How It Secures Container Images
* Automation with content trust

NO.30 Is this the purpose of Docker Content Trust?
Solution: Enable mutual TLS between the Docker client and server.

是

没有

= Docker Content Trust (DCT) is a feature that allows users to verify the integrity and publisher of container images they pull or deploy from a registry server, signed on a Notary server12. DCT does not enable mutual TLS between the Docker client and server, which is a different security mechanism that ensures encrypted and authenticated communication between the client and the server3. DCT is based on digital signatures and The Update Framework (TUF) to provide trust over arbitrary collections of data1. Reference:
Content trust in Docker | Docker Docs
Docker Content Trust: What It Is and How It Secures Container Images
Protect the Docker daemon socket | Docker Docs

第 31 号 Does this command create a swarm service that only listens on port 53 using the UDP protocol?
Solution: ‘docker service create –name dns-cache -p 53:53/udp dns-cache’

是

没有

= The command ‘docker service create –name dns-cache -p 53:53/udp dns-cache’ creates a swarm service that only listens on port 53 using the UDP protocol. This is because the -p flag specifies the port mapping between the host and the service, and the /udp suffix indicates the protocol to use1. Port 53 is commonly used for DNS services, which use UDP as the default transport protocol2. The dns-cache argument is the name of the image to use for the service.
:
docker service create | Docker Documentation
DNS – Wikipedia
I hope this helps you understand the command and the protocol, and how they work with Docker and swarm. If you have any other questions related to Docker, please feel free to ask me.

第 32 号 You want to create a container that is reachable from its host’s network.
Does this action accomplish this?
Solution. Use either EXPOSE or -publish to access the container on the bridge network.

是

没有

说明
Using either EXPOSE or –publish to access the container on the bridge network does not create a container that is reachable from its host’s network. EXPOSE and –publish are options that specify which ports on the container should be exposed or published to the outside world. They do not affect which network the container is connected to. By default, Docker creates and connects containers to a bridge network, which is an internal network that isolates containers from each other and from the host. To create a container that is reachable from its host’s network, you need to use –network host option, which connects the container to the host’s network stack. References: https://docs.docker.com/engine/reference/builder/#expose,
https://docs.docker.com/engine/reference/run/#expose-incoming-ports,
https://docs.docker.com/network/bridge/, https://docs.docker.com/network/host/

NO.33 A company’s security policy specifies that development and production containers must run on separate nodes in a given Swarm cluster.
Can this be used to schedule containers to meet the security policy requirements?
Solution: node affinities

是

没有

They provide granular control over where pods (or in this case, containers) are scheduled, based on the labels of the nodes1. In the context of Docker Swarm, this means that you could use node affinities to ensure that development and production containers are scheduled on separate nodes, thus meeting the company’s security policy requirements12345.

NO.34 Is this statement correct?
Solution: A Dockerfile provides instructions for building a Docker image

是

没有

说明
A Dockerfile is a text file that contains all the commands a user could run on the command line to create an image1. A Dockerfile is composed of instructions that specify the parent image, the packages to install, the files to copy, the ports to expose, and the commands to run2. A Dockerfile can be used to build a Docker image with the docker build command3. References:
* Dockerfile reference | Docker Docs
* What is a Dockerfile? A Step-by-Step Guide [2023 Updated] – Simplilearn
* How to Build Docker Images with Dockerfile | Linuxize

第 35 号 You configure a local Docker engine to enforce content trust by setting the environment variable DOCKER_CONTENT_TRUST=1.
If myorg/myimage: 1.0 is unsigned, does Docker block this command?
Solution: docker container run myorg/myimage:1.0

没有

是

Docker will block the command docker container run myorg/myimage:1.0 if the image tag myorg/myimage:1.0 is unsigned and the environment variable DOCKER_CONTENT_TRUST=1 is set. The reason is that setting DOCKER_CONTENT_TRUST=1 enables Docker Content Trust (DCT), which is a feature that allows users to verify the integrity and publisher of Docker images using digital signatures1. When DCT is enabled, Docker will only pull, run, or build images that have valid signatures. If an image tag is unsigned or has an invalid signature, Docker will reject the operation and display an error message2. Therefore, to run an unsigned image with DCT enabled, you need to either disable DCT by setting DOCKER_CONTENT_TRUST=0 or use the –disable-content-trust flag, or sign the image tag with a valid key3. Reference:
Content trust in Docker
Determine if Docker image is signed or unsigned
Signing Images and Enabling Docker Content Trust

第 36 号 In the context of a swarm mode cluster, does this describe a node?
Solution: an instance of the Docker engine participating in the swarm

是

没有

In the context of a swarm mode cluster, an instance of the Docker engine participating in the swarm is indeed a node1. A node can be either a manager or a worker, depending on the role assigned by the swarm manager2. A manager node handles the orchestration and management of the swarm, while a worker node executes the tasks assigned by the manager2. A node can join or leave a swarm at any time, and the swarm manager will reconcile the desired state of the cluster accordingly1. References:
* 1: Swarm mode overview | Docker Docs
* 2: Manage nodes in a swarm | Docker Docs

NO.37 The Kubernetes yaml shown below describes a networkPolicy.

Will the networkPolicy BLOCK this traffic?
Solution: a request issued from a pod bearing the tier: backend label, to a pod bearing the tier: frontend label

是

没有

第 38 号 Will This command list all nodes in a swarm cluster from the command line?
Solution. ‘docker swarm nodes’

是

没有

= The command ‘docker swarm nodes’ is not a valid command to list all nodes in a swarm cluster from the command line. The correct command is docker node ls, which can be run on a manager node to view the details of all the nodes in the swarm1. The docker swarm command is used to manage the swarm itself, not the nodes. For example, you can use docker swarm init to create a new swarm, or docker swarm join to add a node to an existing swarm2. References:
* Manage nodes in a swarm | Docker Docs
* docker swarm | Docker Docs

第 39 号 Is this a supported user authentication method for Universal Control Plane?
Solution.LDAP

是

没有

= LDAP is a supported user authentication method for Universal Control Plane (UCP). UCP has its own built-in authentication mechanism and integrates with LDAP and Active Directory. It also supports Role Based Access Control (RBAC) and Docker Content Trust. UCP allows you to configure LDAP as an authentication method and connect it toyour LDAP server. You need to provide the LDAP URL, the base DN, the bind DN and password, and the user and group search settings12. Reference:
SAML | Docker Docs
Universal Control Plane overview | dockerlabs

NO.40 Is this an advantage of multi-stage builds?
Solution: optimizes Images by copying artifacts selectively from previous stages

是

没有

Multi-stage builds are a feature of Docker that allows you to use multiple FROM statements in your Dockerfile. Each FROM statement creates a new stage of the build, which can use a different base image and run different commands. You can then copy artifacts from one stage to another, leaving behind everything you don’t want in the final image. This optimizes the image size and reduces the attack surface by removing unnecessary dependencies and tools. For example, you can use a stage to compile your code, and then copy only the executable file to the final stage, which can use a minimal base image like scratch. This way, you don’t need to include the compiler or the source code in the final image. Reference:
Multi-stage builds | Docker Docs
What Are Multi-Stage Docker Builds? – How-To Geek
Multi-stage | Docker Docs

第 41 号 You set up an automatic pruning policy on a DTR repository to prune all images using Apache licenses. What effect does this have on images in this repository?

Matching images are untagged once they are older than the pruning threshold set in the repository’s Settings tab.

Matching Images are untagged during the next prune job.

Matching images are deleted during the next prune Job.

Matching images are untagged during the next prune job, and subsequently deleted once they are older than the pruning threshold set in the repository’s Settings tab.

第 42 号 Is this a function of UCP?
Solution: image role-based access control

是

没有

说明
Image role-based access control is not a function of UCP. UCP has its own built-in authentication mechanism and integrates with LDAP services. It also has role-based access control (RBAC), so that you can control who can access and make changes to your cluster and applications1. However, image role-based access control is a feature of Docker Trusted Registry (DTR), which integrates with UCP and allows you to manage the images you use for your applications2. DTR lets you define granular permissions for images, such as who can push, pull, delete, or scan them3. References: Universal Control Plane overview), Docker Trusted Registry overview), Docker Access Control)

第 43 号 Will this action upgrade Docker Engine CE to Docker Engine EE?
Solution.Run docker engine activate.

是

没有

说明
Running docker engine activate will upgrade Docker Engine CE to Docker Engine EE. This is a feature that allows you to switch from the Community Edition to the Enterprise Edition without reinstalling Docker or losing any data. You need to have a valid license file and a subscription to Docker EE to use this feature1. Docker EE is a premium version of Docker CE that offers additional features, such as security scanning, image management, and certified plugins23. References:
* Upgrade Docker Engine | Docker Docs
* What is the exact difference between Docker EE (Enterprise Edition), Docker CE (Community Edition) and Docker (Custom Support) – Stack Overflow
* Docker Community Edition or Docker Enterprise Edition – Docker | BoxBoat

NO.44 Will this command list all nodes in a swarm cluster from the command line?
Solution: ‘docker Is -a’

是

没有

说明
The command docker Is -a does not list all nodes in a swarm cluster from the command line, but rather lists all containers, both running and stopped, on the current node1. To list all nodes in a swarm cluster, you need to use the command docker node ls from a manager node2. This command shows the node ID, hostname, status, availability, and manager status for each node in the swarm2. You can also use the –filter option to filter the output based on various criteria2. References: Docker Documentation, docker node ls

第 45 号 Will this command mount the host’s ‘/data’ directory to the ubuntu container in read-only mode?
Solution: ‘docker run -v /data:/mydata –mode readonly ubuntu’

是

没有

说明
This command will not mount the host’s ‘/data’ directory to the ubuntu container in read-only mode, because it has an incorrect option for making the volume read-only. According to the official documentation, the correct command should be:
docker run -v /data:/mydata:ro ubuntu
The incorrect option is:
The –mode flag does not exist and should be replaced by a :ro suffix to make the volume read-only.
References: https://docs.docker.com/engine/reference/commandline/run/#mount-volume-v-read-only
https://docs.docker.com/storage/volumes/#use-a-read-only-volume

加载中 …