NEW QUESTION 1
Which of the following commands will create a swarm service which only listens on port 53 using the UDP protocol?

• A. docker service create --name dns-cache -p 53:53/udp dns-cache
• B. docker service create --name dns-cache -p 53:53 --service udp dns-cache
• C. docker service create --name dns-cache -p 53:53 ..constraint networking.protocol.udp=true dns-cache
• D. docker service create --name dns-cache -p 53:53 --udp dns-cache

Answer: A

NEW QUESTION 2
The output of which command can be used to find the architecture and operating system an image is compatible with?

• A. docker image inspect --filter {{.Architecture}} {{.OS}} ' <image-id>
• B. docker image ls <image-id>
• C. docker image inspect --format {{.Architecture}} {{.OS}} ' <image-id>
• D. docker image info <image-id>

Answer: C

NEW QUESTION 3
Which of the following commands will ensure that overlay traffic between service tasks is encrypted?

• A. docker service create --network <network-name> --secure <service-name>
• B. docker network create -d overlay --secure <network-name>
• C. docker network create -d overlay -o encrypted=true <network-name>
• D. docker service create --network <network-name> --encrypted <service-name>

Answer: C

NEW QUESTION 4
Wha is the purpose of Docker Content Trust?

• A. Signing and verification of image tags
• B. Enabling mutual TLS between the Docker client and server
• C. Docker registry TLS verification and encryption
• D. Indicating an image on Docker Hub is an official image

Answer: A

NEW QUESTION 5
A container named "analytics" that stores results in a volume called "data" was created. docker run -d --name=analytics -v data:/data app1
How are the results accessed in "data" with another container called "app2"?

• A. docker run -d --name=reports --volume=data app2
• B. docker run -d --name=reports --volumes-from=analytics app2
• C. docker run -d --name=reports --volume=app1 app2
• D. docker run -d --name=reports --mount=app1 app2

Answer: B

NEW QUESTION 6
Which statement is true?

• A. CMD shell format uses this form ["param", param", "param"]
• B. ENTRYPOINT cannot be used in conjuction with CMD
• C. CMD is used to run the software is the image along with any arguments
• D. ENTRYPOINT cannot be overriden in the "docker container run" command

Answer: A

NEW QUESTION 7
Which one of the following commands will show a list of volumes for a specific container?

• A. 'docker container logs nginx --volumes'
• B. 'docker container inspect nginx'
• C. 'docker volume inspect nginx'
• D. 'docker volume logs nginx --containers'

Answer: B

NEW QUESTION 8
Which of the following is required to install Docker EE from a package repository?

• A. Repository URL obtained from Docker Store
• B. License key obtained from Docker Store
• C. Repository URL obtained from Docker Hub
• D. License key obtained from Docker Hub

Answer: A

NEW QUESTION 9
Which flag for a service would allow a container to consume more than 2 GB of memory only when there is no memory contention but would also prevent a container from consuming more than 4GB of memory, in any case?

• A. --limit-memory 2GB --reserve-memory 4GB
• B. --limit-memory 4GB --reserve-memory 2GB
• C. --memory-swap 2GB --limit-memory 4GB
• D. --memory-swap 4GB --limit-memory 2GB

Answer: C

NEW QUESTION 10
What is used by the kernel to Isolate resources when running Docker containers?

• A. Namespaces
• B. Overlay networks
• C. Volumes
• D. Control groups (also know as cgroups)

Answer: D

NEW QUESTION 11
Which of the following modes can be used for service discovery of a Docker swarm service (Pick 2 correct answers)

• A. Virtual IP (VIP) with --endpoint-mode vip
• B. Overlay with --endpoint-mode overlay
• C. DNS Round-Robin with --endpoint-mode dnsrr
• D. Ingress with --endpoint-mode ingress
• E. Network Address Translation(NAT) with --endpoint-mode nat

Answer: AC

NEW QUESTION 12
If installing Docker using devicemapper for storage with the Intent to run production workloads, how should devicemapper be configured

• A. direct-lvm
• B. loop-lvm
• C. overlay-lvm
• D. aufs-lvm

Answer: A

NEW QUESTION 13
You have deployed a service to swarm. Which command uses the Docker CLI to set the number of tasks of the services to 5? (choose 2)

• A. 'docker service update --replicas=5 <service-id>'
• B. 'docker replica update <service-id>=5'
• C. 'docker update service <service-id>=5'
• D. 'docker service replicas <service-id>=5'
• E. 'docker service scale <service-id> = 5''

Answer: AE

NEW QUESTION 14
When using the Docker client to push an image to a registry, what environment variable is used to instruct the client to perform signing of the image?

• A. DOCKER_CONTENT_TRUST=1
• B. DOCKER_IMAGE_SIGN=1
• C. DOCKER_PUSH_SIGN=1
• D. NOTARY_ENABLE=1Correct

Answer: A

NEW QUESTION 15
Which of the following is supported by control groups?

• A. Manage certificates
• B. Collect net
• C. Limit CPU usage within a container
• D. Isolate processes in a container

Answer: C

NEW QUESTION 16
Which of the following is true about using the '-P' option when creating a new container?

• A. Docker binds each exposed container port to a random port on all the host's interface
• B. Docker gives extended privileges to the container.
• C. Docker binds each exposed container port to a random port on a specified host interface
• D. Docker binds each exposed container port with the same port on the host

Answer: AExplanationControllare

NEW QUESTION 17
Which of the following commands wifi automatically create a volume when a container is started?

• A. 'docker container run --name nginxtest --volumes=/app nginx'
• B. 'docker container run --name nginxtest -v /app:mount nginx'
• C. 'docker container run --name nginxtest --volumes myvol:/app:new nginx'
• D. 'docker container run --name nginxtest -v myvol:/app nginx'

Answer: A

NEW QUESTION 18
Following the principle of least privilege, which of the following methods can be used to securely grnt access to the specific user to communicate to a Docker engine? (Choose two.)

• A. Utilize the '--host 0.0.0.0:2375' option to the Docker daemon to listen on port 2375 over TCP on all interfaces
• B. Utilize openssl to create TLS client and server certificates, configuring the Docker engine to use with mutual TLS over TCP.
• C. Utilize the '--host 127.0.0.1:2375' option to the Docker daemon to listen on port 2375 over TCP on localhost
• D. Give the user root access to the server to allow them to run Docker commands as root.
• E. Add the user to the 'docker' group on the server or specify the grouè with the '--group' Docker daemon option.

Answer: BE

NEW QUESTION 19
Which command interactively monitors all container activity in the Docker engine?

• A. docker system logs
• B. docker system events
• C. docker container events
• D. docker container logs

Answer: B

NEW QUESTION 20
Which of the following constitutes a production-ready devicemapper configuration for the Docker engine?

• A. Create a volume group in devicemapper and utilize the '--dm.thinpooldev' Docker daemon option, specifying the volume group
• B. Format a partition with xfs and mount it at '/var/lib/docker'
• C. Utilize the '--storage-opt dm.directlvm_device' Docker daemon option, specifying a block device
• D. Nothing, devicemapper comes ready for production usage out of the box

Answer: C

Explanation:
Explanation

NEW QUESTION 21
The following health check exists in a Dockerfile: 'HEALTCHECK
CMD curl --fail http://localhost/health || exit 1 '
Which of the following describes its purpose?

• A. Defines the action taken when container health fails, which in this case will kill the container with exit status 1
• B. Defines the health check endpoint on the localhost interface for external monitoring tools to monitor the health of the docker engine.
• C. Defines the health check endpoint on the local host interface for containers to monitor the health of the docker engine.
• D. Defines the health check for the containerized application so that the application health can be monitored by the Docker engine

Answer: A

NEW QUESTION 22
In Docker Trusted Registry, how would a user prevent an image, for example 'nginx:latest' from being overwritten by another user with push access to the repository?

• A. Tag the image with 'nginx:immutable'
• B. Remove push access from all other users.
• C. Use the DTR web UI to make the tag immutable.
• D. Keep a backup copy of the image on another repository.

Answer: C

NEW QUESTION 23
......