Q89. In Docker Trusted Registry, how would a user prevent an image, for example ‘nginx:latest’ from being
overwritten by another user with push access to the repository?

Q90. Will this Linux kernel facility limit a Docker container’s access to host resources, such as CPU or memory?
Solution: namespaces

Q91. Seven managers are in a swarm cluster.
Is this how should they be distributed across three datacenters or availability zones?
Solution: 3-2-2

Q92. Will this configuration achieve fault tolerance for managers in a swarm?
Solution: an odd number of manager nodes, totaling more than two

Q93. Following the principle of least privilege, which of the following methods can be used to securely grnt access to the specific user to communicate to a Docker engine? (Choose two.)

Q94. Following the principle of least privilege, which of the following methods can be used to securely grnt access to the specific user to communicate to a Docker engine? (Choose two.)

Q95. Is this a Linux kernel namespace that is disabled by default and must be enabled at Docker engine runtime to be used?
Solution: net

Q96. The output of which command can be used to find the architecture and operating system an image is
compatible with?

Q97. One of several containers in a pod is marked as unhealthy after failing its livenessProbe many times. Is this the action taken by the orchestrator to fix the unhealthy container?
Solution: Kubernetes automatically triggers a user-defined script to attempt to fix the unhealthy container.

Q98. The Kubernetes yaml shown below describes a networkPolicy.

Will the networkPolicy BLOCK this traffic?
Solution: a request issued from a pod bearing the tier: backend label, to a pod bearing the tier: frontend label

Q99. One of several containers in a pod is marked as unhealthy after failing its livenessProbe many times. Is this the action taken by the orchestrator to fix the unhealthy container?
Solution: The controller managing the pod is autoscaled back to delete the unhealthy pod and alleviate load.

Q100. A service ‘wordpress’ is running using a password string to connect to a non-Dockerized database service. The password string is passed into the ‘wordpress’ service as a Docker secret. Per security policy, the password on the database was changed. Identity the correct sequence of steps to rotate the secret from the old password to the new password.

Q101. Which of the following is required to install Docker EE from a package repository?

Q102. Will this Linux kernel facility limit a Docker container’s access to host resources, such as CPU or memory?
Solution: cgroups

Q103. Will this command ensure that overlay traffic between service tasks is encrypted?
Solution: docker network create -d overlay -o encrypted=true <network-name>

Q104. You configure a local Docker engine to enforce content trust by setting the environment variable
DOCKER_CONTENT_TRUST=1.
If myorg/myimage: 1.0 is unsigned, does Docker block this command?
Solution: docker service create myorg/myimage:1.0

Q105. A company’s security policy specifies that development and production containers must run on separate nodes in a given Swarm cluster.
Can this be used to schedule containers to meet the security policy requirements?
Solution: resource reservation

Q106. Which one of the following commands will show a list of volumes for a specific container?

Q107. Will this command ensure that overlay traffic between service tasks is encrypted?
Solution: docker network create -d overlay –secure

Q108. Will this sequence of steps completely delete an image from disk in the Docker Trusted Registry?
Solution: Delete the image and delete the image repository from Docker Trusted Registry