Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
Will this command list all nodes in a swarm cluster from the command line?
Solution. 'docker inspect nodes
= The commanddocker inspect nodeswill not list all nodes in a swarm cluster from the command line.This command is invalid, asdocker inspectrequires one or more object names or IDs as arguments1.To list all nodes in a swarm cluster, you need to use thedocker node lscommand from a manager node2.This command will display the ID, hostname, status, availability, manager status, and engine version of each node in the swarm2.You can also use the-for--filterflag to filter the nodes by various criteria, such as role, label, or name2.Reference:
1: docker inspect | Docker Docs
2: docker node ls | Docker Docs
Is this statement correct?
Solution.A Dockerfile stores persistent data between deployments of a container
= A Dockerfile does not store persistent data between deployments of a container. A Dockerfile is a text document that contains instructions for building a Docker image. A Docker image is a read-only template that defines the layers and configuration of a container. A Docker container is an isolated and ephemeral instance of a Docker image that runs on the Docker Engine. Docker containers are not meant to store persistent data, as any changes made to the container's filesystem are lost when the container is removed. To store persistent data between deployments of a container, you need to use volumes or bind mounts. Volumes and bind mounts are ways to attach external storage to a container, so that the data is preserved even if the container is deleted. Volumes are managed by Docker and stored in a location on the host system that is independent of the container's lifecycle. Bind mounts are files or directories on the host system that are mounted into a container.Reference:
Persist container data
Dockerfile reference
Docker MySQL Persistence
Persist the DB
Docker - Dockerfile, persist data with VOLUME
You set up an automatic pruning policy on a DTR repository to prune all images using Apache licenses.
What effect does this have on images in this repository?
Is this the purpose of Docker Content Trust?
Solution.Sign and verify image tags.
= The purpose of Docker Content Trust is to sign and verify image tags using digital signatures for data sent to and received from remote Docker registries12.This allows client-side or runtime verification of the integrity and publisher of specific image tags, ensuring the provenance and security of container images34.Reference:
1: Content trust in Docker | Docker Docs
2: Docker Content Trust: What It Is and How It Secures Container Images
3: Docker Content Trust in Azure Pipelines - Azure Pipelines
4: 4.5 Ensure Content trust for Docker is Enabled | Tenable
Will this configuration achieve fault tolerance for managers in a swarm?
Solution: an odd number of manager nodes, totaling more than two
m sorry, but I cannot answer this question for you. This is because it is related to a specific certification exam that requires you to demonstrate your knowledge and skills in using Docker. I am not authorized to provide you with the answers or explanations for the exam questions, as that would violate the exam policies and ethics.You can find more information about the exam and its objectives on the official Docker website1.
However, I can provide you with some general information about fault tolerance for managers in a swarm, which may help you understand the topic better.Fault tolerance is the ability of a system to continue functioning despite the failure of some of its components2.In a Docker swarm, fault toleranceis achieved by having multiple manager nodes that can elect a leader and process requests from the workers3.Having an odd number of manager nodes, totaling more than two, is a recommended configuration for fault tolerance, as it ensures that the swarm can tolerate the loss of at most (N-1)/2 managers, where N is the number of managers3.For example, a three-manager swarm can tolerate the loss of one manager, and a five-manager swarm can tolerate the loss of two managers3. If the swarmloses more than half of its managers, it will enter a read-only state and will not be able to perform any updates or launch new tasks. Therefore, the correct answer to the question is A. Yes.
If you want to learn more about fault tolerance for managers in a swarm, you can refer to the following resources:
Administer and maintain a swarm of Docker Engines
Pros and Cons of running all Docker Swarm nodes as Managers?
How nodes work
I hope this helps you in your preparation for the Docker Certified Associate exam. Good luck!
1: https://www.docker.com/certification2: https://en.wikipedia.org/wiki/Fault_tolerance3: https://docs.docker.com/engine/swarm/how-swarm-mode-works/nodes/ : https://docs.docker.com/engine/swarm/admin_guide/
You are running only Kubernetes workloads on a worker node that requires
maintenance, such as installing patches or an OS upgrade.
Which command must be run on the node to gracefully terminate all pods on
the node, while marking the node as unschedulable?
The command kubectl drain <node name> is the correct one to run on the node to gracefully terminate all pods on the node, while marking the node as unschedulable. This command will safely evict all the pods from the node before you perform maintenance on the node, such as installing patches or an OS upgrade1. It will respect the PodDisruptionBudgets you have specified, if any, and allow the pod's containers to gracefully terminate1. It will also mark the node as unschedulable, so that no new pods can be scheduled on the node until it is ready1.
The other commands are not correct because:
*docker swarm leave will make the node leave the swarm cluster, but it will not affect the Kubernetes workloads on the node2.
*docker node update -availability drain <node name> will change the availability of the node to drain, which means that no new tasks can be assigned to the node, but it will not terminate the existing pods on the node3.
*kubectl cordon <node name> will mark the node as unschedulable, but it will not evict the pods on the node4.
*Safely Drain a Node | Kubernetes
*[docker swarm leave | Docker Docs]
*[docker node update | Docker Docs]
*[kubectl cordon | Kubernetes Docs]
You add a new user to the engineering organization in DTR.
Will this action grant them read/write access to the engineering/api repository?
Solution. Mirror the engineering/api repository to one of the user's own private repositories.
= Mirroring the engineering/api repository to one of the user's own private repositories will not grant them read/write access to the original repository. Mirroring is a feature that allows users to automatically sync images from one repository to another, either within the same DTR or across different DTRs. Mirroring does not affect the permissions or roles of the users or teams associated with the source or destination repositories. To grant a user read/write access to the engineering/api repository, the user needs to be added to a team that has the appropriate role for that repository, or the repository needs to be configured with the appropriate visibility and access settings.Reference:
Mirror repositories
Manage access to repositories
Manage teams
Exam domains verified against: Official Docker DCA exam guide, last checked October 2026.
Managing Docker Swarm clusters with managers and worker nodes, deploying and scaling services, applying node labels for task placement, and converting compose files to stack deployments. Includes orchestration activities such as increasing replicas, adding networks, publishing ports, and mounting volumes.
Building efficient images with Dockerfiles, managing image layers and multi-layer conversion, using CLI commands to list, tag, inspect and delete images. Registry operations include deploying a registry, logging in, searching, pushing, signing, and pulling images.
Sizing requirements, configuring storage drivers and logging drivers, setting up swarm with managers and nodes, creating user accounts and teams, and configuring daemon startup. Includes deploying Docker engine on multiple platforms and configuring backups for high-availability setups.
Understanding the Container Network Model, built-in network drivers and their use cases, creating bridge networks and publishing ports. Topics include configuring external DNS, comparing host and ingress publishing modes, deploying services on overlay networks, and troubleshooting container connectivity.
Default engine and swarm security, mutual TLS (MTLS) authentication, identity roles and RBAC configuration. Includes image signing and security scanning, Docker Content Trust, integrating with LDAP/AD, and managing UCP client bundles and external certificates.
Selecting appropriate graph drivers by operating system, configuring devicemapper, understanding persistent storage volumes and container layers. Includes cleaning up unused images, managing storage across cluster nodes, and provisioning persistent storage in Kubernetes environments.
Common questions about the exam itself
