50 Free Docker Certified Associate Practice Questions
Preparing for the Docker Certified Associate? These 50 free practice questions cover all domains.
Domain 1: Orchestration (Questions 1–13)
Question 1
Which command initializes a Docker Swarm on a manager node?
a) docker swarm create
b) docker swarm init
c) docker swarm start
d) docker cluster init
Show Answer
Answer: b) docker swarm init
Explanation: docker swarm init --advertise-addr <ip> initializes a Swarm on the current node, making it a manager. It outputs a join token for worker nodes.
Question 2
Which service mode ensures exactly one replica runs per node?
a) Replicated
b) Global
c) Daemon
d) Singleton
Show Answer
Answer: b) Global
Explanation: Global mode places one container on every node in the Swarm. Replicated mode places a specified number of containers across the cluster.
Question 3
What does docker service scale web=5 do?
a) Creates 5 new services
b) Scales the "web" service to 5 replicas
c) Removes 5 services
d) Load balances across 5 nodes
Show Answer
Answer: b) Scales the "web" service to 5 replicas
Explanation: docker service scale <service>=<replicas> adjusts the replica count for a service. The Swarm scheduler places the containers across available nodes.
Question 4
Which argument to docker service update sets the update concurrency?
a) --parallelism
b) --concurrency
c) --update-parallelism
d) --batch-size
Show Answer
Answer: c) --update-parallelism
Explanation: --update-parallelism <n> sets how many replicas to update simultaneously. --update-delay sets the delay between updates.
Question 5
How many manager nodes are needed for high availability in Swarm?
a) 1
b) 2
c) 3
d) 5
Show Answer
Answer: c) 3
Explanation: Three managers provide high availability (survive one failure). Five managers survive two failures. Odd numbers recommended for Raft consensus.
Question 6
Which command deploys a stack from a Compose file?
a) docker stack deploy -c docker-compose.yml my-stack
b) docker compose up -d
c) docker stack create -f docker-compose.yml
d) docker deploy -c docker-compose.yml
Show Answer
Answer: a) docker stack deploy -c docker-compose.yml my-stack
Explanation: docker stack deploy uses Compose file v3+ to deploy to Swarm. docker compose is for local development (single host).
Domain 2: Image Creation, Management & Registry (Questions 14–23)
Question 7
Which Dockerfile instruction sets the working directory for subsequent commands?
a) WORKDIR /app
b) CD /app
c) DIR /app
d) CHDIR /app
Show Answer
Answer: a) WORKDIR /app
Explanation: WORKDIR sets the working directory for RUN, CMD, ENTRYPOINT, COPY, and ADD instructions. It creates the directory if it doesn't exist.
Question 8
What is a multi-stage build used for?
a) Building multiple images at once
b) Reducing final image size by separating build and runtime stages
c) Building for multiple architectures
d) Running multiple build processes
Show Answer
Answer: b) Reducing final image size by separating build and runtime stages
Explanation: Multi-stage builds use multiple FROM statements. Artifacts from early stages are copied to later stages, keeping the final image small.
Question 9
Which command tags an image for pushing to a registry?
a) docker tag my-app:latest my-registry.io/my-app:1.0
b) docker push my-app:latest
c) docker rename my-app:latest my-registry.io/my-app:1.0
d) docker tag my-registry.io/my-app:1.0 my-app:latest
Show Answer
Answer: a) docker tag my-app:latest my-registry.io/my-app:1.0
Explanation: docker tag <source> <target> creates an alias tag. The registry hostname is part of the tag name. docker push uploads the image.
Question 10
Which Dockerfile instruction should be placed first in a Dockerfile?
a) RUN
b) FROM
c) COPY
d) CMD
Show Answer
Answer: b) FROM
Explanation: Every Dockerfile must start with FROM (except in multi-stage builds where FROM appears multiple times). It sets the base image.
Domain 3: Installation and Configuration (Questions 24–29)
Question 11
Where is the Docker daemon configuration file located?
a) /etc/docker/daemon.json
b) /etc/docker/config.json
c) /var/lib/docker/config.json
d) /etc/default/docker
Show Answer
Answer: a) /etc/docker/daemon.json
Explanation: daemon.json configures the Docker daemon (storage driver, log driver, insecure registries, cgroup driver, etc.). Changes require systemctl restart docker.
Question 12
Which command shows Docker system-wide resource usage?
a) docker system df
b) docker info
c) docker stats
d) docker system prune
Show Answer
Answer: a) docker system df
Explanation: docker system df shows disk usage for images, containers, volumes, and build cache. docker system prune removes unused data.
Domain 4: Networking (Questions 30–36)
Question 13
Which Docker network type is best for multi-host communication in Swarm?
a) bridge
b) host
c) overlay
d) macvlan
Show Answer
Answer: c) overlay
Explanation: Overlay networks enable communication between containers on different Swarm nodes. They're automatically created when Swarm services publish ports.
Question 14
Which command publishes port 8080 on the host to port 80 in the container?
a) docker run -p 8080:80 nginx
b) docker run -p 80:8080 nginx
c) docker run --expose 80 -p 8080 nginx
d) docker run --port 8080:80 nginx
Show Answer
Answer: a) docker run -p 8080:80 nginx
Explanation: -p <host>:<container> maps host port 8080 to container port 80. -P publishes all exposed ports to random host ports.
Domain 5: Security (Questions 37–44)
Question 15
Which Docker security feature maps container root to a non-root user on the host?
a) User namespaces
b) Capabilities
c) Seccomp
d) AppArmor
Show Answer
Answer: a) User namespaces
Explanation: --userns-remap maps the container's root user to a non-privileged user on the host, reducing the impact of container breakouts.
Question 16
Which flag removes all capabilities from a container?
a) --cap-drop=ALL
b) --capability-drop=ALL
c) --security-drop=ALL
d) --no-capabilities
Show Answer
Answer: a) --cap-drop=ALL
Explanation: Drop all capabilities for maximum security, then add only needed ones: --cap-drop=ALL --cap-add=NET_BIND_SERVICE.
Question 17
What is Docker Content Trust?
a) A trust framework for image authors
b) Signing and verifying container images
c) A trusted registry list
d) A secure connection to registries
Show Answer
Answer: b) Signing and verifying container images
Explanation: DOCKER_CONTENT_TRUST=1 enables image signing and verification using cryptographic keys, ensuring image integrity and publisher authenticity.
Domain 6: Storage and Volumes (Questions 45–50)
Question 18
Which volume type stores data in Docker's managed storage area?
a) Bind mount
b) Named volume
c) tmpfs mount
d) Host mount
Show Answer
Answer: b) Named volume
Explanation: Named volumes (created via docker volume create) are managed by Docker and stored in /var/lib/docker/volumes/. Bind mounts map any host directory.
Question 19
Which Docker command copies a file from a container to the host?
a) docker cp container:/path/file /host/path
b) docker copy container:/path/file /host/path
c) docker extract container:/path/file /host/path
d) docker export container /path/file
Show Answer
Answer: a) docker cp container:/path/file /host/path
Explanation: docker cp copies files between containers and the local filesystem. The syntax is docker cp [OPTIONS] CONTAINER:SRC_PATH DEST_PATH or reverse.
Question 20
Which mount type stores data in memory only?
a) bind
b) volume
c) tmpfs
d) overlay
Show Answer
Answer: c) tmpfs
Explanation: tmpfs mounts store data in RAM (or swap), not on disk. Data is lost when the container stops. Useful for temporary secrets or cache.
How Did You Score?
- 0–25 correct: Review the Docker Certified Associate Guide.
- 26–40 correct: On track. Build hands-on experience.
- 41–50 correct: Ready for the exam!
Access all Docker practice questions →
Related Articles
Bereit, dein Wissen zu testen?
Probiere unsere Übungsprüfungen mit Hunderten von realistischen Fragen aus.
Üben starten →