Docker Updated DCA Exam Questions and Answers by vienna

= Creating a collection for each application is not a way to accomplish this. A collection is a term used by Ansible to describe a package of related content that can be used to automate the management of Kubernetes resources1. A collection is not a native Kubernetes concept and does not group resources together within the cluster. To group Kubernetes-specific resources, such as secrets, for each application, you need to use namespaces. A namespace is a logical partition of the cluster that allows you to isolate resources and apply policies to them2. You can create a namespace for each application and store the secrets and other resources in that namespace. This way, you can prevent conflicts and limit access to the resources of each application. To create a namespace, you can use the kubectl create namespace command or a yaml file2. To create a secret within a namespace, you can use the kubectl create secret commandwith the --namespace option or a yaml file with the metadata.namespace field3. References:

Kubernetes Collection for Ansible - GitHub

Namespaces | Kubernetes

Secrets | Kubernetes

Managing Secrets using kubectl | Kubernetes

They provide granular control over where pods (or in this case, containers) are scheduled, based on the labels of the nodes1.In the context of Docker Swarm, this means that you could use node affinities to ensure that development and production containers are scheduled on separate nodes, thus meeting the company’s security policy requirements12345.

While creating a Dockerfile for each environment is a possible solution, it is not the most efficient or scalable way to provision configuration to containers at runtime. Docker provides several mechanisms to inject configuration into containers at runtime, such as environment variables, command line arguments, Docker secrets for sensitive data, or even configuration files mounted as volumes. These methods allow the same Docker image to be used across multipleenvironments, promoting immutability and consistency across your deployments. Creating a separate Dockerfile for each environment would mean maintaining multiple versions of the Dockerfile, which could lead to inconsistencies and is generally not a recommended practice.

Image role-based access control is not a function of UCP. UCP has its own built-in authentication mechanism and integrates with LDAP services. It also has role-based access control (RBAC), so that you can control who can access and make changes to your cluster and applications1. However, image role-based access control is a feature of Docker Trusted Registry (DTR), which integrates with UCP and allows you to manage the images you use for your applications2. DTR lets you define granular permissions for images, such as who can push, pull, delete, or scan them3. References: Universal Control Plane overview), Docker Trusted Registry overview), Docker Access Control)