Docker Updated DCA Exam Questions and Answers by lucien

 The command docker network create -d overlay -o encrypted=true  will ensure that overlay traffic between service tasks is encrypted. This command creates an overlay network with the encryption option enabled, which means that Docker will create IPSEC tunnels between all the nodes where tasks are scheduled for services attached to the overlay network. These tunnels use the AES algorithm in GCM mode and manager nodes automatically rotate the keys every 12 hours1. This way, thedata exchanged between containers on different nodes on the overlay network is secured. References:

Overlay network driver

 A node is a physical or virtual machine running Docker Engine in swarm mode1. A node can be either a manager or a worker, depending on its role in the cluster1. A physical machine participating in the swarm is a node, regardless of its role or availability2. References:

How nodes work | Docker Docs

Manage nodes in a swarm | Docker Docs

 Network is a type of Linux kernel namespace that provides container isolation. Network namespaces isolate the system resources associated with networking, such as network interfaces, IP addresses, routing tables, firewall rules, etc. Each network namespace has its own virtual network stack, and processes in different network namespaces can communicate through virtual network devices or tunnels1. Network namespaces are used by Docker to create isolated networks for containers, and allow users to customize the network configuration and connectivity of each container2. References:

network_namespaces(7) - Linux manual page

Docker network overview | Docker Documentation

= Docker Content Trust (DCT) is a feature that allows users to verify the integrity and publisher of container images they pull or deploy from a registry server, signed on a Notary server12. DCT does not enable mutual TLS between the Docker client and server, which is a different security mechanism that ensures encrypted and authenticated communication between the client and the server3. DCT is based on digital signatures and The Update Framework (TUF) to provide trust over arbitrary collections of data1. References:

Content trust in Docker | Docker Docs

Docker Content Trust: What It Is and How It Secures Container Images

Protect the Docker daemon socket | Docker Docs