CoursesFree Quizzes
DockerSecurity

Capabilities & Default Security — DCA Practice Question

A representative Docker Certified Associate (DCA) exam question on Capabilities & Default Security. Work through it below, then read why each option is right or wrong.

This question is part of the free Docker Certified Associate practice test.

Short answer

The correct answer is B. It drops all capabilities except a limited set needed by typical processes, using an allowlist instead of a denylist..

B is correct: the security page says Docker drops all capabilities except those needed, an allowlist approach. A is wrong because the default set is small, not the full kernel set. C is wrong because a default set such as CHOWN, KILL, and NET_BIND_SERVICE stays enabled without any --cap-add. D is wrong because Docker does not choose the capability set from the image's USER instruction.

The Question

By default, how does Docker Engine handle Linux kernel capabilities for a new container?

AIt grants the container every capability the host kernel supports, and administrators remove the ones they do not need.
BIt drops all capabilities except a limited set needed by typical processes, using an allowlist instead of a denylist.Correct
CIt drops every capability, so administrators must add each one back with --cap-add before any process can start.
DIt keeps the full capability set for images that run as root and drops the whole set for images that declare USER.

Why B is correct

B is correct: the security page says Docker drops all capabilities except those needed, an allowlist approach. A is wrong because the default set is small, not the full kernel set. C is wrong because a default set such as CHOWN, KILL, and NET_BIND_SERVICE stays enabled without any --cap-add. D is wrong because Docker does not choose the capability set from the image's USER instruction.

Why the other options are wrong

Option A: It grants the container every capability the host kernel supports, and administrators remove the ones they do not need.

Option A does not satisfy the requirement in the scenario. Review the explanation above: the correct choice (B) is the only one that fully meets every constraint stated in the question.

Option C: It drops every capability, so administrators must add each one back with --cap-add before any process can start.

Option C does not satisfy the requirement in the scenario. Review the explanation above: the correct choice (B) is the only one that fully meets every constraint stated in the question.

Option D: It keeps the full capability set for images that run as root and drops the whole set for images that declare USER.

Option D does not satisfy the requirement in the scenario. Review the explanation above: the correct choice (B) is the only one that fully meets every constraint stated in the question.

Key idea: Capabilities & Default Security

B is correct: the security page says Docker drops all capabilities except those needed, an allowlist approach. A is wrong because the default set is small, not the full kernel set. C is wrong because a default set such as CHOWN, KILL, and NET_BIND_SERVICE stays enabled without any --cap-add. D is wrong because Docker does not choose the capability set from the image's USER instruction. On the DCA exam, questions in the "Security" domain test whether you can map a scenario's constraints to the right choice. Read the requirement carefully, eliminate options that violate any single constraint, and pick the one that satisfies all of them with the least operational overhead.

Ready to see how you'd score?

Take the free practice quiz and find out which Docker Certified Associate domains you need to focus on. No signup required.

Take the free quizSee all 327+ practice questions

Practice 5 similar questions

Same cert, same or adjacent domain. Use these after reviewing the explanation.

1Swarm Init & Listen Addr — DCA Practice QuestionOrchestration2Add & Copy — DCA Practice QuestionImage Creation, Management, and Registry3Apt & Docker CE — DCA Practice QuestionInstallation and Configuration4Default Networks & Docker Network ls — DCA Practice QuestionNetworking5Docker Info & Backing Filesystem — DCA Practice QuestionStorage and Volumes

Related Docker Certified Associate Practice Questions

Swarm Init & Listen Addr — DCA Practice Question→Add & Copy — DCA Practice Question→Apt & Docker CE — DCA Practice Question→

Official sources used

Verify program and exam details at the source before scheduling.

docs.docker.comEngine: Securitydocs.docker.comContainers: Run