DCA Exam Dumps : Docker Certified Associate (DCA) Exam

= Creating images that contain the specific configuration for every environment is not a way to provision configuration to containers at runtime. This approach violates the principle of separating application code from configuration, and makes the images less portable and reusable across different environments1. It also increases the maintenance overhead and the risk of configuration drift, as any change in the configuration would require rebuilding and redeploying the images2. To provision configuration to containers at runtime, you should use a different mechanism, such as environment variables, command-line arguments, or config maps345. References:

Configuration management with Containers | Kubernetes

Environment variables in Compose | Docker Docs

Override the default command | Docker Docs

Configuration management with Containers | Kubernetes

 The command docker network create -d overlay -o encrypted=true  will ensure that overlay traffic between service tasks is encrypted. This command creates an overlay network with the encryption option enabled, which means that Docker will create IPSEC tunnels between all the nodes where tasks are scheduled for services attached to the overlay network. These tunnels use the AES algorithm in GCM mode and manager nodes automatically rotate the keys every 12 hours1. This way, thedata exchanged between containers on different nodes on the overlay network is secured. References:

Overlay network driver

Label constraints can be used to schedule containers to meet the security policy requirements. Label constraints allow you to specify which nodes a service can run on based on the labels assigned to the nodes1. For example, you can label the nodes that are intended for development with env=dev and the nodes that are intended for production with env=prod. Then, you can use the --constraint flag when creating a service to restrict it to run only on nodes with a certain label value. For example, docker service create --name dev-app --constraint 'node.labels.env == dev' ... will create a service that runs only on development nodes2. Similarly, docker service create --name prod-app --constraint 'node.labels.env == prod' ... will create a service that runsonly on production nodes3. This way, you can ensure that development and production containers are running on separate nodes in a given Swarm cluster. References:

Add labels to swarm nodes

Using placement constraints with Docker Swarm

Multiple label placement constraints in docker swarm