Correct Answer: A

This command will display a list of volumes for a specific container, because it uses docker container inspect to show detailed information about a container, including its volumes. According to the official documentation, docker container inspect will show the Mounts section that contains information about all volumes mounted by the container.

Correct Answer: B

Correct Answer: B

Resource reservation cannot be used to schedule containers to meet the security policy requirements, because resource reservation only affects the available resources on a node and does not restrict which containers can run on which nodes. According to the official documentation, resource reservation is used to ensure that a service has enough resources to run. References: https://docs.docker.com/engine/swarm/services/#reserve-memory-or-cpus-for- a-service

Correct Answer: A

This is a way to accomplish this, because creating one namespace for each application and adding all the resources to it is a good practice for deploying applications in Kubernetes. According to the official documentation, namespaces are used to group resources into logical units that correspond to different projects, teams, or environments. Using namespaces can help avoid naming collisions and enforce resource quotas and access policies.

Correct Answer: A

Correct Answer: A

Correct Answer: B

This does not describe the role of Control Groups (cgroups) when used with a Docker container, because user authorization to the Docker API is not related to cgroups. According to the official documentation, cgroups are a Linux kernel feature that limits and isolates the resource usage of a group of processes, such as CPU, memory, disk I/O, network, etc. Docker can use cgroups to share available hardware resources to containers and optionally enforce limits and constraints.

Correct Answer: BC

Correct Answer: B

Correct Answer: B

Indicating an image on Docker Hub is an official image is not the purpose of Docker Content Trust. Official images are curated images that are provided and maintained by Docker, Inc. or by upstream software maintainers. Official images have a special badge on Docker Hub that indicates their status. Official images are not necessarily signed by Docker Content Trust, although some of them are. The purpose of Docker Content Trust is to sign and verify image tags, not to indicate official images.