Level 4 exam — Docker · GUIDINEE.COM

Exam — fresh questions

12 questions to validate the level: registries, healthcheck and restart, reverse proxy, backups and CI.
Answer everything, then click Check: your score and explanations will appear.

4.1 · Recall

1. What is each registry (Hub, GHCR, private) for?

All three are interchangeable with no difference Hub for CI, GHCR for public, private for everything A single registry is always enough everywhere Hub for sharing in public, GHCR tied to code for CI, private for sensitive internal

Public for open source, GHCR for your CIs, private for sensitive internal.

4.1 · Application

2. Idir logs in to the registry in a script. Which command is correct?

Limited-scope token via CI secret and --password-stdin docker login ghcr.io -p mysecret (plain-text password) Sharing the account password in the team chat Logging in with no credentials at all

The stdin-passed limited token lingers neither in history nor in logs.

4.2 · Recall

3. What does restart: unless-stopped do?

Relaunches after crash or reboot, except voluntary stop Prevents any startup Deletes the container after each stop Does nothing at all

Relaunch after crash or reboot, but respects manual stop: the right lasting default.

4.2 · Application

4. docker compose ps shows a service “Up (unhealthy)”. What does Idir do?

He deletes the whole project He diagnoses it (logs) instead of routing to it He ignores the displayed state He sends more traffic to that service

Up = living process, unhealthy = sick service: treat, don't route.

4.2 · Application

5. Idir's API crashed because the database wasn't ready. What does he declare?

restart: no everywhere No dependency between services depends_on with condition: service_healthy on a real healthcheck depends_on without condition (mere order)

The condition waits for true ready proven by the healthcheck, not a mere order.

4.3 · Application

6. Three web applications, a single port 80 available. What does Idir do?

He exposes everything without restriction One reverse proxy published alone, host-based routing to unpublished apps He publishes three different ports at random He merges the three applications into one

Only one published (the proxy), routing by names: one port, N services.

4.3 · Arbitration

7. The database is currently on the frontend network with the applications. Idir's decision?

Also publish the database port Remove network segmentation Leave it on the frontend to simplify Confine it to backend, reached by name from the apps

Database confined to backend: directly unreachable even if the proxy is compromised.

4.4 · Recall

8. Which backup is valid?

A dump successfully replayed on a test volume, data verified A screenshot of the terminal A never-replayed dump An archive stored inside the volume itself

Only a tested restore proves the backup.

4.4 · Application

9. Idir backs up the volume without stopping production. How?

He copies the archive into the backed-up volume He never backs up before an upgrade Throwaway --rm container mounting the volume read-only, archive outside the volume He stops all of production to copy

Read-only throwaway, off-volume archive: prod keeps running, the backup is elsewhere.

4.5 · Application

10. Which tag does Idir deploy to production from CI?

The moving branch alias No tag The branch name The commit SHA (or the tagged version), tested and traceable

Prod deploys an exact, tested artefact, not a moving alias.

4.5 · Arbitration

11. Idir's workflow needs the registry token. Where does he put it?

In plain text in the workflow file In repository secrets, with minimal permissions, never hard-coded Shown in logs for lasting debugging In a shared code comment

Repository secrets, never hard-coded nor in logs, minimal permissions.

4.1 · Arbitration

12. Idir's team deploys to production an image whose exact content nobody knows. What does he decide?

Keep going with ambiguous tags and local builds Stop versioning images CI as the only factory + full name with immutable tag recorded in the prod compose file Push the internal image in public to compare

Single CI factory and immutable tag: each prod image has a known, traceable origin.

What's next?

Score ≥ 80%: move to Level 5 — orchestration and production, and industrialise your gains (private registry, hardened stacks, single frontend, tested backups, CI factory).
Score 50-79%: revisit the failed sections (registries 4.1, reliability 4.2, proxy 4.3, backups 4.4, CI 4.5), reread the explanations above, then retake the test.
Score < 50%: restart the level from 4.1, practising each move (traceable push/pull, healthcheck + restart, segmented frontend, tested restore, green workflow), then retry the exam with a fresh head.