DOCKER-SCOUT Practice Test

DOCKER-SCOUT practice test: what's covered

• SBOM
• Image Analysis
• CVEs
• Policies
• Remediation
• Registry and CI Integrations

Free DOCKER-SCOUT sample questions

1. A DevSecOps engineer needs to understand which packages exist inside a production image. Which response is the BEST fit?

   • A. Analyze the image with Docker Scout to generate or read the SBOM and list packages and versions
   • B. Inspect only the image tag name
   • C. Check the container hostname after deployment
   • D. Assume the Dockerfile lists every transitive package
   Show answer

   Correct: A. Analyze the image with Docker Scout to generate or read the SBOM and list packages and versions is the best answer because Docker Scout uses SBOM data to inventory components beyond what is visible in tags or Dockerfiles. The other choices do not fit the scenario: Inspect only the image tag name addresses the wrong layer or timing, Check the container hostname after deployment skips a required control, and Assume the Dockerfile lists every transitive package would create avoidable operational or security risk.

2. A team builds images with provenance and SBOM attestations enabled. Which response is the BEST fit?

   • A. Use the attached SBOM attestation when available so analysis reflects the build artifact metadata
   • B. Discard attestations because SBOMs are only for legal teams
   • C. Replace the image digest with a mutable latest tag
   • D. Store SBOMs only as screenshots in tickets
   Show answer

   Correct: A. Use the attached SBOM attestation when available so analysis reflects the build artifact metadata is the best answer because SBOM attestations provide machine-readable component inventory tied to the artifact. The other choices do not fit the scenario: Discard attestations because SBOMs are only for legal teams addresses the wrong layer or timing, Replace the image digest with a mutable latest tag skips a required control, and Store SBOMs only as screenshots in tickets would create avoidable operational or security risk.

3. A local image has never been pushed to a registry but needs a quick vulnerability check. Which response is the BEST fit?

   • A. Run Docker Scout analysis locally or through Docker Desktop without requiring registry activation
   • B. Wait until the image is deployed to production
   • C. Scan only the Kubernetes service name
   • D. Use ping against the container port as a CVE scanner
   Show answer

   Correct: A. Run Docker Scout analysis locally or through Docker Desktop without requiring registry activation is the best answer because Scout can inspect local images; vulnerability analysis is not the same as network reachability. The other choices do not fit the scenario: Wait until the image is deployed to production addresses the wrong layer or timing, Scan only the Kubernetes service name skips a required control, and Use ping against the container port as a CVE scanner would create avoidable operational or security risk.

4. An image analysis report must support audit and remediation. Which TWO choices should the engineer select? (Choose TWO)

   • A. Identify vulnerable packages with version and fixed-version guidance
   • B. Tie findings to image digest or artifact identity rather than only a mutable tag
   • C. Report only the maintainer email address
   • D. Use container uptime as the vulnerability identifier
   Show answer

   Correct: A and B. Identify vulnerable packages with version and fixed-version guidance and Tie findings to image digest or artifact identity rather than only a mutable tag are correct because actionable reports need package and artifact precision. The distractors do not satisfy the requirement: Report only the maintainer email address is incomplete for this case, and Use container uptime as the vulnerability identifier solves a different problem or weakens the design.

5. Two images use the same tag name at different times and show different findings. Which response is the BEST fit?

   • A. Compare immutable digests because tags can move while digests identify exact image content
   • B. Assume the first tag result is always current
   • C. Delete all tags to make findings stable
   • D. Use container names as cryptographic identifiers
   Show answer

   Correct: A. Compare immutable digests because tags can move while digests identify exact image content is the best answer because image tags are mutable but digests identify the exact artifact. The other choices do not fit the scenario: Assume the first tag result is always current addresses the wrong layer or timing, Delete all tags to make findings stable skips a required control, and Use container names as cryptographic identifiers would create avoidable operational or security risk.

Last updated: 2026-10-19

DOCKER-SCOUT practice test FAQ