Docker DCA: What Each Domain Actually Tests (Not What the Blueprint Says)

First thing you should know: Docker doesn't run the Docker certification anymore. Mirantis does. When Docker sold its Enterprise business back in 2019, the DCA went with it, and that single fact explains about 80% of why people fail this exam.

Because the blueprint says "Docker." The exam says Docker Enterprise. There's a difference, and it costs $199 to find out the hard way.

I want to walk through the six domains as they actually behave in the exam room, not as they're worded on the objectives PDF. If you want to sanity-check yourself against real question phrasing while you read, the free Docker DCA practice test is a decent mirror of the format — including the weird one.

The format nobody warns you about

55 questions, 90 minutes, 65% to pass. But the question types split:

13 classic multiple choice — normal, four options, pick one.
42 DOMC (Discrete Option Multiple Choice) — options appear one at a time, you answer yes/no to each, and you cannot go back.

DOMC is the whole ballgame. You can't eliminate wrong answers by comparison because you never see the answers together. Partial knowledge, which carries you through most cert exams, is worth almost nothing here. You either know that docker service update --force triggers a rolling restart or you're coin-flipping in public.

Certification is valid 2 years. Now the domains.

Domain 1: Orchestration — 25%

The biggest slice, and it's Swarm. Not Kubernetes. People see "orchestration," think 2026, think Kubernetes, and study the wrong thing for two weeks.

What it actually tests: the Swarm object model and the exact CLI verbs that manipulate it.

docker swarm init --advertise-addr 10.0.0.10
docker swarm join-token worker      # know worker vs manager token
docker node update --availability drain node-2
docker service create --replicas 3 --name api --publish 8080:80 nginx
docker service scale api=5
docker service update --image nginx:1.27 --update-parallelism 2 --update-delay 10s api
docker service rollback api

Expect questions on the difference between replicated and global mode, what happens to tasks when a node is drained versus paused, and quorum math — a 5-manager cluster tolerates 2 failures, a 3-manager cluster tolerates 1. They love quorum math.

Stack files too. Know which Compose keys are ignored in Swarm mode (depends_on, build, links) and which only exist there (deploy: with placement, constraints, resources).

The trap: questions about locking a swarm (docker swarm update --autolock=true) and where the unlock key lives. Two questions on my mock runs, both niche, both memorizable in five minutes.

Domain 2: Image Creation, Management, and Registry — 20%

The Dockerfile domain, and the friendliest one if you've actually built images for a living.

Layer behavior is the core idea. Know that each instruction creates a layer, that RUN apt-get update and RUN apt-get install in separate instructions gives you a stale cache bug, and how multi-stage builds discard everything before the final FROM.

FROM golang:1.22 AS build
WORKDIR /src
COPY . .
RUN CGO_ENABLED=0 go build -o /app

FROM alpine:3.20
COPY --from=build /app /app
ENTRYPOINT ["/app"]

Then the pairs they'll test you on until you're sick of them:

CMD vs ENTRYPOINT (and what happens when you use both — CMD becomes default args)
COPY vs ADD (ADD untars archives and fetches URLs; that's the whole answer)
ARG vs ENV (ARG is build-time only, doesn't persist into the running container)

Registry side: docker image prune -a versus docker system prune, tagging conventions, and Docker Trusted Registry image promotion policies. That last one is Enterprise-only and it will show up.

Domain 3: Installation and Configuration — 15%

The most Enterprise-flavoured domain and the one to memorize rather than understand. UCP (Universal Control Plane), DTR (Docker Trusted Registry), backup ordering, HA node counts.

Also generic daemon config — know /etc/docker/daemon.json cold:

{
  "log-driver": "json-file",
  "log-opts": { "max-size": "10m", "max-file": "3" },
  "storage-driver": "overlay2",
  "default-address-pools": [{ "base": "172.30.0.0/16", "size": 24 }]
}

And know that changing it needs systemctl restart docker, not a reload of anything else.

Domain 4: Networking — 15%

Drivers, and when each applies. bridge (single host, default), host (no isolation, container uses host stack), overlay (multi-host, Swarm), macvlan (container gets a MAC on the physical LAN), none.

The recurring exam idea is DNS-based service discovery: in a user-defined bridge network or an overlay network, containers resolve each other by name. On the default bridge, they don't. That distinction alone is worth several questions.

docker network create -d overlay --attachable backend
docker service create --name db --network backend postgres:16
# another service on 'backend' now reaches it at hostname 'db'

Also: the routing mesh and why publishing port 8080 on one node makes it reachable on every node.

Domain 5: Security — 15%

Content Trust is the headliner. export DOCKER_CONTENT_TRUST=1 and know exactly what breaks after that — unsigned images refuse to pull, and docker push starts signing.

Beyond that: RBAC grants in UCP (subject + role + collection), client bundles for CLI auth, secrets vs configs, and namespaces/cgroups as the isolation primitives.

echo "s3cr3t" | docker secret create db_pass -
docker service create --secret db_pass --name api myimage
# lands at /run/secrets/db_pass inside the container, tmpfs, never on disk

Remember secrets are immutable — you can't update one, you rotate by creating a new secret and updating the service.

Domain 6: Storage and Volumes — 10%

Smallest domain, easiest points. Volumes vs bind mounts vs tmpfs. --mount syntax versus the older -v shorthand. Storage drivers (overlay2 is the answer to almost every "which driver" question on modern Linux). Where images physically live: /var/lib/docker.

Device Mapper direct-lvm setup appears occasionally because Enterprise. Skim it, don't study it.

How I'd sequence six weeks

Weeks 1–2: Swarm. Build a real 3-node cluster on cheap VMs or multipass. Break it. Drain nodes. Kill a manager.
Week 3: Images and registry. Write ten Dockerfiles and inspect every layer with docker history.
Week 4: Networking + storage together. They overlap more than the blueprint suggests.
Week 5: Security + the Enterprise install material. Pure memorization week.
Week 6: DOMC drilling only. Nothing new.

That last week matters more than it sounds. DOMC punishes hesitation, and the only cure is volume. I ran timed sets on ExamCert until I stopped second-guessing single options — $4.99 for lifetime access with a 100% money-back guarantee if you don't pass, which is roughly 2.5% of the exam voucher. Hard to argue with the math.

Is it worth it in 2026?

Honestly? If your shop runs Kubernetes end to end, the CKA is the better spend. But if you're on Swarm, Docker Enterprise, or you want a credential that proves container fundamentals rather than K8s-specific ops, the DCA still holds up — and hiring managers still recognize the name even if Mirantis is the one printing it.

Just go in knowing it's an Enterprise exam wearing a Docker t-shirt.

Start with a free DCA practice exam and see how DOMC feels before you pay $199 to feel it for real.