Explanation
Resource reservation is a feature that allows you to specify the amount of CPU and memory resources that a service or a container needs. This helps the scheduler to place the service or the container on a node that has enough available resources. However, resource reservation does not control which node the service or the container runs on, nor does it enforce any separation or isolation between different services or containers.
Therefore, resource reservation cannot be used to schedule containers to meet the security policy requirements.
References:
* [Reserve compute resources for containers]
* [Docker Certified Associate (DCA) Study Guide]
https://docs.docker.com/config/containers/resource_constraints/
https://success.docker.com/certification/study-guides/dca-study-guide

Explanation
(Please check the official Docker site for the verified answer) Comprehensive Explanation: = (Please check the official Docker site for the comprehensive explanation) References: (Some possible references from the web search results are)
* Docker Security - Docker Documentation
* Docker Security Best Practices - Medium
* Docker Security Cheat Sheet - GitHub
* Docker Security: A Comprehensive Guide - Snyk
* Docker Security: Tips and Tricks to Secure Your Containers - DevSecOps I hope this helps you in your exam preparation. Good luck!

= A Dockerfile does not store persistent data between deployments of a container. A Dockerfile is a text document that contains instructions for building a Docker image. A Docker image is a read-only template that defines the layers and configuration of a container. A Docker container is an isolated and ephemeral instance of a Docker image that runs on the Docker Engine. Docker containers are not meant to store persistent data, as any changes made to the container's filesystem are lost when the container is removed. To store persistent data between deployments of a container, you need to use volumes or bind mounts. Volumes and bind mounts are ways to attach external storage to a container, so that the data is preserved even if the container is deleted.
Volumes are managed by Docker and stored in a location on the host system that is independent of the container's lifecycle. Bind mounts are files or directories on the host system that are mounted into a container. References:
* Persist container data
* Dockerfile reference
* Docker MySQL Persistence
* Persist the DB
* Docker - Dockerfile, persist data with VOLUME

Namespaces are a Linux kernel feature that isolate containers from each other and from the host system. They limit the access of a container to host resources, such as CPU or memory, by creating a separate namespace for each aspect of a container, such as process IDs, network interfaces, user IDs, etc. This way, a container can only see and use the resources that belong to its own namespace, and not those of other containers or the host12. References:
* Isolate containers with a user namespace | Docker Docs
* Docker overview | Docker Docs

= The command docker volume inspect nginx will not display a list of volumes for a specific container. This is because docker volume inspect expects one or more volume names as arguments, not a container name1. To display a list of volumes for a specific container, you can use the docker inspect command with the --format option and a template that extracts the volume information from the container JSON output2. For example, to display the source and destination of the volumes mounted by the container nginx, you can use the following command:
docker inspect --format=' { {range .Mounts}} { {.Source}}: { {.Destination}} { {end}}' nginx References:
* docker volume inspect | Docker Docs
* docker inspect | Docker Docs