Explanation
This set of commands can identify the published port(s) for a container. The docker container inspect command shows low-level information about a container in JSON format. This information includes the network settings of the container, such as the port bindings and exposed ports. The docker port command shows the public port(s) that are mapped to a private port inside the container. By using these two commands, you can identify the published port(s) for a container. References:
https://docs.docker.com/engine/reference/commandline/container_inspect/,
https://docs.docker.com/engine/reference/commandline/port/

Explanation
A DTR security scan does not detect image configuration poor practices, such as exposed ports or inclusion of compilers in production images. A DTR security scan is a feature that scans images for known vulnerabilities in the software packages or dependencies that are installed in the image. A DTR security scan does not check for image configuration poor practices, such as exposing unnecessary ports or including unnecessary tools in production images. To avoid image configuration poor practices, you should follow the Dockerfile best practices and use multi-stage builds to optimize your images. References:
https://docs.docker.com/ee/dtr/user/manage-images/scan-images-for-vulnerabilities/,
https://docs.docker.com/develop/develop-images/dockerfile_best-practices/,
https://docs.docker.com/develop/develop-images/multistage-build/

Explanation
Using either EXPOSE or --publish to access the container on the bridge network does not create a container that is reachable from its host's network. EXPOSE and --publish are options that specify which ports on the container should be exposed or published to the outside world. They do not affect which network the container is connected to. By default, Docker creates and connects containers to a bridge network, which is an internal network that isolates containers from each other and from the host. To create a container that is reachable from its host's network, you need to use --network host option, which connects the container to the host's network stack. References: https://docs.docker.com/engine/reference/builder/#expose,
https://docs.docker.com/engine/reference/run/#expose-incoming-ports,
https://docs.docker.com/network/bridge/, https://docs.docker.com/network/host/

Explanation
Better logical separation of Dockerfile instructions for increased readability is not an advantage of multi-stage builds. Multi-stage builds are a feature that allows you to use multiple FROM statements in your Dockerfile.
Each FROM statement begins a new stage of the build. You can selectively copy artifacts from one stage to another, leaving behind everything you don't want in the final image. The main advantage of multi-stage builds is that they allow you to reduce the size of your final image by only including the essential components and dependencies. Another advantage of multi-stage builds is that they allow you to optimize the build cache by grouping similar instructions in each stage. Better logical separation of Dockerfile instructions for increased readability is not an inherent advantage of multi-stage builds, as it depends on how you write and organize your Dockerfile. References: https://docs.docker.com/develop/develop-images/multistage-build/,
https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#use-multi-stage-builds

Explanation
A physical machine participating in the swarm is a node in the context of a swarm mode cluster. A node is an instance of the Docker engine participating in the swarm. A node can be either a physical machine or a virtual machine. Nodes are either managers or workers. Managers maintain cluster state and manage cluster tasks.
Workers execute tasks assigned by managers. References:
https://docs.docker.com/engine/swarm/key-concepts/#nodes-and-services,
https://docs.docker.com/engine/swarm/how-swarm-mode-works/nodes/