Consul 1.15 Exam Questions and Answers

Apply 'production' or 'staging' tags to the service definition.

Consul tags are arbitrary key-value metadata attached to a service registration, so tagging instances 'production' or 'staging' lets upstream routing, such as prepared queries or intentions, select the correct subset by tag rather than by service name alone.

SRV

Consul's DNS interface publishes SRV records that carry both the target hostname and the service port, letting clients discover where a service listens. A records return only addresses, so SRV is the record type that answers service-address queries.

Use the 'passing' query parameter in the DNS request.

The 'passing' query parameter filters DNS responses so only instances whose health checks are all passing are returned, excluding any with warning or critical states. This satisfies the requirement that the service resolve only when every check passes.

To provide additional categorization or versioning for services.

Service tags supply arbitrary metadata labels that Consul exposes through the catalog and DNS interface, enabling categorisation, versioning and filtered queries. This satisfies the stem's requirement to describe the tag's purpose: attaching non-functional identifiers to a service registration for discovery and grouping, rather than configuring health checks or routing behaviour.

It returns an empty response (NXDOMAIN or empty set).

Consul DNS suppresses unhealthy instances from service lookups, so when every instance fails its health check, the query yields no records — NXDOMAIN or an empty answer set — rather than stale addresses. This satisfies the stem's requirement by preventing clients from receiving unreachable endpoints, letting them fail fast instead of timing out.

To define arbitrary key/value metadata for the service.

The meta block stores arbitrary user-defined key/value pairs attached to a service, such as version, owner or environment labels. It is purely descriptive metadata, not configuration, and does not affect health checking, routing or service discovery behaviour.

Serf (SWIM)

Consul servers use the Serf library, which implements the SWIM gossip protocol, to exchange membership and failure-detection messages across the WAN gossip pool. SWIM's infection-style dissemination lets datacentre servers converge on membership state without a central coordinator.

Secondary datacenters continue to operate, but ACL updates are blocked.

Secondary datacentres keep serving their local workloads because each maintains its own replicated state, but ACL token and policy updates originate from the primary and cannot propagate. The outage therefore blocks only ACL changes, not ongoing operations.

The changes are asynchronously replicated to all secondary datacenters.

ACL replication in Consul propagates token and policy changes from the primary to secondary datacenters asynchronously, satisfying the stem's cross-datacenter consistency requirement without blocking primary writes. Secondaries receive updates shortly after the primary commits them, so the change is not instantaneous but eventually consistent across all secondary datacenters.

consul members -wan

`consul members -wan` queries the WAN gossip pool directly, listing every datacenter's server agents with their gossip status and round-trip latency. That satisfies the stem's need for insight into WAN gossip state under high latency, unlike LAN-scoped commands or RPC-based tooling that bypass the gossip layer entirely.

By deploying Mesh Gateways.

Mesh gateways route server-to-server RPC traffic between datacenters over the WAN, so datacenters without direct network connectivity can still federate. Each gateway proxies traffic on behalf of its local servers, satisfying the stem's no-shared-network constraint without requiring VPN tunnels or routed peering.

consul join -wan <remote-server-address>

The -wan flag directs the join request over the WAN gossip pool rather than the LAN pool, which is the only way to federate separate Consul datacenters. Running consul join without -wan would attempt a LAN gossip join and fail to establish cross-datacenter federation.

deregister_critical_service_after

deregister_critical_service_after specifies the duration a service may remain critical before Consul automatically removes it from the catalog. Setting it to 24h satisfies the requirement, unlike checks or timeouts that only affect health status without deregistering the service.

After 30 seconds

A TTL check expects a heartbeat within its TTL window. Once 30 seconds elapse without one, Consul marks the check critical, so the service status changes immediately at that expiry rather than after a further grace period.

The agent receives a successful TCP handshake

A successful TCP handshake confirms the target port is open and accepting connections, which is the sole pass criterion for Consul's TCP health check. Unlike HTTP checks, no status code or payload is evaluated, so the SYN-ACK response itself satisfies the check's passing condition.

2xx

Consul's HTTP health check treats any response in the 2xx range as passing, marking the service healthy. Other ranges (3xx redirects, 4xx client errors, 5xx server errors) are interpreted as failing or warning states, so 2xx is the only range that satisfies the passing-state requirement.

TTL check

A TTL check inverts the model: the application must periodically call Consul's HTTP pass endpoint to reset the timer, and Consul marks it critical if the heartbeat lapses. This suits legacy apps lacking HTTP or TCP endpoints, since they signal health themselves.

curl -X PUT http://localhost:8500/v1/agent/check/pass/checkID

Consul's HTTP API exposes agent check endpoints, so a PUT to /v1/agent/check/pass/checkID marks the named TTL check as passing and resets its timer. This is the documented manual method for pushing a TTL check update without waiting for the service to report.

The proxy type (e.g., 'connect-proxy').

The `kind` field declares the service registration type, with `connect-proxy` marking a sidecar proxy instance rather than a standard service. This satisfies Consul's requirement to distinguish proxy registrations from application services, enabling Connect to route traffic through the correct proxy for mTLS enforcement.

Envoy

Envoy is the default sidecar proxy that Consul Connect injects alongside services, handling mTLS and L4 authorisation between them. It satisfies the stem because Consul ships Envoy as the built-in proxy, though the interface allows alternative proxies to be registered.

The application uses the local Consul agent API to fetch identity certificates.

With Consul Connect native integration, the application itself performs mTLS by calling the local Consul agent's API to obtain its leaf identity certificate and CA bundle, then uses those credentials directly for encrypted, authenticated service-to-service communication.

A mesh gateway deployment.

Cross-datacenter service-to-service traffic traverses the WAN through mesh gateways, which proxy Consul's mTLS connections between datacenters. Deploying a mesh gateway in each datacenter is required so the local sidecar can reach the remote service without direct network peering.

consul intention create -deny service-a service-b

This command directly creates a deny-type intention.

consul intention list

`consul intention list` queries the intention endpoint directly, returning every active intention across the mesh with source, destination and action. It satisfies the stem's requirement to display all active intentions without filtering by service name, unlike `consul intention check`, which tests a single source-destination pair.

512 KB

Consul's KV store caps each individual value at 512 KB, a hard limit imposed by the Raft replication and storage layer. Larger payloads must be split across multiple keys or stored externally, so 512 KB is the precise maximum for a single key's value.

/v1/session/create

Consul creates lock sessions through the session endpoint, which returns a session ID used as the lock-delimiter when acquiring KV locks. The /v1/session/create path is the documented API for this, unlike destroy or renew operations.

key

A key watch monitors a single KV pair path and fires its handler whenever that key's value changes, matching the requirement to trigger a script on one specific key. Other watch types cover prefixes, services, nodes or checks, not individual key modification.

15 seconds.

The session TTL defines the duration after which an un-renewed session is invalidated, releasing associated locks.

The session TTL is too low, causing premature expiration.

A session lock is released when its TTL elapses, so a TTL set too low expires the session prematurely and frees the lock without any explicit release call. This directly satisfies the stem's unexpected-release constraint: Consul's lock is tied to session lifetime, not to client intent.

index

Supplying the index parameter tells Consul to hold the blocking query open until the KV store's modify index exceeds that value, returning only on change or timeout. This satisfies the stem's requirement to watch for updates based on the last observed index, avoiding repeated polling.