Consul 1.15 Practice Test 10 — 10 Questions

Question 1

What is the role of a Consul server in a non-primary datacenter regarding ACLs?

Accepted Answer

They replicate the ACL state from the primary.. In a multi-datacenter Consul deployment, ACL state is authoritative only in the primary datacenter. Non-primary datacenters, including their servers, do not accept ACL writes; instead, they replicate the ACL state (tokens, policies, roles, and bindings) from the primary datacenter. This ensures a single source of truth for ACLs and prevents conflicting policies across datacenters. The replication is one-way, from primary to secondary, and is performed by the Consul servers in the secondary datacenter.

Answer

They ignore all ACLs.

Answer

They can write new ACL policies independently.

Answer

They become the primary if the original primary fails.

Question 2

A service 'orders' must call an upstream database service through its sidecar proxy. The upstream is registered in the same Consul datacenter and the operator wants the sidecar to discover it dynamically rather than hard-code an address. Which upstream configuration entry in the sidecar_service stanza accomplishes this?

Accepted Answer

destination_name set to the upstream service name, with no destination_type or fixed address.. Dynamic discovery for a sidecar upstream is achieved by naming the target service and letting the default service destination type drive catalog lookups. The proxy then watches Consul for healthy instances and balances across them. Static addressing, remote datacenter scoping, and prepared queries all change that behavior in ways the scenario does not require.

Answer

A local_bind_port and a destination_name, but with destination_type omitted and datacenter set to a remote value.

Answer

destination_type set to 'static' with a destination_name equal to the upstream's DNS name.

Answer

destination_type set to 'prepared_query' with a destination_name matching the upstream service.

Question 3

A service is registered with Consul using the HTTP API, but it is not appearing in DNS queries. The service definition includes a health check that is currently critical. What is the most likely reason for the DNS query failure?

Accepted Answer

The service's health check is critical, so Consul excludes it from DNS results.. Consul DNS returns only healthy service instances. When a service's health check is critical, the service is considered unhealthy and is excluded from DNS responses. Even though the service is registered and visible in the catalog, it will not resolve via DNS until the health check passes. This behavior ensures that clients only receive addresses of healthy instances, which is a core principle of service discovery in Consul.

Answer

The service is registered in a different datacenter than the DNS query.

Answer

The service name contains uppercase letters, which are not allowed in DNS queries.

Answer

The DNS interface is disabled by default and must be enabled in the agent configuration.

Question 4

A financial services firm requires that all service-to-service traffic inside its Consul 1.15 datacenter be encrypted and that services accept connections only when an explicit intention permits them. An operator enables Connect on all agents but services still accept plaintext traffic from non-mesh clients. Which additional step is required to enforce encryption and deny-by-default for the whole datacenter?

Accepted Answer

Set 'connect.enabled = true' in the agent configuration and register a default-deny intention, then ensure services only listen on loopback or are reachable solely through their sidecar proxy.. Enabling Connect provides the mTLS data plane, and a default-deny intention establishes least privilege so every allowed path must be stated explicitly. However, if the application still listens on a routable address, non-mesh clients can connect in plaintext and bypass the proxy entirely. Binding the workload to loopback or exposing it only through the proxy closes that gap, making encryption and deny-by-default enforceable for all traffic.

Answer

Enable TLS on the agents and rely on gossip encryption to protect service traffic.

Answer

Create a default-deny intention and set 'connect.enabled = true' in the server configuration only.

Answer

Configure the sidecar proxies to bind the service's original port and set a default-deny intention, so all inbound traffic must pass through the proxy.

Question 5

An operator wants to query the Consul catalog for all nodes that provide a service named `api` in the `us-east` datacenter. They need to retrieve the node names and addresses. Which Consul HTTP API endpoint should they use?

Accepted Answer

`GET /v1/catalog/service/api?dc=us-east`. The `/v1/catalog/service/:service` endpoint is designed to return all nodes and service instances for a specific service, optionally filtered by datacenter using the `dc` parameter. The health endpoint is more focused on health status, while the nodes endpoint lists all nodes. The agent services endpoint is local only.

Answer

`GET /v1/agent/services`

Answer

`GET /v1/catalog/nodes?dc=us-east`

Answer

`GET /v1/health/service/api?dc=us-east`

Question 6

A developer runs `dig @127.0.0.1 -p 8600 web.service.consul SRV` and receives no records, even though `consul catalog services` lists `web` and `consul members` shows the node as alive. A health check for the `web` service is registered and currently shows a critical status. What is the most likely cause of the empty SRV response?

Accepted Answer

The Consul DNS interface only returns records for services that have at least one passing health check.. Consul's DNS interface only returns records for service instances that have at least one passing health check. When the `web` service check is critical, Consul considers the instance unhealthy and omits it from DNS responses. This behavior ensures that clients only discover healthy endpoints, which is a core feature of Consul's service discovery.

Answer

The DNS query must use the `ANY` type to return SRV records for services with critical checks.

Answer

The SRV record requires a `tcp` prefix in the query, such as `_tcp.web.service.consul`.

Answer

The `web` service is registered in a different datacenter, so the local DNS server cannot resolve it.

Question 7

A developer needs to register a service named 'api' with Consul and ensure that it is only discoverable by consumers that explicitly request the 'v2' tag. Which Consul feature should be used?

Accepted Answer

Service tags. Service tags are the correct mechanism to allow consumers to filter service instances by a specific label such as 'v2'. By registering the service with the tag 'v2', the developer enables discovery queries that include that tag to return only the desired instances. This is a common pattern for versioned services or canary deployments.

Answer

ACLs

Answer

Health checks

Answer

Service meta

Question 8

A platform team operates a Consul 1.15 cluster with a primary datacenter in us-east-1 and a secondary datacenter in eu-west-1. After configuring ACLs for replication, they update a token policy in the primary datacenter. A security engineer in the secondary datacenter immediately checks the ACL token and finds the old policy still in effect. What is the most likely reason the policy change has not propagated yet?

Accepted Answer

The secondary datacenter has not yet received the updated policy because ACL replication is asynchronous and may take time to propagate.. ACL replication between datacenters is asynchronous, so changes made in the primary datacenter are not instantly visible in secondary datacenters. The security engineer checked before the next replication cycle, which explains why the old policy was still in effect. The other options describe mechanisms that are not part of Consul's ACL replication model.

Answer

ACL replication only works in one direction from secondary to primary, so changes made in the primary are not replicated.

Answer

The secondary datacenter must be restarted to pick up the new ACL policy from the primary datacenter.

Answer

The updated policy must be manually copied to each secondary datacenter using the consul acl policy create command.

Question 9

A cloud engineer is setting up a new Consul 1.15 datacenter that will join an existing WAN federation. The existing datacenter uses a specific gossip encryption key for the WAN pool. Which configuration parameter must be set on the new datacenter's servers to ensure they can participate in WAN gossip?

Accepted Answer

encrypt. The encrypt parameter sets the gossip encryption key. For WAN gossip to function between datacenters, all servers in the WAN pool must use the same encryption key. Configuring encrypt on the new datacenter's servers with the existing key allows them to securely join the WAN gossip pool.

Answer

primary_datacenter

Answer

acl_replication_token

Answer

retry_join_wan

Question 10

A platform team runs Consul agents in server mode on three dedicated hosts and client agents on each application node. They need a check that verifies the Consul servers themselves are reachable on the Serf LAN gossip port from the perspective of every client agent, so that a partitioned server is flagged even if it still answers HTTP requests on port 8500. Which check definition should they register on each client agent?

Accepted Answer

A TCP check with `tcp` set to the server's address on port 8301, registered as a check on each client agent.. Testing reachability of the Serf LAN port from each client agent requires a check that actually opens a connection to that port on the server host. A TCP check pointed at port 8301 does exactly that, and because it is registered on the client agent, the health status reflects the client's own network path rather than the server's self-assessment. HTTP or script checks that exercise the API can pass while gossip connectivity is broken.

Answer

An HTTP check against `http://<server>:8500/v1/status/leader` on each server, with `interval` set to 10s.

Answer

A UDP check with `udp` set to the server's address on port 8301, registered on each client agent.

Answer

A script check that runs `consul members -status=alive` and fails if any server is missing from the output.