Consul 1.15 Practice Test 12 — 15 Questions

Question 1

A new engineer is configuring a Consul server agent for a datacenter named 'west' and wants the agent to automatically rejoin the WAN federation after a restart without manual intervention. Which configuration setting should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

'retry_join_wan' with the addresses of server agents in the other datacenter, so the agent retries WAN join attempts on startup and after failures.. 'retry_join_wan' is the supported mechanism for resilient WAN federation membership. It lists remote server addresses and retries joins with backoff, so a restarted or temporarily disconnected server agent rejoins the WAN pool without operator action. Options that address LAN joins or address translation do not restore cross-datacenter membership.

Answer

'retry_join' with the LAN addresses of servers in the same datacenter, which also covers WAN rejoin as a side effect.

Answer

'translate_wan_addrs' set to true, which causes the agent to discover and join the WAN pool automatically.

Answer

'start_join_wan' with a single remote server address, which retries only once at startup and then stops.

Question 2

What is true about Consul health checks? (Select TWO)

Accepted Answer

They run on the local agent. They run locally on the agent and can be associated with specific services.

Answer

They only support GET requests

Answer

They always run on the server

Answer

They cannot be disabled

Question 3

An operations engineer registers an external PostgreSQL service on a Consul 1.15 client agent. The database listens on 10.20.30.40:5432 and is not managed by Consul, but a co-located exporter on the same VM exposes readiness at http://127.0.0.1:9187/ready. The engineer wants Consul to gate the service on the exporter's readiness signal while still advertising the database's real address and port to consumers. Which registration best achieves this?

Accepted Answer

Register the service with address 10.20.30.40 and port 5432, and attach an http check with target http://127.0.0.1:9187/ready.. A service definition's address and port fields describe where consumers should connect, while checks are independent probes the agent executes. Pointing an http check at the loopback exporter while advertising the database's real endpoint gives accurate discovery plus a meaningful readiness gate. The other approaches either mispublish the endpoint, detach the check from the service, or substitute a weaker signal.

Answer

Register only an http check named postgres-ready and rely on the check ID to imply the backing service.

Answer

Register the service with address 127.0.0.1 and port 9187, and attach a tcp check on the exporter port.

Answer

Register the service with address 10.20.30.40 and port 5432, and attach a tcp check to 10.20.30.40:5432 with a short interval.

Question 4

A Consul administrator is reviewing how check results propagate and wants to understand which factors determine whether a service instance is considered healthy in the catalog. Which two factors directly determine a service's aggregate health status in Consul? (Choose two.)

Accepted Answer

The status of the node-level checks associated with the agent hosting the service. Consul determines a service instance's health from two sources: the checks attached to that service and the checks attached to the node hosting it. A critical node check, such as a failed serfHealth, makes every service on that node unhealthy, while a critical service check makes only that instance unhealthy. Other attributes such as sibling service count, datacenter, or server version do not participate in the health computation.

Answer

The number of other services registered on the same agent

Answer

The Consul version running on the server that handles the catalog write

Answer

The datacenter in which the service is registered

Question 5

A service is registered with a check that has deregister_critical_service_after set to 30m. The service's check enters the critical state due to a transient network partition. The partition is resolved after 20 minutes, and the check returns to passing. What is the effect on the service registration?

Accepted Answer

The service remains registered because the check returned to passing before the 30-minute deregistration timer expired. The deregister_critical_service_after field starts a timer when a check becomes critical and resets that timer if the check leaves the critical state. In this scenario, the check returned to passing after 20 minutes, before the 30-minute threshold, so the service remains registered. Deregistration only happens if the check stays critical continuously for the full configured duration.

Answer

The service is deregistered immediately when the check becomes critical

Answer

The service is deregistered after 30 minutes from the initial registration, regardless of check state

Answer

The service is deregistered because it was critical at any point

Question 6

A service is registered with a health check that has the field deregister_critical_service_after set to "10m". The service's check has been in the critical state for 15 minutes. What will Consul do?

Accepted Answer

The service will be deregistered from the catalog.. When deregister_critical_service_after is set, Consul automatically deregisters a service if its check remains critical for longer than the specified duration. In this case, 15 minutes exceeds the 10-minute threshold, so the service is removed from the catalog. The check status does not change to warning, and maintenance mode is not involved.

Answer

The check will be marked as warning.

Answer

The service will be placed in maintenance mode.

Answer

The check will be restarted and re-evaluated.

Question 7

A Consul operator needs to register a health check that runs a custom binary located at /opt/checks/validate.sh every 15 seconds. The check should be considered passing only when the script exits with code 0. Which check definition correctly implements this?

Accepted Answer

{"check": {"id": "validate", "name": "validate", "args": ["/opt/checks/validate.sh"], "interval": "15s"}}. The args field is the correct way to define a script check in Consul 1.15. It takes an array containing the command and any arguments, and the check passes when the command exits with code 0. The script field is deprecated, and http and tcp fields define entirely different check types that cannot execute local binaries. Using args also avoids shell interpretation, which is safer and more predictable.

Answer

{"check": {"id": "validate", "name": "validate", "script": "/opt/checks/validate.sh", "interval": "15s"}}

Answer

{"check": {"id": "validate", "name": "validate", "tcp": "/opt/checks/validate.sh", "interval": "15s"}}

Answer

{"check": {"id": "validate", "name": "validate", "http": "http://localhost/opt/checks/validate.sh", "interval": "15s"}}

Question 8

An operator has two Consul datacenters, 'dc1' and 'dc2', federated via WAN gossip. They want to query the health of a service named 'web' in dc2 from a Consul agent in dc1 using the HTTP API. Which endpoint should they use?

Accepted Answer

GET /v1/health/service/web?dc=dc2. To query the health of a service in a remote federated datacenter, the correct endpoint is /v1/health/service/<service> with the dc query parameter set to the target datacenter. This endpoint returns the health checks and statuses for the service instances. The local Consul agent in dc1 will forward the request to dc2's servers because the datacenters are federated, allowing cross-datacenter health queries.

Answer

GET /v1/health/checks/web?dc=dc2

Answer

GET /v1/health/service/web?dc=dc1

Answer

GET /v1/catalog/service/web?dc=dc2

Question 9

An operator registers a service with a TTL check and forgets to send periodic updates. After the TTL expires, what status does Consul report for that check, and what is the immediate effect on service discovery?

Accepted Answer

The check becomes critical, and healthy instances of the service are excluded from DNS and health API results.. A TTL check must be updated within its TTL or the agent marks it critical. Because Consul's DNS and health API default to returning only passing instances, the service stops being discoverable as healthy until a new update arrives. This makes heartbeat reliability a critical design consideration for TTL-based checks.

Answer

The check becomes warning, and the service remains discoverable but is deprioritized in DNS results.

Answer

The check remains passing until the agent restarts, because TTL expiry is evaluated lazily.

Answer

The check transitions to unknown, and the service is still returned by DNS with a warning flag.

Question 10

An operations engineer wants a service registered in Consul to be deregistered automatically from the catalog when its health check has been critical for an extended period, without any external tooling. The service definition is written in HCL and loaded via the agent's config directory. Which combination of settings accomplishes this?

Accepted Answer

Set deregister_critical_service_after on the check and define the check inside the service block. Automatic removal of a service whose check stays critical is achieved with the check-level deregister_critical_service_after setting, which the local agent enforces. Defining the check inside the service block binds that behavior to the specific service instance. No external process is required, satisfying the requirement to avoid outside tooling. The other choices either do nothing automatically or reintroduce external scripts and manual tagging.

Answer

Set the check's status to "critical" at registration and rely on Consul's garbage collector

Answer

Set the service's tags to include "critical" and configure a prepared query to filter them

Answer

Enable enable_script_checks and add a script that calls the /v1/catalog/deregister endpoint

Question 11

An engineer registers an external service for a third-party payment gateway that cannot run a Consul agent. The registration uses an alias health check that points at a Consul node named 'edge-proxy-01' and a service named 'payment-gateway'. The external service stays healthy in the catalog as long as the proxy node and service are passing. A second engineer later adds a separate script check directly to the same external service definition. After a deployment, the payment gateway disappears from DNS even though the edge proxy node and its payment-gateway service both report passing. What is the most likely cause?

Accepted Answer

The added script check is failing on the node running the catalog registration, and any failing check on a service marks the whole service critical.. Service health in Consul is the aggregate of every check attached to that service, and the worst state wins. Adding a script check that fails on the registering node therefore pushes the external payment gateway to critical even though the alias check still reflects a passing edge proxy. Since DNS queries filter to passing instances by default, the service vanishes from resolution until the failing check is corrected.

Answer

Alias checks cannot coexist with other checks on the same service, so Consul silently discards the alias result when a second check is added.

Answer

The external service node name collides with the alias target node, causing Consul to overwrite the alias check status with the external node's own health.

Answer

The alias check requires the target service to be registered on the same agent, so it failed once the deployment moved the proxy to another datacenter.

Question 12

A team is standardizing health check definitions across a fleet of Consul 1.15 agents. They want checks that can be expressed entirely in HCL and do not require an external script interpreter on the node. Which two check types meet these criteria? (Choose two.)

Accepted Answer

http. Both http and tcp checks are evaluated directly by the Consul agent using its internal networking stack, and both are fully declarable in HCL without any external interpreter or binary. Script and docker checks depend on external runtimes, while alias checks merely mirror other checks and are not standalone probes. This makes http and tcp the portable choices for a standardized fleet.

Answer

docker

Answer

script

Answer

alias

Question 13

A team is writing Consul 1.15 service definitions for a set of gRPC services that expose the standard gRPC health checking protocol on a dedicated port, and they want Consul to actively probe that protocol rather than a plain TCP connect. Which two settings must be present in each check block to make Consul perform a gRPC health check against the service? (Choose two.)

Accepted Answer

interval = "10s". A gRPC health check is selected by the grpc field, which carries the address Consul dials, and like any active check it needs an interval to define the probe cadence. Together those two settings make the agent invoke the standard gRPC health checking protocol against the service; TLS, a method name, and a TCP address are not required to enable that behavior.

Answer

tcp = "127.0.0.1:50051"

Answer

method = "grpc.health.v1.Health/Check"

Answer

grpc_use_tls = true

Question 14

A developer registers a service 'web-frontend' with Consul using the HTTP API. The service registration includes a health check with a TCP check on port 8080 and an interval of '15s'. After registration, the developer queries the service using the DNS interface: 'dig @127.0.0.1 -p 8600 web-frontend.service.consul'. The query returns no results. Which of the following is the most likely reason?

Accepted Answer

The service is not passing its health check, so Consul DNS returns no records.. Consul DNS returns only service instances that are passing their health checks. If the TCP check on port 8080 is failing, the instance is marked critical and excluded from DNS results. The developer should check the health status via the HTTP API or UI. The other options are incorrect because the DNS query format is valid, the 'passing' parameter is not required, and service names do not need underscores.

Answer

The DNS query must include the datacenter, e.g., 'web-frontend.service.dc1.consul'.

Answer

The DNS interface requires the 'passing' parameter to return results for services with checks.

Answer

The service name must be prefixed with an underscore, e.g., '_web-frontend.service.consul'.

Question 15

You are configuring a Consul Watch to trigger a script whenever a specific KV key changes. Which type of watch should you define in your configuration file?

Accepted Answer

key. The 'key' watch type in Consul is specifically designed to monitor a single KV pair for changes. When the value of the specified key changes, the watch triggers the configured handler (e.g., a script). This matches the requirement of triggering a script whenever a specific KV key changes. Other watch types monitor different Consul resources such as events, services, or nodes, and are not suited for tracking a single KV key.

Answer

event

Answer

service

Answer

nodes