Consul 1.15 Practice Test 13 — 15 Questions

Question 1

You observe that a session lock is being released unexpectedly. What is the most likely cause?

Accepted Answer

The session TTL is too low, causing premature expiration.. Consul sessions are tied to a TTL (Time-To-Live) that must be periodically renewed by the owning agent. If the TTL is set too low and the agent fails to renew in time—due to network latency, agent overload, or misconfiguration—the session expires, and any locks held by that session are automatically released. This is the most common cause of unexpected lock releases in Consul.

Answer

The Consul agent is in leader mode.

Answer

The index was not incremented.

Answer

The KV key was deleted.

Question 2

Which TWO are common use cases for Consul Connect?

Accepted Answer

Zero-trust networking.. Consul Connect is HashiCorp's service mesh feature within Consul, and option C (Zero-trust networking) is correct because Connect enforces identity-based authorization via mutual TLS (mTLS) between services, so no service is trusted by default based on network location. Option D (Secure service-to-service communication) is also correct because Connect provides automatic mTLS encryption, sidecar proxies (Envoy), and intention-based access control for east-west traffic between services. Options A (Managing server hardware), B (Creating virtual machines), and E (Configuring network switches) are incorrect because those are infrastructure provisioning and physical/virtual network device tasks handled by tools like Terraform, hypervisors, or switch management software, not by Consul Connect's service mesh capabilities.

Answer

Managing server hardware.

Answer

Creating virtual machines.

Answer

Configuring network switches.

Question 3

When multiple agents are in a cluster, how does Consul ensure that service discovery information is consistent across all nodes?

Accepted Answer

Via the Raft consensus protocol for catalog changes.. Consul uses the Raft consensus protocol to replicate catalog changes across server nodes, ensuring that service discovery information is consistent and fault-tolerant. Raft elects a leader that handles writes and replicates log entries to followers, guaranteeing that all servers converge on the same state. This is how Consul maintains a consistent service catalog across the cluster.

Answer

Using a centralized database like PostgreSQL.

Answer

By polling the leader every second.

Answer

By broadcasting all service updates to every node.

Question 4

When troubleshooting a failing health check, which tools are recommended? (Select TWO)

Accepted Answer

Consul UI. The Consul UI (A) is recommended because it visually displays the current health status of each service and node, showing which checks are passing, warning, or critical, and it lets you drill into the specific check output to identify the failure. Agent logs (B) are recommended because the Consul agent records detailed health check execution results, errors, and state transitions, which reveal why a check is failing (e.g., script exit codes, timeouts, or connection errors). DNS query (C) is not appropriate here because DNS only resolves service names to addresses and does not expose health check diagnostics. The Consul key-value store (D) holds arbitrary configuration data and is unrelated to health check troubleshooting. System metrics (E) provide resource usage data but do not show Consul health check status or failure reasons.

Answer

DNS query

Answer

Consul key-value store

Answer

System metrics

Question 5

A platform team stores service configuration under the Consul KV prefix `config/web/`. An operator runs `consul kv put config/web/timeout 30` at a time when the key already exists with value `45` and ModifyIndex `812`. The operator later needs to update the value only if no one else has changed the key since that write. Which Consul CLI invocation correctly performs this compare-and-swap using the index returned by the prior write?

Accepted Answer

consul kv put -cas=812 config/web/timeout 60. Consul KV supports optimistic concurrency through the check-and-set parameter, exposed on the CLI as `-cas`. Supplying the ModifyIndex observed from a previous operation makes the write succeed only when the key has not been modified since that index was read. If any other client wrote to the key in between, Consul rejects the update with a conflict, letting the operator re-read and retry rather than silently overwriting another change.

Answer

consul kv put -index=812 config/web/timeout 60

Answer

consul kv put -lock=812 config/web/timeout 60

Answer

consul kv put -modify-index=812 config/web/timeout 60

Question 6

Which of the following are true regarding TTL checks? (Select TWO)

Accepted Answer

They require the app to push updates. Option A is correct because TTL-based checks rely on the application or service itself to push updates (e.g., via an API or heartbeat) before the TTL expires; the monitoring system does not actively poll, so the app must refresh the record to keep the check healthy. Option D is correct because TTL checks are event-driven rather than scheduled: instead of running on a fixed interval, they expire after a defined time-to-live, making them the only check type without a polling interval. Option B is wrong because TTL checks are not automatically removed; they transition to a failed/expired state when the TTL lapses unless the app pushes an update. Option C is wrong because TTL checks are not inherently faster than script checks—speed depends on the push mechanism and network, not on the check type itself. Option E is wrong because TTL checks are explicitly not polled at a fixed interval; that description applies to standard interval-based checks.

Answer

They are automatically removed

Answer

They are faster than script checks

Answer

They are polled at a fixed interval

Question 7

Which THREE factors influence the mTLS handshake in a Consul Connect mesh?

Accepted Answer

The identity certificate issued to the service.. In Consul Connect, the mTLS handshake is driven by the cryptographic material each side presents and validates: option A, the identity certificate issued to the service, is the leaf certificate (with SPIFFE-style URI SAN) that the sidecar proxy presents to prove its service identity, so it directly determines the handshake. Option B, the CA root certificate, is the anchor both proxies use to verify the peer's leaf certificate chain, making it essential to the handshake's trust decision. Option C, the trust bundle, is the set of CA certificates (including roots and any intermediates) that Consul distributes to proxies so they can validate certificates during the handshake, especially across CA rotations. Option D, the intention status, is enforced by the sidecar proxy as an authorization decision after/around connection establishment and does not alter the TLS handshake cryptography. Option E, the service health check result, affects service discovery and routing but is not part of the mTLS handshake itself.

Answer

The intention status.

Answer

The service health check result.

Question 8

A developer needs to see which intentions currently govern traffic between services in a Consul 1.15 datacenter. Which command lists all intentions stored in the catalog?

Accepted Answer

consul intention list. Intentions are managed through the consul intention command family, and the list subcommand returns all stored rules for the datacenter. Commands that inspect the catalog or test a single source-destination pair do not enumerate the full set of authorization rules. For a complete audit, listing intentions is the correct operation.

Answer

consul connect intentions

Answer

consul intention check

Answer

consul catalog services -intentions

Question 9

You are operating a Consul 1.15 cluster with Connect enabled. A service named 'api' is registered with a sidecar proxy. You need to ensure that only the 'web' service can initiate connections to 'api'. You have created an intention that allows 'web' to connect to 'api', but you have not created any other intentions. What is the default behavior for other services trying to connect to 'api'?

Accepted Answer

They are denied because the default intention behavior is 'deny'.. In Consul Connect, intentions are deny by default. When you create an intention allowing 'web' to connect to 'api', that is the only allowed path. All other services are denied because there is no intention permitting them. This default-deny model is fundamental to Consul's security posture, ensuring that only explicitly authorized services can communicate, which reduces the attack surface.

Answer

They are allowed because the default intention behavior is 'allow'.

Answer

They are allowed only if they have a valid mesh certificate.

Answer

They are denied only if the 'api' service has a specific intention denying them.

Question 10

What is the correct way to specify a local bind port for an upstream service?

Accepted Answer

upstreams { destination_name = "svc", local_bind_port = 9000 }. The correct syntax for defining an upstream service with a local bind port in Consul's service definition is within the 'upstreams' block, specifying 'destination_name' and 'local_bind_port'. This tells the local proxy to listen on the specified port and forward traffic to the destination service. The other options use incorrect block names or syntax that Consul does not recognize.

Answer

service { upstream = { 9000 } }

Answer

proxy { upstream_port = 9000 }

Answer

upstream { port = 9000 }

Question 11

Which THREE of the following are components of a Consul Connect service definition?

Accepted Answer

proxy. Connect services typically use 'proxy', 'upstreams', and 'connect' blocks to define their behavior in the mesh.

Answer

acl_policy

Answer

kv_store

Question 12

You are deploying a legacy application that does not support HTTP or TCP health checks. Which Consul health check type should you configure to allow the application to signal its own health via a heartbeat API call?

Accepted Answer

TTL check. A TTL check is designed exactly for this scenario: the service (or an external script) must periodically call Consul's HTTP API to mark itself healthy, and if the TTL elapses without an update, Consul marks the check critical. This lets a legacy application that cannot expose HTTP/TCP endpoints signal its own health via a heartbeat.

Answer

HTTP check

Answer

TCP check

Answer

Script check

Question 13

You are troubleshooting a partition between two datacenters. The WAN gossip shows high latency. Which Consul CLI tool provides the best insight into the WAN gossip state?

Accepted Answer

consul members -wan. The consul members -wan command lists all members of the WAN gossip pool, showing their status, address, port, protocol, and build. It is the primary CLI tool for inspecting the health and membership of the WAN gossip layer that connects datacenters in a federation. High latency or partition issues in WAN gossip will be visible as failed or left members in this output, making it the best diagnostic choice.

Answer

consul operator raft list-peers

Answer

consul monitor

Answer

consul kv get

Question 14

Which of the following conditions can cause a health check to transition to the 'critical' state? (Select TWO)

Accepted Answer

The HTTP check times out. Option A is correct because a health check that times out — for example, an HTTP/HTTPS check that fails to receive a response within its configured timeout interval — is treated as a failed check and drives the target into the 'critical' state. Option B is correct because a script-based health check that returns a non-zero exit code signals failure (exit code 0 conventionally means success), so the check is marked unhealthy and transitions to 'critical'. Options C, D, and E do not belong: an idle service is not inherently unhealthy, a 200 OK response is a successful HTTP status that keeps the check healthy, and 50% disk usage is well below typical warning/critical thresholds, so none of these would trigger a critical health state.

Answer

The service is idle

Answer

The service returns a 200 OK

Answer

The disk space is 50% full

Question 15

What does the 'kind' field in a service definition specify for a Consul Connect service?

Accepted Answer

The proxy type (e.g., 'connect-proxy').. In a Consul Connect service definition, the `kind` field declares the type of service registration — most commonly `connect-proxy` for a sidecar proxy, but also `connect-native`, `terminating-gateway`, `ingress-gateway`, and `mesh-gateway`. It tells Consul how to treat the service in the service mesh, not what version or language it is. This is required for proxies and gateways so Consul can wire them into the mesh correctly.

Answer

The service version.

Answer

The datacenter location.

Answer

The language of the application.