Consul 1.15 Practice Test 14 — 15 Questions

Question 1

Which component acts as the default sidecar proxy for Consul Connect?

Accepted Answer

Envoy. Envoy is the default and recommended sidecar proxy for Consul Connect.

Answer

Nginx

Answer

HAProxy

Answer

Linkerd

Question 2

What is the effect of changing the 'interval' parameter in a service health check?

Accepted Answer

It changes the frequency at which the check runs.. The `interval` parameter in a Consul health check definition controls how often the check is executed — for example, `interval = "10s"` runs the check every 10 seconds. It directly governs the polling frequency of the check script, HTTP endpoint, or TCP probe, and therefore how quickly Consul detects a state change.

Answer

It changes the DNS TTL.

Answer

It changes the weight of the service.

Answer

It changes the timeout of the check.

Question 3

You are using a Consul Watch to monitor KV changes. What does the 'handler' field specify?

Accepted Answer

The path to the executable to trigger.. In a Consul watch configuration, the `handler` field specifies the path to an executable that Consul invokes when the watched data changes. Consul passes the watch results as JSON on stdin to the handler, and the handler can act on the change (e.g., reload a service, update a config file). It is not a filter, server address, or key path.

Answer

The address of the Consul server.

Answer

The filter criteria for the watch.

Answer

The KV key to watch.

Question 4

To verify if two datacenters are connected via WAN, which command shows the remote datacenter's server nodes?

Accepted Answer

consul members -wan. The `consul members -wan` command queries the WAN gossip pool and lists all Consul servers across every datacenter that are federated via the WAN. It shows the remote datacenter's server nodes, confirming WAN connectivity. This is the only command that explicitly targets the WAN gossip layer, which is used for cross-datacenter communication.

Answer

consul members

Answer

consul info

Answer

consul operator raft list-peers

Question 5

When a session is associated with a lock, what happens to the lock if the session is deleted?

Accepted Answer

The lock is released.. Consul locks are bound to the session that acquired them. When a session is deleted — whether explicitly via the session destroy API or implicitly through TTL expiry — Consul automatically releases every lock and KV entry associated with that session. This is the core safety property that makes session-based locking reliable for leader election.

Answer

The lock remains held by the server.

Answer

The lock is held until the key is deleted.

Answer

The lock transfers to a new session.

Question 6

What is the purpose of the 'check' field inside a 'service' object in a Consul configuration file?

Accepted Answer

To define the health status requirements. In a Consul service definition, the check field (or checks array) declares one or more health checks associated with that service, such as HTTP, TCP, script, TTL, or gRPC checks. Consul uses these checks to determine whether the service instance is healthy and should be returned by DNS or the catalog API. The correct answer is that it defines the health status requirements for the service.

Answer

To provide credentials for the service

Answer

To enable service discovery

Answer

To set the service weight

Question 7

When using 'Consul Connect native' integration, how does the application handle mTLS?

Accepted Answer

The application uses the local Consul agent API to fetch identity certificates.. In native integration, the application uses the Consul API to retrieve certificates and handles the mTLS handshake itself.

Answer

mTLS is disabled by default for native apps.

Answer

The sidecar proxy handles all mTLS.

Answer

The Consul agent performs the TLS handshake on behalf of the app.

Question 8

Which file format is used for Consul configuration?

Accepted Answer

HCL or JSON. Consul accepts configuration in either HCL or JSON format. HCL is the more human-readable format used in most examples, while JSON is supported for programmatic generation and legacy compatibility. Both are parsed into the same configuration structure.

Answer

INI

Answer

YAML

Answer

XML

Question 9

What is the benefit of using a Mesh Gateway in a multi-datacenter deployment with overlapping IP space?

Accepted Answer

It allows cross-datacenter traffic without routing overlapping networks.. A mesh gateway in Consul enables service-to-service communication across datacenters by routing traffic through a gateway that terminates and re-originates the connection, rather than relying on direct IP routing between datacenters. This is essential when two datacenters have overlapping CIDR ranges, because the mesh gateway provides a single, routable entry point that abstracts the underlying overlapping addresses. Without it, Consul's native cross-datacenter routing (which uses the remote datacenter's IPs) would fail due to routing conflicts.

Answer

It reduces the server memory usage.

Answer

It eliminates the need for ACLs.

Answer

It increases the gossip speed.

Question 10

Which feature allows you to define a health check that depends on the health of another service?

Accepted Answer

You must implement this logic in a script check. Consul does not have a native 'service dependency' health check type. To make one service's health depend on another, you must implement the logic yourself, typically in a script check that queries the Consul API or DNS for the other service's health and returns an appropriate exit code. This is the documented and practical approach for cross-service health dependencies.

Answer

Service dependency field

Answer

Cross-service monitoring

Answer

Service grouping

Question 11

Which command-line interface command is used to set a value in the Consul KV store?

Accepted Answer

consul kv put. The correct Consul CLI command to set a value in the KV store is 'consul kv put'. This command writes a value to the specified key path. For example, 'consul kv put mykey myvalue' stores 'myvalue' at the key 'mykey'. The other commands do not exist in the Consul CLI.

Answer

consul kv write

Answer

consul kv set

Answer

consul kv update

Question 12

You want to ensure that specific services in a remote datacenter are only accessible to certain local services. How can you achieve this?

Accepted Answer

Use Consul Intentions.. Consul Intentions define allow/deny rules for service-to-service communication, including across datacenters. They are the correct mechanism to restrict access to specific services in a remote datacenter based on the source service's identity.

Answer

Use firewall rules on all nodes.

Answer

Modify DNS resolution.

Answer

Use ACL tokens.

Question 13

When defining a TCP health check, what is the primary indicator that the check is 'passing'?

Accepted Answer

The agent receives a successful TCP handshake. For a TCP health check, Consul considers the check passing if it can successfully establish a TCP connection to the specified port. This is indicated by a successful TCP handshake (SYN, SYN-ACK, ACK). No application-level response is required.

Answer

The port is listed in netstat

Answer

The service responds with a specific string

Answer

The service returns a 200 OK

Question 14

What happens to the gossip protocol if the 'encrypt' key is mismatched between two datacenters trying to join via WAN?

Accepted Answer

The join fails.. If the gossip encryption key ('encrypt' for LAN or 'encrypt_wan' for WAN) is mismatched between two datacenters attempting to join via WAN, the join fails because Serf cannot decrypt the gossip messages from the remote cluster. Encryption keys must match exactly for the WAN gossip pool to form. There is no fallback to unencrypted communication.

Answer

The join proceeds with warnings.

Answer

The connection defaults to unencrypted.

Answer

Only metadata is encrypted.

Question 15

What is the primary benefit of using a Mesh Gateway in a Consul Connect architecture?

Accepted Answer

It enables communication between services in different datacenters.. Mesh gateways provide a single point of ingress/egress for cross-datacenter traffic, reducing the need for direct cross-DC networking.

Answer

It encrypts traffic at the storage layer.

Answer

It improves local mTLS performance.

Answer

It provides load balancing for local services.