Consul 1.15 Practice Test 16 — 15 Questions

Question 1

An operator wants to list every key beneath the `services/web/` prefix, including nested paths, and see each key's associated flags and modify index. Which command returns that information?

Accepted Answer

consul kv get -recurse services/web/. Listing a KV subtree with metadata requires recursion. The `-recurse` flag on `consul kv get` returns every key under the prefix, each with its value, flags, and modify index, which is precisely the audit view the operator needs. A non-recursive get targets a single key, export targets backup workflows, and the catalog command serves a different subsystem.

Answer

consul catalog services services/web/

Answer

consul kv get services/web/

Answer

consul kv export services/web/

Question 2

A platform team runs a Consul 1.15 cluster where a legacy VM service registers its health check through the /v1/agent/check/register HTTP API rather than a service definition file. The check is a script check that takes about 40 seconds to finish on a busy host. Operators notice the check flaps to critical roughly every minute even though the script always exits 0 when run manually. The agent's check_update_interval is left at the default. Which change most directly resolves the flapping without altering the script itself?

Accepted Answer

Raise the check's timeout value so it exceeds the script's worst-case runtime.. Consul enforces the check's timeout when executing script checks; a script that runs longer than the timeout is terminated and the check reports critical. Because the observed runtime of roughly 40 seconds exceeds the default timeout, the check fails on schedule, producing the regular flapping. Increasing the timeout to exceed the worst-case runtime lets the script complete and report its genuine result.

Answer

Increase the agent's check_update_interval to a value larger than the check interval.

Answer

Set the check's status field to passing so the agent stops executing the script.

Answer

Change the check type from script to TTL and have the script call the TTL endpoint on success.

Question 3

You are deploying Consul servers in a new datacenter that will be a secondary in a federated environment. The primary datacenter is already configured with ACLs enabled and replication is working. You need to ensure the new secondary datacenter can replicate ACLs from the primary. Which configuration must be set on the new secondary's servers?

Accepted Answer

primary_datacenter set to the name of the primary datacenter and acl_replication_token with acl:read privileges.. To enable ACL replication in a secondary datacenter, you must set primary_datacenter to the name of the primary datacenter and provide acl_replication_token with a token that has acl:read privileges in the primary. These two settings allow the secondary servers to authenticate to the primary and read ACL policies, roles, and tokens. Without primary_datacenter, the agent does not know where to replicate from.

Answer

acl_replication_token with a token that has acl:write privileges in the primary datacenter.

Answer

acl_datacenter set to the primary datacenter name and acl_replication_token with acl:read privileges.

Answer

acl_replication_enabled set to true and acl_replication_token with acl:write privileges.

Question 4

What is the default value for the Consul KV flags field if not provided during a write?

Accepted Answer

0. When a KV pair is written without specifying the flags field, Consul defaults the flags value to 0. The flags field is a 64-bit unsigned integer used for application-specific metadata, and its zero value indicates no flags set.

Answer

1

Answer

null

Answer

-1

Question 5

A DevOps engineer is configuring a Consul service `payment-processor` that must be discoverable only when its health check is passing. The service is registered with a script health check that runs every 10 seconds. The engineer wants to ensure that DNS queries for `payment-processor` return only healthy instances. Which two actions should the engineer take? (Choose two.)

Accepted Answer

Include the `passing` parameter in the DNS query.. To ensure DNS queries return only healthy instances of `payment-processor`, the service must have an associated health check, and the DNS query must include the `passing` parameter. The health check association allows Consul to track the service's health, while the `passing` parameter filters results to only passing instances. Together, these actions guarantee that only healthy instances are discoverable via DNS.

Answer

Use the `?near` parameter in the DNS query to prioritize local instances.

Answer

Set the `"status": "passing"` field in the service registration.

Answer

Configure the service with `"enable_tag_override": true`.

Question 6

A developer is deploying a new service called 'inventory' with a Connect sidecar proxy. They want to verify that the sidecar is running and registered correctly. Which command should they use to check the status of the Connect-enabled service?

Accepted Answer

consul health service inventory. To check the status of a Connect-enabled service, you should use 'consul health service' because it returns the health checks for the service and its sidecar proxy. The sidecar proxy is registered as a separate service, so you can also query it directly. Commands like 'consul catalog nodes' only show node placement, not health or proxy status.

Answer

consul catalog nodes -service=inventory

Answer

consul services status inventory

Answer

consul connect status inventory

Question 7

A team stores rolling deployment state under `deploy/current`. To avoid a race where two operators both believe they own the release, the application must acquire the key only if it is not already held, and it must automatically release the key if the holding process dies. Which combination of Consul primitives achieves this?

Accepted Answer

Create a session, then call the KV acquire endpoint with that session and the key; the lock is released automatically when the session expires.. Mutual exclusion with automatic release requires a session-bound acquisition. The acquire operation is atomic, so only one session can hold the key, and because the key is tied to a session it is freed when that session ends. This pairs contention safety with failure recovery, which plain writes or check-and-set alone cannot provide.

Answer

Use consul kv put with the -cas flag set to the current ModifyIndex on every write attempt.

Answer

Write the key with consul kv put, then poll the key every second to detect a competing writer.

Answer

Register a service check for the operator and rely on the catalog health status to block duplicate writes.

Question 8

A platform team runs a Consul 1.15 cluster where a critical payment service is registered with a TTL health check. The service owner wants Consul to mark the check as critical if the application fails to renew the TTL for more than one minute. Which configuration field should be set in the service definition to enforce this behavior?

Accepted Answer

ttl. TTL health checks are passive: the application must periodically renew the check via the HTTP API. The ttl field defines the maximum time allowed between renewals before Consul transitions the check to critical. Other fields like interval or timeout apply to active checks, and deregister_critical_service_after controls removal, not the critical transition.

Answer

deregister_critical_service_after

Answer

interval

Answer

timeout

Question 9

A Consul operator observes that a web service registered on two nodes is only reachable through the DNS interface on one node. The service definition on both nodes is identical, including the same service name and port. What is the most likely cause?

Accepted Answer

The service on the unreachable node is failing its health check, so it is excluded from DNS results.. Consul's DNS interface only returns service instances that are passing their health checks. When two identical service definitions exist but only one appears in DNS results, the most probable cause is that the other instance is failing its health check. The operator should inspect the health check status for that service instance using the Consul UI or the /health/service API endpoint.

Answer

The node that is not returning results has not been configured with the correct datacenter.

Answer

The service definition is missing the 'tags' field, causing the DNS query to return only one instance.

Answer

The DNS interface requires the 'passing' parameter to be set to true to return all instances.

Question 10

You need to register a health check that triggers an alert when memory usage is high. Which type of check is most appropriate?

Accepted Answer

Script Check. A Script check runs an arbitrary executable on the Consul client at a defined interval and interprets its exit code (0 = passing, 1 = warning, other = critical), making it the only check type that can inspect local system metrics like memory usage. HTTP, TCP, and gRPC checks only verify reachability or protocol-level responses and cannot read OS-level resource counters.

Answer

gRPC Check

Answer

HTTP Check

Answer

TCP Check

Question 11

Which command displays all active intentions in the Consul mesh?

Accepted Answer

consul intention list. The command 'consul intention list' displays all active intentions in the Consul mesh. Intentions define which services are allowed to communicate with which other services when Connect is enabled. The list command shows the source, destination, action (allow/deny), and precedence.

Answer

consul connect intentions

Answer

consul kv get intentions

Answer

consul services intentions

Question 12

A Consul operator is using the HTTP API to register a web service with an external health check script. The operator wants to ensure that if the service process fails but the node remains up, the service is marked unhealthy and removed from DNS query results. Which of the following API endpoints should the operator use to register the service and its check together?

Accepted Answer

PUT /v1/agent/service/register. The agent service register endpoint accepts a JSON payload that can include both the service definition and an associated check. This allows the agent to manage the check and update the service's health status. When the external script fails, the check becomes critical, and the service is excluded from DNS results. Other endpoints either register checks separately or bypass the agent's health monitoring.

Answer

PUT /v1/agent/service/deregister

Answer

PUT /v1/catalog/register

Answer

PUT /v1/agent/check/register

Question 13

What is the purpose of the 'Behavior' field when creating a Consul session?

Accepted Answer

To specify what happens to locks on session invalidation.. The 'Behavior' field in a Consul session controls what happens to locks held by the session when the session is invalidated (e.g., due to TTL expiry or explicit destruction). The two valid values are 'release' (default), which releases all locks, and 'delete', which deletes the locks. This determines the fate of held locks upon session invalidation.

Answer

To define the node affinity.

Answer

To determine if the session can be renewed.

Answer

To set the session priority.

Question 14

An operator needs to delete the single KV entry `app/temp/cache-ttl` but must leave every other key under `app/temp/` untouched. Which command performs exactly that deletion?

Accepted Answer

consul kv delete app/temp/cache-ttl. Deleting a single KV entry requires passing its full path to `consul kv delete` with no recursion flag. Consul then removes only that exact key, leaving all siblings under the same prefix intact. Recursion, check-and-set conditions, and empty-value writes all change behavior in ways that either over-delete, fail, or merely blank the value.

Answer

consul kv delete -cas=0 app/temp/cache-ttl

Answer

consul kv delete -recurse app/temp/

Answer

consul kv put app/temp/cache-ttl ""

Question 15

A developer stores a feature flag at the key `config/features/new-ui` in Consul KV and wants to atomically create it only if it does not already exist, failing the write if the key is present. Which Consul CLI command accomplishes this?

Accepted Answer

consul kv put -cas=0 config/features/new-ui true. Atomic create-if-absent writes in Consul KV are performed with the check-and-set flag. Supplying a CAS value of zero conditions the write on the key not yet existing, because a missing key reports a ModifyIndex of zero. If another client created the key first, its ModifyIndex becomes non-zero and the conditional write returns an error rather than overwriting it.

Answer

consul kv put -flags=0 config/features/new-ui true

Answer

consul kv put -acquire config/features/new-ui true

Answer

consul kv put -modify-index=0 config/features/new-ui true