Consul 1.15 Practice Test 17 — 15 Questions

Question 1

A service definition includes a 'meta' block. What is the intended use of this block?

Accepted Answer

To define arbitrary key/value metadata for the service.. The 'meta' block in a service definition is used to define arbitrary key/value metadata for the service. This metadata is not used by Consul for routing or health checks but can be used by external tools, for filtering in the UI, or for custom logic in service discovery. It is a flexible way to attach additional information to a service.

Answer

To configure service discovery timeouts.

Answer

To override the default health check interval.

Answer

To store authentication credentials.

Question 2

A developer uses the Consul KV store to coordinate a rolling deployment. They write a key `deploy/status` with the value `in-progress` using `consul kv put deploy/status in-progress`. Later, they want to check the current value of that key without any blocking or long-polling behavior. Which command should they run?

Accepted Answer

consul kv get deploy/status. The correct command is the one that performs a simple read of a single key. `consul kv get` retrieves the value and optional metadata for the specified key, matching the developer's requirement to check the current value without blocking. The other commands either write, watch, or export data, none of which satisfy a straightforward read.

Answer

consul kv put deploy/status

Answer

consul kv export deploy/status

Answer

consul watch -type=key -key=deploy/status

Question 3

A Consul operator defines a service check with the following HCL block: check { id = "web-api" name = "Web API HTTP" http = "http://localhost:8080/health" interval = "10s" timeout = "1s" }. The endpoint consistently responds in 1.4 seconds but returns HTTP 200. What status will Consul report for this check?

Accepted Answer

critical, because the check exceeded its configured one-second timeout. The HTTP check fails when the request cannot complete within the configured timeout, even if the endpoint eventually returns a success code. Because the probe takes 1.4 seconds against a one-second timeout, Consul abandons the request and marks the check critical. The interval governs probe frequency, not latency evaluation, and HTTP 200 alone cannot keep the check passing when the timeout is breached.

Answer

maintenance, because the check is temporarily unavailable

Answer

warning, because the response was slower than the check interval

Answer

passing, because the endpoint returned HTTP 200

Question 4

A Consul cluster has three server nodes and multiple client agents. A service 'db' is registered on two nodes, each with a health check that includes 'DeregisterCriticalServiceAfter' set to '1h'. One of the nodes experiences a network partition and becomes unreachable. After 2 hours, the node rejoins the cluster. What happens to the service instance on that node?

Accepted Answer

The service instance is deregistered after 1 hour of the check being critical, even if the node is still unreachable.. When a node becomes unreachable, the health check for the service will eventually be marked critical. With 'DeregisterCriticalServiceAfter' set to 1h, Consul will deregister the service instance after it has been critical for that duration. This happens even if the node is still partitioned. When the node rejoins, if the service is still running and registered with the local Consul agent, it may be re-registered. The other options are incorrect because they misstate the timing or conditions for deregistration.

Answer

The service instance is only deregistered if the node is permanently removed from the cluster.

Answer

The service instance remains registered indefinitely because the node is part of the Consul cluster.

Answer

The service instance is immediately deregistered when the node becomes unreachable.

Question 5

What is the function of the 'consul intention check' command?

Accepted Answer

To verify if traffic is allowed between two services.. The 'consul intention check' command verifies whether traffic is allowed between two services based on the current intentions. It takes a source and destination service and returns whether the connection is allowed or denied, along with the matching intention. This is useful for troubleshooting connectivity issues in the mesh.

Answer

To list all intentions.

Answer

To create a new intention.

Answer

To delete an intention.

Question 6

A security team requires that a service 'reporting' only accept connections from services presenting a valid mesh certificate issued by the Connect CA, and that all other traffic be rejected. They have registered reporting with a sidecar proxy. Which combination ensures this behavior?

Accepted Answer

Rely on the default deny behavior of intentions and create allow intentions only for the intended callers.. Connect's built-in default-deny behavior means a sidecar rejects any inbound connection without a matching allow intention, and mTLS ensures only holders of valid Connect certificates can attempt the handshake. Explicit allow intentions for the intended callers complete the configuration. Protocol settings, agent TLS flags, and wildcard allows do not provide the required selective access.

Answer

Set 'protocol' to 'tcp' in a service-defaults entry and create a deny intention for all other services.

Answer

Create a wildcard allow intention for all sources, then use ACLs to restrict which services can obtain a certificate.

Answer

Disable TLS verification on the sidecar by setting verify_outgoing to false.

Question 7

You are using a Consul KV entry to store a feature flag. You want the flag to be automatically deleted if the node that owns it becomes unhealthy. Which Consul API operation should you use?

Accepted Answer

Create a session with the node's checks, then call PUT /v1/kv/feature/flag?acquire=<session> with the flag value.. Acquiring a KV entry with a session establishes a lock. When the session's health checks fail, Consul invalidates the session and releases the lock, deleting the key. This is the intended mechanism for tying a KV entry's lifetime to node health. The other operations either set metadata, perform conditional writes, or attempt to release a lock that was never acquired.

Answer

Call PUT /v1/kv/feature/flag?cas=0 with the flag value, then configure a watch to delete the key when the node fails.

Answer

Call PUT /v1/kv/feature/flag?flags=1 with the flag value, then rely on Consul's garbage collector to remove it when the node fails.

Answer

Call PUT /v1/kv/feature/flag?release=<session> with the flag value, then create a session for the node.

Question 8

A platform team stores feature-flag values under the prefix `config/features/`. They need to read the single key `config/features/checkout` and receive its value along with metadata such as `CreateIndex` and `ModifyIndex` in the response. Which Consul CLI command accomplishes this?

Accepted Answer

consul kv get config/features/checkout. Reading one exact key path with `consul kv get` returns the stored value together with the key's metadata, including CreateIndex and ModifyIndex, which the team needs for change tracking. The other commands either modify or delete the key or export a prefix in a different JSON format, so they cannot deliver a single-key read with its index fields.

Answer

consul kv put config/features/checkout

Answer

consul kv delete config/features/checkout

Answer

consul kv export config/features/checkout

Question 9

A service 'inventory' is registered in Consul 1.15 with Connect enabled. You need to verify that the sidecar proxy for 'inventory' is running and healthy. Which command should you use?

Accepted Answer

consul health service inventory-sidecar-proxy. Consul registers a sidecar proxy for each Connect-enabled service with a naming convention of '<service>-sidecar-proxy'. The 'consul health service' command retrieves the health checks and status for that proxy, confirming it is running and passing checks. This is the standard way to verify sidecar health in Consul.

Answer

consul connect proxy -sidecar-for inventory

Answer

consul services status inventory

Answer

consul intention check inventory

Question 10

Which HTTP method is used to create or update a key in the Consul KV store?

Accepted Answer

PUT. The Consul KV store uses the PUT HTTP method to create or update a key. A PUT to /v1/kv/<key> with the value in the request body either creates the key if it does not exist or overwrites it if it does, making PUT the idempotent write operation for KV entries.

Answer

GET

Answer

DELETE

Answer

POST

Question 11

You are implementing a distributed semaphore using Consul KV and sessions. You create a session with a TTL of 60 seconds and use the 'acquire' parameter to lock a key. After acquiring the lock, the application holding the session experiences a 90-second pause due to a garbage collection stop-the-world event. The Consul agent on the node is healthy and continues to renew the session. What happens to the lock?

Accepted Answer

The lock remains held because the Consul agent renews the session, and the application's pause does not affect the session.. Session TTL renewal is handled by the Consul agent, not the application. Even if the application is paused, the agent continues to renew the session, keeping the lock held. This can lead to a situation where a lock is held by a session whose application is not actively using it. To avoid this, applications should explicitly release locks or use health checks that reflect application liveness.

Answer

The lock is released because the session TTL expires after 60 seconds without renewal from the application.

Answer

The lock is released immediately when the garbage collection pause begins because Consul detects the application is unresponsive.

Answer

The lock is released after 90 seconds when the application resumes and fails to renew the session in time.

Question 12

You need to verify if a node has successfully joined the cluster for service discovery. Which tool confirms this?

Accepted Answer

consul members. The `consul members` command queries the gossip protocol (LAN/WAN) and lists all nodes that are currently part of the Consul cluster, showing their status (alive, left, failed) and role. This directly confirms whether a node has successfully joined the cluster, as it relies on the Serf gossip layer that manages cluster membership. Other commands like `consul catalog nodes` query the catalog, which may not reflect real-time membership status if the node is unreachable or has not synced.

Answer

consul catalog nodes

Answer

consul info

Answer

consul services

Question 13

When configuring a Service-specific health check, what is the impact of setting the 'expose' field to true?

Accepted Answer

The check status is exposed on the HTTP interface. Setting 'expose' to true allows the service to expose its health checks via the local agent's HTTP interface, enabling external access to the health check status.

Answer

The service is automatically registered with a Load Balancer

Answer

The check is bypassed

Answer

The agent automatically upgrades the check to HTTP

Question 14

What is the recommended approach for running health checks on a service that is part of a non-containerized, multi-process architecture?

Accepted Answer

Run one check per service definition. For a non-containerized, multi-process service, Consul's recommended approach is to define one health check per service definition so each process or component can be independently verified. This gives accurate per-process health visibility and avoids the false 'passing' state that a single coarse check can produce when one subprocess dies while another stays up.

Answer

Only check the parent process

Answer

Use only TCP checks

Answer

Use a single script check that kills the service

Question 15

If a service has multiple health checks associated with it, when is the service itself considered 'critical'?

Accepted Answer

When any check is critical. In Consul, a service is considered 'critical' if any of its associated health checks are in a critical state. This is because the service's overall health is an aggregation where the worst status among all checks determines the service status. Therefore, a single critical check makes the entire service critical.

Answer

When a majority of checks are critical

Answer

When all checks are critical

Answer

Only if the primary check is critical