Consul 1.15 Practice Test 18 — 15 Questions

Question 1

An operator wants to atomically create a key `locks/leader` only if it does not already exist, so that two competing processes cannot both become leader. Which Consul KV operation should be used?

Accepted Answer

A `consul kv put` using the `-cas` flag set to 0. Atomic create-if-absent is achieved with the check-and-set mechanism. Supplying `-cas 0` tells Consul to perform the write only when the key's ModifyIndex is zero, meaning the key is absent. The first writer succeeds; any later writer sees a non-zero index and is rejected, ensuring a single leader without a race condition.

Answer

A normal `consul kv put` with no extra flags

Answer

A `consul kv get` followed by a `consul kv put`

Answer

A `consul kv put` with the `-flags` option set to a unique value

Question 2

Which THREE network considerations are vital for Consul WAN federation?

Accepted Answer

Sufficient bandwidth for gossip heartbeat messages.. Option A is correct because Consul WAN federation relies on the gossip protocol (Serf) to exchange heartbeat messages between datacenter servers, and insufficient bandwidth can cause missed heartbeats, false failures, and instability in the federated cluster. Option D is correct because WAN gossip uses port 8302 over both TCP and UDP, so firewall rules must permit both protocols on that port for servers in different datacenters to communicate. Option E is correct because WAN federation fundamentally requires that server nodes in each datacenter can reach server nodes in the other datacenters, typically over the WAN gossip port and the server RPC port (8300), to join and maintain the federation. Option B is not required because each datacenter can use its own independent NAT or network egress; a shared NAT gateway is not a Consul WAN federation requirement. Option C is not required because while consistent MTU can help avoid fragmentation issues, Consul does not mandate uniform MTU settings across regions for WAN federation to function.

Answer

A shared NAT gateway for all datacenters.

Answer

Uniform MTU settings across all regions.

Question 3

Which of the following is a key feature of Consul Connect's intentions?

Accepted Answer

Service authorization (allow/deny).. Consul Connect's intentions define which services are allowed to communicate with which other services. They are essentially authorization policies that allow or deny connections based on service identity. Intentions are a core feature for enforcing zero-trust security in a service mesh.

Answer

Global load balancing.

Answer

Certificate rotation.

Answer

Traffic splitting.

Question 4

What is the impact of setting 'enable_tag_override' to true in a service definition?

Accepted Answer

It allows tags to be modified via the API without updating the config file.. Setting 'enable_tag_override' to true in a service definition allows tags to be modified via the API without updating the service's configuration file. This is useful for dynamic tag changes, such as adding a tag for maintenance mode. By default, this is false, meaning tags are managed by the config file and API changes are overwritten on restart.

Answer

It ignores all tags in the catalog.

Answer

It forces all nodes to update their tags.

Answer

It prevents tags from being used in DNS lookups.

Question 5

When using Consul DNS for a service, what happens if no instances are healthy?

Accepted Answer

It returns an empty response (NXDOMAIN or empty set).. Consul DNS returns only healthy service instances. If no instances are healthy, the query returns an empty response — typically NXDOMAIN for the service name or an empty answer set — rather than an error or unhealthy instances. This signals to clients that no healthy backend is available.

Answer

It returns a 500 error.

Answer

It redirects to a standby service.

Answer

It returns all instances regardless of health.

Question 6

Which THREE of the following are true about Consul KV keys?

Accepted Answer

Keys support storing binary data. Option B is correct because Consul KV values are stored as raw bytes, so any binary data (not just UTF-8 text) can be written and retrieved via the KV API or `consul kv put`/`consul kv get`. Option C is correct because Consul KV keys are case-sensitive, meaning `App/Config` and `app/config` are distinct keys. Option E is correct because keys use slash-delimited paths such as `service/web/port`, giving a folder-like hierarchy that can be listed with `consul kv get -recurse` or the `?recurse` API parameter. Option A is wrong because a leading slash is not required; keys like `foo/bar` are valid without one. Option D is wrong because spaces are permitted in Consul KV keys (they are just bytes in the key string), so there is no rule forbidding them.

Answer

Keys must start with a slash

Answer

Keys cannot contain spaces

Question 7

You want to delete a key and all its children in the KV store using the CLI. Which flag should you use?

Accepted Answer

-recurse. The -recurse flag in the CLI allows the delete operation to act on the key and all nested keys.

Answer

-force

Answer

--all

Answer

--cascade

Question 8

In a multi-datacenter environment, what happens if the 'primary_datacenter' server cluster becomes unavailable?

Accepted Answer

Secondary datacenters continue to operate, but ACL updates are blocked.. In Consul's multi-datacenter model, the primary datacenter is authoritative for ACL token replication and certain global operations. If the primary becomes unavailable, secondary datacenters continue serving their local services and DNS/HTTP queries, but ACL updates and token replication are blocked until the primary returns. This design prioritizes availability of local service discovery over global consistency.

Answer

Secondary datacenters elect a new primary.

Answer

All secondary datacenters immediately shut down.

Answer

The entire WAN federation is dismantled.

Question 9

You are deploying a blue/green release where the active environment is selected by the value of the Consul KV key `deploy/active-color`, currently set to `blue`. Your CI pipeline must atomically switch the value to `green` but only if the current value is still `blue`, and must fail if another pipeline already changed it. Which API operation should the pipeline use?

Accepted Answer

A `PUT` to `/v1/kv/deploy/active-color` with the `cas` query parameter set to the `ModifyIndex` of the current `blue` value.. Atomic conditional writes in Consul KV are performed with the check-and-set mechanism: the client reads the key to learn its `ModifyIndex`, then issues a write carrying that index in the `cas` parameter. If the stored index no longer matches, the write is rejected and the pipeline knows another actor modified the key. This gives exactly the fail-if-changed semantics a blue/green switch needs.

Answer

A `PUT` to `/v1/txn` that writes the new value and deletes the old one in the same transaction, using the key name as the version token.

Answer

A `PUT` to `/v1/kv/deploy/active-color` after acquiring a Consul session lock on the same key using `/v1/kv/deploy/active-color?acquire=<session>`.

Answer

A `PUT` to `/v1/kv/deploy/active-color?flags=1` with the body `green`, relying on the flags bit to reject concurrent writers.

Question 10

A Consul service is registered with a TTL health check. The application owner wants the service to be marked unhealthy automatically if the application stops sending heartbeats, without requiring a separate check script or endpoint. The application can send heartbeats every 10 seconds. Which TTL check configuration should be used to mark the service unhealthy after no heartbeat is received for 30 seconds?

Accepted Answer

check { ttl = "30s" }. A TTL check expires and becomes critical if no heartbeat is received within the configured ttl duration. Setting ttl to 30 seconds aligns with the requirement to mark the service unhealthy after 30 seconds without a heartbeat. The interval, timeout, and status fields do not replace the ttl field for heartbeat-based checks.

Answer

check { ttl = "30s", status = "passing" }

Answer

check { ttl = "10s" }

Answer

check { interval = "30s", timeout = "10s" }

Question 11

A developer registers a service called 'web' with a sidecar proxy in a Consul 1.15 datacenter. The service needs to call a backend service named 'api' through the mesh. The developer adds an upstream block to the 'web' service definition pointing to 'api' on port 8080. What does this upstream configuration accomplish for the 'web' sidecar proxy?

Accepted Answer

It creates a local listener on the 'web' sidecar that forwards traffic to an 'api' proxy instance on port 8080.. Upstreams are declared in the calling service's definition and cause its sidecar proxy to open a local listener. The application connects to that local port, and the proxy forwards traffic to a healthy instance of the upstream service through the mesh. This provides service discovery, mTLS, and load balancing without the application knowing backend addresses.

Answer

It configures the 'web' sidecar to accept inbound connections from 'api' on port 8080.

Answer

It enables mTLS between 'web' and 'api' by generating a shared certificate for both services.

Answer

It registers 'api' as a dependency in the Consul catalog so that 'web' can discover its IP address directly.

Question 12

When providing a session TTL, what is the minimum duration allowed?

Accepted Answer

10 seconds. Consul enforces a minimum session TTL of 10 seconds; any value below this is rejected by the agent. This floor prevents excessively chatty heartbeat traffic that would overwhelm the gossip protocol and server resources. The correct answer is therefore 10 seconds.

Answer

30 seconds

Answer

5 seconds

Answer

1 second

Question 13

You are deploying a Consul cluster across three datacenters: dc1, dc2, and dc3. Each datacenter has its own LAN gossip pool and they are all joined via WAN gossip. You want to enable cross-datacenter service discovery so that services in dc1 can discover services in dc2 and dc3. Which Consul feature allows a service in one datacenter to query services in another datacenter without additional configuration?

Accepted Answer

DNS interface with datacenter parameter. Consul's DNS interface supports querying services in other datacenters by including the datacenter in the query name. Once WAN federation is established, a service in dc1 can query a service in dc2 by using the format .service..consul. This requires no extra configuration beyond the initial federation, making it the correct answer.

Answer

Service mesh with intentions

Answer

Prepared queries

Answer

Network segments

Question 14

A platform engineer is defining a TTL health check for a batch worker that cannot be polled by the Consul agent. The check must be considered healthy only when the worker actively reports in, and must become unhealthy if the worker stops reporting. Which two configuration elements are required to make this TTL check functional? (Choose two.)

Accepted Answer

A TTL value that defines the maximum interval between reports. A TTL check requires two things: a ttl value, which sets the expiry window, and periodic updates from the monitored process to the Consul HTTP API. The ttl tells Consul when to mark the check critical, and the API calls tell Consul the service is alive. Optional fields like deregister_critical_service_after and status mapping are not required for the check to function.

Answer

A status field that maps HTTP response codes to states

Answer

A script or HTTP endpoint that the agent polls

Answer

A deregister_critical_service_after value

Question 15

Which TWO of the following are standard DNS records returned by Consul for service discovery?

Accepted Answer

SRV. Consul's DNS interface returns SRV records (option B) to advertise the port and target host of a registered service instance, which is essential because service discovery must convey both the address and the port the service listens on. Consul also returns A records (option C) that map a service name to the IP address(es) of the healthy instances, allowing clients to resolve a service directly to an IP. These two record types are the core of Consul's service discovery responses, with SRV providing host+port and A providing the IPv4 address. The other options are standard DNS record types but are not the service-discovery answers Consul returns for a service lookup: NS (option A) delegates zones to name servers, SOA (option D) holds zone authority metadata, and PTR (option E) is used for reverse DNS lookups.

Answer

NS

Answer

SOA

Answer

PTR