Consul 1.15 Practice Test 19 — 15 Questions

Question 1

You need to perform a canary deployment for a service. What Consul feature should you use?

Accepted Answer

Service splitting via Service Resolver.. Consul's service resolver supports service splitting, which allows you to define weighted subsets of service instances for canary deployments. By configuring a service resolver with a split, you can direct a percentage of traffic to a new version (canary) while the rest goes to the stable version. This is the intended feature for gradual rollouts. Other options like KV store updates, intentions, and mesh gateways do not provide traffic splitting capabilities.

Answer

KV store manual updates.

Answer

Intentions.

Answer

Service mesh gateway.

Question 2

What information does the Consul HTTP API return for a health check? (Select TWO)

Accepted Answer

Output. The Consul HTTP API health check response includes the Status field (E), which reports the check's current state as "passing", "warning", or "critical", and the Output field (B), which contains the human-readable message or command output produced by the check. These two fields are part of the standard check object returned by endpoints such as /v1/health/checks/<service> and /v1/agent/checks. Service CPU usage (A) is not reported by Consul health checks, as Consul does not collect resource metrics. Service port (C) is part of the service definition, not the health check object returned by the health API. Check uptime (D) is not a field Consul tracks or returns for health checks.

Answer

Service CPU usage

Answer

Service port

Answer

Check uptime

Question 3

A DevOps engineer runs a Consul 1.15 agent on a VM and registers a web service with a script health check that executes a local shell script. The script returns exit code 0 when the service is healthy and exit code 1 when unhealthy. After the script runs, Consul reports the check status as passing. Which statement best describes how Consul interprets the script's exit code for this check?

Accepted Answer

Exit code 0 indicates passing, and any non-zero exit code indicates critical.. Consul script checks map exit code 0 to passing and any non-zero exit code to critical. There is no intermediate warning state based on exit codes for script checks. The engineer's script returning 1 will correctly cause the check to be marked critical, which can then trigger alerts or service deregistration if configured.

Answer

Exit code 0 indicates passing, exit code 1 indicates critical, and exit code 2 indicates warning.

Answer

Exit code 0 indicates passing, and exit code 1 indicates maintenance mode.

Answer

Exit code 0 indicates passing, exit code 1 indicates warning, and any other code indicates critical.

Question 4

A Consul service check is configured with `deregister_critical_service_after: "10m"`. The service enters a critical state due to a failed check. What happens after 10 minutes if the check remains critical?

Accepted Answer

The service is deregistered from the Consul catalog.. When a service check is critical for the duration specified in `deregister_critical_service_after`, Consul automatically deregisters the service from the catalog. This prevents dead services from lingering in service discovery. The service must be re-registered to reappear. Other options describe different behaviors such as maintenance mode, check disabling, or status change, none of which are caused by this field.

Answer

The service is marked as maintenance mode and removed from DNS.

Answer

The service is moved to a warning state and remains registered.

Answer

The check is disabled but the service remains registered.

Question 5

A platform team is running Consul Connect with Envoy sidecar proxies. They need to ensure that a service named 'payments' can only be accessed by services in the 'frontend' namespace, and all other access must be denied. They have Consul Enterprise with namespaces enabled. Which intention configuration achieves this requirement with the least administrative overhead?

Accepted Answer

Create an intention that allows 'frontend/*' to 'payments' and set the default intention behavior to deny.. The most efficient way to allow only services from the 'frontend' namespace to access 'payments' is to create a single intention that allows 'frontend/*' to 'payments', and set the default intention behavior to deny. This leverages Consul Enterprise namespaces and wildcard intentions to minimize the number of intentions required. Other options either require many intentions, use the wrong feature, or are not supported.

Answer

Use a service-resolver configuration to restrict access to 'payments' based on the source namespace.

Answer

Configure the Envoy proxy for 'payments' with a network filter that allows only traffic from the 'frontend' namespace.

Answer

Create an intention that denies all sources to 'payments', then create individual allow intentions for each service in the 'frontend' namespace.

Question 6

A platform team is deploying a new service 'payments' on a Consul 1.15 cluster with Connect enabled. They want to ensure that only the 'checkout' service can initiate connections to 'payments', and all other services are denied by default. Which intention should they create?

Accepted Answer

An intention from '*' to 'payments' with action 'deny', and an intention from 'checkout' to 'payments' with action 'allow'.. Consul intentions are evaluated based on specificity, with exact matches taking precedence over wildcards. A wildcard deny intention sets a default deny posture for the destination service, while a specific allow intention grants access to the authorized source. This pattern enforces least privilege and is a common security practice in Consul Connect.

Answer

An intention from '*' to 'payments' with action 'allow', and an intention from 'checkout' to 'payments' with action 'deny'.

Answer

An intention from 'payments' to 'checkout' with action 'deny', and an intention from 'checkout' to 'payments' with action 'allow'.

Answer

An intention from 'checkout' to 'payments' with action 'allow', and no other intentions.

Question 7

A developer has stored the database connection string under the Consul KV path `config/db/primary`. A configuration management script needs to fetch this value as raw text so it can be exported directly into an environment variable. Which Consul CLI command retrieves only the value of that key?

Accepted Answer

consul kv get -raw config/db/primary. The -raw flag suppresses the key name and all metadata, emitting only the stored bytes of the value. When a script needs to assign a KV value directly to a shell variable, any extra formatting breaks the assignment, so the raw form is required. The other commands either add metadata or wrap the value in JSON.

Answer

consul kv get -detailed config/db/primary

Answer

consul kv get config/db/primary

Answer

consul kv export config/db/primary

Question 8

A team is running Consul 1.15 with Connect and wants to expose a TCP service through an ingress gateway so external clients can reach it over mTLS. They define the gateway and a listener on port 8443. External clients report TLS handshake failures. The gateway logs show no matching certificate. Which configuration element must be present for the listener to serve TLS?

Accepted Answer

A TLS certificate and private key must be provided for the listener, either inline or via an SDS or file reference.. Ingress gateway listeners that terminate TLS must be given a certificate and private key. Consul supports inline certificates, file-based references, and SDS integrations such as Vault. Without this material the gateway cannot complete the TLS handshake, producing the handshake failures and missing-certificate log entries. Routing and intention configuration are separate concerns from certificate provisioning.

Answer

The gateway's service registration must include the 'connect: { gateway: {} }' stanza and a matching intention for the external client.

Answer

The listener must set 'protocol = "tcp"' and rely on the client to perform mTLS directly to the backend service.

Answer

The listener must reference a service-resolver that includes a 'tls' subset before it can accept TLS connections.

Question 9

When configuring mTLS in Consul Connect, how are certificates distributed to the sidecar proxies?

Accepted Answer

The agent fetches them from the server and provides them via the Envoy xDS API.. In Consul Connect mTLS, the Consul agent on each node acts as the local certificate authority client: it fetches leaf certificates and the CA bundle from the Consul servers and delivers them to the sidecar proxy (Envoy) dynamically through the xDS API. This means certificates are rotated automatically without restarting the proxy or editing service definitions.

Answer

They are hardcoded in the service definition.

Answer

Via an external secret management service only.

Answer

Via a shared disk volume.

Question 10

An engineer needs a service check that simply confirms a TCP port on the same host is accepting connections, without sending any application payload. Which Consul check configuration accomplishes this?

Accepted Answer

check { name = "db-port" tcp = "localhost:5432" interval = "10s" }. The tcp check type is designed for exactly this purpose: Consul dials the given host and port and marks the check passing when the connection succeeds. It requires no payload exchange and no helper binaries. HTTP checks expect an HTTP conversation, TTL checks rely on the service to push status, and script checks add an external process dependency that the native TCP probe avoids.

Answer

check { name = "db-port" script = "nc -z localhost 5432" interval = "10s" }

Answer

check { name = "db-port" ttl = "10s" }

Answer

check { name = "db-port" http = "localhost:5432" interval = "10s" }

Question 11

You have a service that needs to talk to a service in a different datacenter. What configuration is required?

Accepted Answer

A mesh gateway deployment.. To allow services in different datacenters to communicate over Consul's service mesh, you must deploy a mesh gateway in each datacenter. Mesh gateways proxy mTLS traffic between datacenters, enabling sidecar proxies to reach services in remote datacenters without direct network peering. Without a mesh gateway, cross-datacenter service-to-service traffic cannot traverse the WAN through Consul's mesh.

Answer

Direct VPC peering.

Answer

An external service definition.

Answer

A global intention.

Question 12

If you are using SPIRE for certificate management, how does this interact with Consul Connect?

Accepted Answer

Consul Connect can delegate CA operations to an external provider like SPIRE.. Consul Connect supports pluggable CA providers, and SPIRE is one of the supported external CA integrations. When configured, Consul delegates certificate signing and issuance for service mesh identities to SPIRE, allowing organizations already standardized on SPIFFE/SPIRE to unify workload identity across Consul and non-Consul workloads.

Answer

Only static certificates can be used.

Answer

Consul must be disabled.

Answer

SPIRE replaces the Consul agent.

Question 13

A company runs a primary datacenter and a secondary datacenter with ACL replication enabled. During a maintenance window the primary's servers are taken offline for several hours while the secondary remains fully operational. What is the expected behavior in the secondary during the outage?

Accepted Answer

The secondary continues serving catalog and DNS queries using its replicated ACL data, but new ACL tokens or policy changes cannot be created or replicated until the primary returns.. A secondary datacenter relies on locally replicated ACL data, so it continues authorizing requests and serving queries while the primary is offline. The outage blocks the replication stream, meaning new tokens and policy changes cannot be created or propagated until the primary is reachable again. No automatic promotion or data purge occurs.

Answer

The secondary purges its replicated ACL data to avoid serving stale policies, forcing a full re-replication when the primary returns.

Answer

The secondary automatically promotes itself to primary and begins accepting ACL writes, then demotes itself when the primary returns.

Answer

The secondary immediately stops accepting all requests because ACL authorization depends on a live connection to the primary.

Question 14

An operator registers a web service with a TTL health check and forgets to send periodic updates. After the TTL expires, the service appears as critical in the Consul UI. Which behavior explains why the check transitioned to critical automatically?

Accepted Answer

TTL checks automatically transition to critical when their TTL elapses without an update.. TTL checks are passive: the service or an external process must periodically report health. When the TTL elapses without a report, Consul automatically marks the check critical. This design detects services that have stopped reporting, which is exactly what happened when the operator forgot to send updates.

Answer

The service was deregistered because the TTL expired, and the missing service is shown as critical.

Answer

The Consul agent restarted and reset all check states to critical.

Answer

Consul requires TTL checks to be updated by an external monitoring system, and the absence of that system caused the critical state.

Question 15

You are configuring a new Consul datacenter named 'dc2' to join an existing WAN federation with primary datacenter 'dc1' that uses mesh gateways. The WAN is not directly routable between datacenters. Which configuration allows dc2's servers to establish WAN federation through the mesh gateways?

Accepted Answer

Set primary_gateways in dc2's server configuration to the addresses of dc1's mesh gateways and enable connect.enable_mesh_gateways on both datacenters.. WAN federation through mesh gateways requires setting primary_gateways on the secondary datacenter's servers to the primary's mesh gateway addresses, and enabling mesh gateways in both datacenters. This lets the secondary servers form the WAN gossip pool and perform RPCs over the gateways when direct WAN routing is unavailable.

Answer

Set retry_join_wan in dc2's servers to the private IPs of dc1's servers and enable connect.enable_mesh_gateways only on dc2.

Answer

Configure dc2's servers with retry_join_wan pointing to dc1's server LAN addresses and set acl.tokens.default to the replication token.

Answer

Enable connect.enable_mesh_gateways on dc2 and set primary_datacenter to dc1, then use the consul join -wan command with dc1's mesh gateway addresses.