Consul 1.15 Practice Test 20 — 15 Questions

Question 1

You are deploying a new service 'api' in a Consul Connect mesh. You want to ensure that all incoming connections to 'api' are logged for auditing purposes. Which Consul feature should you configure?

Accepted Answer

Enable access logs on the sidecar proxy for 'api'.. To log incoming connections to a service in Consul Connect, you should enable access logs on the sidecar proxy. The proxy handles all incoming traffic and can be configured to write logs that include details such as the source service, destination, and timestamp. This is the correct approach for auditing service-to-service communication.

Answer

Use Consul's built-in traffic capture feature to record all connections to 'api'.

Answer

Set the intention action to 'allow' and enable audit logging in Consul's ACL system.

Answer

Configure a service mesh gateway to log all traffic passing through it.

Question 2

Which TWO of the following are valid ways to monitor Consul Connect performance?

Accepted Answer

Envoy stats endpoint.. Option A (Envoy stats endpoint) is correct because Consul Connect uses Envoy sidecar proxies for its service mesh data plane, and each Envoy proxy exposes a /stats endpoint (typically on port 19000 via the admin interface) that reports detailed metrics such as upstream request counts, latency histograms, and connection errors, making it a valid way to monitor Connect performance. Option C (Prometheus metrics) is correct because Consul and Envoy both expose metrics in Prometheus format — Consul's /v1/agent/metrics endpoint and Envoy's /stats/prometheus endpoint — which can be scraped to monitor Connect proxy and mesh health. Option B is not a valid monitoring method because changing Consul log levels to 'debug' only increases log verbosity for troubleshooting; it does not provide performance metrics. Option D is not specific to Consul Connect, as checking system RAM is a generic host resource check rather than a Connect performance monitoring technique. Option E is incorrect because Consul Connect does not involve directly querying a database; it is a service mesh feature for securing service-to-service communication.

Answer

Modifying Consul log levels to 'debug'.

Answer

Checking the system RAM.

Answer

Directly querying the database.

Question 3

What is the purpose of the 'service-tag' in a Consul service definition?

Accepted Answer

To provide additional categorization or versioning for services.. Service tags in Consul are arbitrary string labels attached to a service registration that enable additional categorization, versioning, and filtering. They are commonly used with DNS queries (e.g., tag.service.consul) and in prepared queries or Connect intentions to select subsets of service instances. Tags do not affect the service's network location, DNS priority, or encryption.

Answer

To define the physical location of the server.

Answer

To set the priority of the service in DNS.

Answer

To encrypt communication between services.

Question 4

An administrator needs to query service information. Which DNS record type is commonly used by Consul to return service addresses?

Accepted Answer

SRV. Consul's DNS interface primarily uses SRV records to return service addresses because SRV records include both the hostname and the port number of the service instances. This allows clients to discover not just the IP address but also the port on which the service is listening, which is essential for dynamic service discovery. While A records can return IP addresses, they lack port information, making SRV the preferred record type for querying service information in Consul.

Answer

TXT

Answer

MX

Answer

CNAME

Question 5

Which TWO of the following are valid ways to troubleshoot inter-datacenter communication issues?

Accepted Answer

Inspect server logs for RPC errors between datacenters.. Option B is correct because inter-datacenter communication in Consul relies on the WAN gossip pool and RPC forwarding between servers, so inspecting server logs for RPC errors (such as failed RPCs to remote datacenters or WAN gossip issues) is a valid diagnostic step to identify connectivity or federation problems. Option D is correct because 'consul members -wan' lists the members of the WAN gossip pool, allowing you to verify that servers in remote datacenters are visible and participating in cross-datacenter communication. Option A is not a valid troubleshooting method because changing the datacenter name alters the identity of the cluster and would break existing federation rather than diagnose it. Option C is not appropriate because restarting all clients does not address server-to-server WAN communication and could cause unnecessary disruption. Option E is incorrect because 'consul kv export' only exports key/value data and does not test or repair inter-datacenter connectivity.

Answer

Change the datacenter name in the config.

Answer

Restart all clients in the datacenter.

Answer

Use 'consul kv export' to sync data.

Question 6

When a health check is failing, which Consul API endpoint would you call to investigate the specific error message provided by the check?

Accepted Answer

/v1/health/checks/. The /v1/health/checks/ endpoint returns the health checks for a given service, including the status and output of each check. This output often contains the specific error message from the check, making it the correct endpoint to investigate a failing health check.

Answer

/v1/agent/services

Answer

/v1/agent/self

Answer

/v1/catalog/nodes

Question 7

A Consul 1.15 operator is defining a TTL-based health check for a batch job that only reports in when it completes a run. The job must be marked critical if it has not checked in within 30 minutes. The operator wants the check to start in the passing state so a freshly registered job is not immediately flagged. Which configuration block accomplishes this?

Accepted Answer

check = { id = "batch", ttl = "30m", status = "passing" }. TTL checks are passive: the service must periodically call the pass, warn, or fail endpoints, and the ttl field sets the deadline after which Consul flips the check to critical. The status field is the documented way to seed the initial reported state, so a newly registered batch job can start as passing and only become critical if it misses its 30-minute check-in window.

Answer

check = { id = "batch", ttl = "30m", deregister_critical_service_after = "30m" }

Answer

check = { id = "batch", ttl = "30m", fail_fast = true }

Answer

check = { id = "batch", interval = "30m", status = "passing" }

Question 8

An operator wants to create a distributed lock using the Consul KV store and sessions. They create a session with `consul session create` and obtain a session ID. They then attempt to acquire a lock on the key `locks/primary` by running `consul kv put -acquire locks/primary leader1`. The command fails with an error indicating the lock is already held. Which of the following best explains why the lock acquisition failed?

Accepted Answer

The key `locks/primary` already has an associated session that holds the lock, and the session is still active.. Lock acquisition in Consul KV uses sessions. When a key has an active session associated with it, that session holds the lock. A new `-acquire` attempt with a different session will fail because the lock is already held. The other options describe incorrect requirements or behaviors that do not match Consul's lock semantics.

Answer

The operator did not specify a value for the key, and Consul requires a non-empty value to acquire a lock.

Answer

The session ID used for the `-acquire` operation was not created with the `-behavior=release` flag, so it cannot acquire locks.

Answer

The key `locks/primary` does not exist yet, and Consul requires the key to be created before acquiring a lock.

Question 9

You are joining two Consul datacenters via WAN gossip. Which command must be executed on a Consul server in the secondary datacenter to initiate the federation?

Accepted Answer

consul join -wan <remote-server-address>. The consul join -wan command is used to join a Consul server to the WAN gossip pool of another datacenter. It must be executed on a server in the secondary datacenter, specifying the address of a remote server in the primary datacenter. This establishes the WAN federation, allowing cross-datacenter communication.

Answer

consul members -wan

Answer

consul reload -wan

Answer

consul agent -join-wan

Question 10

You are deploying a Consul Connect service mesh in a Consul 1.15 datacenter. You want to ensure that all service-to-service traffic is encrypted and authenticated. What is the default behavior for intentions when no intention is defined between two services?

Accepted Answer

Traffic is denied by default, and mTLS is enforced for allowed connections.. Consul Connect uses a default-deny model for intentions. If no intention explicitly allows traffic between two services, the connection is denied. For allowed connections, mTLS is enforced by the sidecar proxies. This is a fundamental security principle of Consul Connect, ensuring that no unauthorized traffic flows between services.

Answer

Traffic is denied only if the Consul ACL system is enabled.

Answer

Traffic is allowed only if both services have mTLS enabled.

Answer

Traffic is allowed by default, and mTLS is still enforced.

Question 11

You are configuring a new Consul datacenter in a multi-datacenter federation. The datacenter must be able to join the existing WAN gossip pool and participate in cross-datacenter service discovery. Which two configuration settings are required on the new datacenter's Consul servers to enable WAN gossip and ensure secure communication? (Choose two.)

Accepted Answer

retry_join_wan. To enable WAN gossip, the new datacenter's servers must be able to discover and join the existing WAN pool, which requires retry_join_wan to specify seed servers. Additionally, all servers in the WAN pool must share the same gossip encryption key configured via encrypt to secure communication. The other settings are important for ACLs and identification but do not directly enable or secure WAN gossip.

Answer

acl_replication_token

Answer

datacenter

Answer

primary_datacenter

Question 12

A system administrator needs to delete a single key named `temp/config` from the Consul KV store. They want to ensure that only that key is removed and no other keys are affected. Which command should they use?

Accepted Answer

consul kv delete temp/config. The `consul kv delete` command with a specific key path deletes only that key. The `-recurse` flag would delete the key and all subkeys, which is not desired. Writing an empty value does not delete the key. The pipeline approach is invalid. Therefore, the simple delete command is correct.

Answer

consul kv delete -recurse temp/config

Answer

consul kv export temp/config | consul kv delete -

Answer

consul kv put temp/config ""

Question 13

You are using Consul's DNS interface to query a service named 'web' in datacenter dc2 from a client in dc1. The query returns no results, but you know the service is running in dc2. What is the most likely reason?

Accepted Answer

The DNS query must include the datacenter name, for example web.service.dc2.consul, to resolve services in another datacenter.. Consul's DNS interface resolves services in the local datacenter by default. To query a service in a different datacenter, you must append the datacenter name to the query, such as web.service.dc2.consul. Without this qualifier, the query only searches the local catalog, which may not contain the service, leading to no results. The local Consul agent forwards the query to the specified datacenter's servers.

Answer

The service 'web' must be registered with a tag that matches the datacenter name to be discoverable across datacenters.

Answer

The client's DNS resolver must be configured with a forwarder to dc2's Consul servers.

Answer

The service 'web' is not registered in dc1's catalog, so cross-datacenter DNS queries are not supported.

Question 14

You are managing a multi-datacenter Consul deployment with ACLs enabled. The primary datacenter is in dc1, and a secondary datacenter is in dc2. You have configured ACL replication in dc2 using acl_replication_token. After some time, you notice that new ACL tokens created in dc1 are not being replicated to dc2, and the replication status shows 'No known leader'. What is the most likely cause of this issue?

Accepted Answer

The secondary datacenter's servers cannot communicate with the primary datacenter's servers due to a network partition or misconfigured WAN gossip.. The 'No known leader' status in ACL replication indicates that the secondary datacenter cannot reach the primary datacenter's servers to discover the leader. This is typically due to network connectivity issues, such as a partition or misconfigured WAN gossip. The other options would produce different error messages and are less likely given the specific status.

Answer

The acl_replication_token in dc2 does not have the necessary permissions to read ACLs from the primary datacenter.

Answer

The acl_replication_token has expired and needs to be renewed.

Answer

The primary datacenter's ACL system is disabled, causing replication to fail.

Question 15

You are using Consul 1.15 with Connect and want to enable Layer 7 traffic management for a service 'api' to perform HTTP path-based routing. Which configuration is required in the service definition?

Accepted Answer

Set 'protocol' to 'http' in the service definition and configure a service-router config entry.. Consul's L7 traffic management requires the service to declare an HTTP-based protocol and use config entries such as service-router, service-splitter, or service-resolver. The service-router specifically supports path-based routing by matching on HTTP path, header, or query parameters. Without the correct protocol, Envoy operates in L4 mode and cannot inspect HTTP requests.

Answer

Set 'protocol' to 'grpc' and configure a service-splitter config entry.

Answer

Set 'protocol' to 'tcp' and use a service-resolver config entry with subsets.

Answer

Set 'protocol' to 'http' and create an intention with a path-based rule.