Consul 1.15 Practice Exam 2 — 20 Questions

Question 1

A Consul cluster spans multiple datacenters. A service `user-auth` is registered in both `dc1` and `dc2`. A client in `dc1` queries the DNS interface for `user-auth.service.consul`. By default, which instances will be returned?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Only instances from `dc1`.. By default, Consul DNS queries are limited to the local datacenter of the agent that receives the query. A client in `dc1` querying `user-auth.service.consul` will only get instances from `dc1`. To discover instances in other datacenters, the query must explicitly include the datacenter, such as `user-auth.service.dc2.consul`. This design promotes locality and avoids unintended cross-datacenter traffic.

Answer

Only instances from `dc2` if `dc1` has no healthy instances.

Answer

Instances from both `dc1` and `dc2`, load-balanced.

Answer

Instances from all datacenters, sorted by latency.

Question 2

Which command is used to check the status of a registered service?

Accepted Answer

consul health service. The 'consul health service' command queries the health of all instances of a named service, returning the nodes, their health check statuses, and associated metadata. It is the standard CLI way to inspect whether a registered service is passing its checks and is reachable through the catalog.

Answer

consul check

Answer

consul status

Answer

consul list

Question 3

You are troubleshooting a health check that seems to be hanging. Which flag, if available, would provide more information about the check's execution within the agent logs?

Accepted Answer

-log-level=debug. Increasing the agent's log level to 'debug' provides detailed information about check execution and processing.

Answer

-verbose

Answer

-monitor-checks

Answer

-trace

Question 4

A service is intermittently failing to resolve via DNS because it has multiple health checks, some of which are 'warning'. How do you ensure it is only returned when all checks are 'passing'?

Accepted Answer

Use the 'passing' query parameter in the DNS request.. Consul DNS supports a 'passing' query parameter that filters results to only those service instances whose health checks are all passing — warning and critical instances are excluded. Appending ?passing to the DNS query (e.g., 'dig @127.0.0.1 web.service.consul SRV?passing') ensures the service is returned only when every check is green. This is the standard mechanism for strict health-based DNS filtering.

Answer

Configure 'service_prefix' in DNS settings.

Answer

Use the 'stale' query parameter.

Answer

Set 'enable_tag_override' to true.

Question 5

What is the function of the 'consul connect envoy' command?

Accepted Answer

To launch and manage the Envoy proxy sidecar for a service.. This command bootstraps and manages the lifecycle of the Envoy sidecar process.

Answer

To generate TLS certificates for Envoy.

Answer

To verify the Envoy binary installation.

Answer

To update the Envoy configuration via CLI.

Question 6

What is the purpose of the 'upstreams' block in a service definition?

Accepted Answer

To configure the outbound dependencies of the service.. It defines the targets that the sidecar proxy should be allowed to proxy requests to.

Answer

To set the service's health check interval.

Answer

To limit the total number of connections.

Answer

To define the ingress rules.

Question 7

An operator configures a TCP health check for a database service on port 5432, specifying tcp = "localhost:5432" and interval = "10s". The database process is running and accepting connections, but the check is reported as critical. What is the most likely explanation?

Accepted Answer

The Consul agent does not have network permissions or the database is bound only to a specific interface not matching localhost.. A TCP health check succeeds only if the agent can establish a TCP connection to the specified address and port. Even if the database is running, it might be listening on a different interface (e.g., only on a specific IP, not localhost) or the agent might lack the necessary permissions. The configured address localhost:5432 must match where the database is actually listening. Therefore, the most likely explanation is a mismatch in the listening address or a permission issue preventing the connection.

Answer

The check is being executed from a different network namespace than the database process.

Answer

The interval is too short; Consul requires a minimum interval of 30 seconds for TCP checks.

Answer

The TCP check requires an explicit timeout value, and without it the check immediately fails.

Question 8

When using the HTTP health check type, how can you verify that a specific header is included in the health check request?

Accepted Answer

By adding the 'header' object to the check definition. In Consul's HTTP health check definition, you can specify custom headers using the 'header' object, which is a map of header names to arrays of values. This allows the health check request to include specific headers required by the application.

Answer

By appending it to the URL string

Answer

It is not possible

Answer

By setting the environment variable

Question 9

Which THREE of the following are benefits of using the Consul DNS interface?

Accepted Answer

No application code changes required.. Ease of use, platform-agnostic, and no application changes are benefits.

Answer

Provides advanced traffic shifting.

Answer

Encrypts all traffic between services.

Question 10

When troubleshooting a service that fails to start its Envoy proxy, which service definition field should you check for incorrect configuration?

Accepted Answer

proxy. The proxy field in a Consul service definition configures the Envoy sidecar, including upstreams, protocol, and the sidecar's port and configuration. If Envoy fails to start, the proxy stanza is the first place to inspect for malformed upstream definitions, invalid protocol values, or missing sidecar service registration.

Answer

checks

Answer

tags

Question 11

What components can affect the outcome of a health check? (Select THREE)

Accepted Answer

Network connectivity. Network connectivity (A) is correct because a health check must be able to reach the target service or node over the network; if the path is blocked, the check fails regardless of the service's actual state. Application responsiveness (C) is correct because the check's result depends on whether the application actually answers within the configured timeout and returns the expected status. Agent configuration (D) is correct because settings such as check interval, timeout, and the check definition itself determine when and how the check runs and what result is reported. The client browser (B) is not involved, since health checks are performed by agents or servers, not by end-user browsers. Consul server uptime (E) is not a direct component of an individual health check outcome, as checks are executed by the local agent and only aggregated by the servers.

Answer

Client browser

Answer

Consul server uptime

Question 12

A developer registers a service named 'orders' on a Consul node and wants DNS queries for orders.service.consul to return the service's SRV records so clients can discover both the address and the port. The developer is verifying that the registration contains everything needed for SRV resolution. Which two registration elements must be present for SRV queries to return usable records? (Choose two.)

Accepted Answer

A port value in the service definition. SRV answers combine a target host and a port, so Consul needs both a port from the service definition and a resolvable address, taken from the service address or inherited from the node. Health checks, tags, and naming conventions affect filtering or presentation but are not prerequisites for generating SRV records. The two required elements are therefore the port and the address.

Answer

An explicit tag on the service

Answer

A health check attached to the service

Answer

A DNS-friendly service name with no underscores

Question 13

Which THREE of the following are valid check types in Consul?

Accepted Answer

TCP. Consul supports HTTP, TCP, and Script (external) health checks.

Answer

SSH

Answer

FTP

Question 14

You want to perform a list operation on a KV prefix to see all keys, but you don't want the values returned. Which API parameter helps reduce payload size?

Accepted Answer

keys=true. The `keys=true` query parameter on the Consul KV list endpoint instructs the API to return only the key names under the given prefix, omitting the associated values. This dramatically reduces the response payload size when you only need to enumerate keys rather than retrieve their contents. It is the documented way to perform a lightweight listing operation against a KV prefix.

Answer

raw=true

Answer

list=true

Answer

summarize=true

Question 15

Which Consul feature allows you to observe the KV store for changes and run a command in response?

Accepted Answer

Consul Watches. Consul Watches are a mechanism that allows you to monitor specific Consul data (such as KV pairs, health checks, or service listings) for changes and trigger an external handler (e.g., a script or HTTP endpoint) when a change occurs. The watch polls the Consul API at a specified interval and invokes the handler with the updated data. This is the intended feature for reacting to KV store modifications.

Answer

KV Hooks

Answer

Consul Events

Answer

Consul Connect

Question 16

What is the 'Consul Connect proxy' kind used for?

Accepted Answer

To mark a service definition as a sidecar proxy.. It defines a service that is explicitly a sidecar proxy.

Answer

To define a gateway.

Answer

To define the service that the proxy runs in front of.

Answer

To enable mTLS for the service.

Question 17

In a Consul health check, what does the 'notes' field provide?

Accepted Answer

A human-readable description. The 'notes' field in a Consul health check is a free-form, human-readable string that operators use to document the purpose, ownership, or remediation guidance for the check. It is displayed in the Consul UI and API responses but has no effect on the check's pass/fail evaluation. This makes it purely informational metadata for operators and dashboards.

Answer

The trigger time

Answer

The expected result

Answer

The logic for the check

Question 18

You want to perform a blocking query on a KV key to watch for updates. Which parameter must you provide in your request based on the last observed index?

Accepted Answer

index. To perform a blocking query on a KV key, you must provide the 'index' parameter, which specifies the last observed ModifyIndex. Consul will hold the request until the key's index exceeds this value or the wait time expires.

Answer

consistency

Answer

wait

Answer

timeout

Question 19

Which THREE of the following are key components of a service definition?

Accepted Answer

Check/Health Check. In a service definition (as used by service discovery/registry tools such as Consul), the Service Name (E) is the fundamental identifier that registers the service and lets other services and DNS/API lookups discover it, so it is a required key component. The Port (D) is also essential because it tells clients and the registry on which TCP/UDP port the service is listening, enabling correct routing and connection. A Check/Health Check (C) is likewise a core part of the definition, since it defines how the registry verifies the instance is healthy (e.g., an HTTP, TCP, or script check with an interval and timeout) and removes unhealthy instances from discovery. By contrast, a Secret Key (A) is a credential/security artifact, not a structural element of a service definition, and a Node BIOS version (B) is hardware/firmware inventory data that has no role in describing or discovering a service.

Answer

Secret Key

Answer

Node BIOS version

Question 20

A Consul cluster has a service registered with an HTTP health check pointing to https://10.0.0.5:8443/health. The check is failing with a TLS certificate verification error even though the service is healthy. The operator wants Consul to skip certificate verification for this specific check without disabling TLS globally. Which check configuration field should be set?

Accepted Answer

tls_skip_verify. HTTP health checks in Consul support a tls_skip_verify boolean that disables certificate verification for that individual check. This allows checks against services with self-signed or internal CA certificates to succeed without weakening the agent's global TLS posture. The other listed fields either apply to agent-level TLS settings or to unrelated aspects of the check request.

Answer

ca_file

Answer

verify_outgoing

Answer

method