Consul 1.15 Practice Exam 3 — 20 Questions

Question 1

If a Consul agent is configured with 'disable_remote_exec = true', how does this affect the KV store?

Accepted Answer

It has no effect on the KV store.. 'disable_remote_exec' controls whether Consul's remote execution feature (the 'consul exec' command) is allowed on the agent. It has no relationship to the KV store — KV reads, writes, watches, and consistency modes are governed by separate ACL and query parameters. Setting this flag simply blocks remote command execution for security hardening.

Answer

It forces all KV reads to be consistent.

Answer

It prevents all KV writes.

Answer

It disables KV watches.

Question 2

Which of the following best describes the 'consul agent -dev' mode in relation to service discovery?

Accepted Answer

It provides a single-node Consul environment for testing.. The 'consul agent -dev' flag starts a single-node Consul agent configured as a server and client in one process, with an in-memory datastore, no persistence, and no cluster join. It is explicitly designed for local development, testing, and demos — not for production — and it still exposes the DNS interface, HTTP API, and service catalog so you can exercise service discovery locally.

Answer

It disables DNS interfaces.

Answer

It forces the service catalog to be stored in Redis.

Answer

It is suitable for production clusters.

Question 3

You notice that the KV store is not consistent across datacenters. What is the cause?

Accepted Answer

KV store is datacenter-local by design.. Consul's KV store is datacenter-local by design — each datacenter maintains its own independent KV namespace with no automatic replication to peer datacenters. When you write a key in dc1, it does not appear in dc2 unless you explicitly write it there or use a tool like consul-replicate. This is expected behaviour, not a fault.

Answer

The Raft protocol is broken.

Answer

The ACL token lacks the 'write' permission.

Answer

The WAN gossip is disabled.

Question 4

Which command line tool can you use to manually trigger a TTL check update for a specific service?

Accepted Answer

curl -X PUT http://localhost:8500/v1/agent/check/pass/checkID. The Consul HTTP API exposes agent check endpoints that allow external systems to push health status updates. A TTL check registered with the local agent can be manually marked passing by sending an HTTP PUT to /v1/agent/check/pass/<checkID> on port 8500. This is the documented mechanism for scripts and external monitors to report liveness without waiting for the TTL to expire.

Answer

consul kv put

Answer

consul agent -check-update

Answer

consul health update

Question 5

Which TWO of the following statements are true about the 'passing' parameter in DNS queries?

Accepted Answer

It returns only services with passing health checks.. Option B is correct because the 'passing' parameter filters DNS query results so that only service instances whose health checks are currently passing are returned, which is essential for service discovery in tools like Consul. Option E is correct because 'passing' is appended as a query string parameter in the DNS query URL, for example when querying a service name with ?passing to restrict results to healthy instances. Option A is incorrect because the 'passing' parameter does not require manual service registration; services are registered through the service registry or API, not through this query parameter. Option C is incorrect because 'passing' is a query-time filter and has no effect on restarting the DNS server. Option D is incorrect because 'passing' is a per-query parameter, not a permanent configuration setting.

Answer

It requires manual service registration.

Answer

It forces the DNS server to restart.

Answer

It is a permanent configuration setting.

Question 6

Which Consul API endpoint is used to create a new session that can be used for locking KV keys?

Accepted Answer

/v1/session/create. The correct endpoint is /v1/session/create because it is specifically designed to create a new session in Consul. Sessions are the foundation for distributed locks and KV key acquisition. When you create a session, Consul returns a session ID that can be used with the KV acquire endpoint to obtain a lock on a key. This endpoint accepts parameters like name, TTL, and behavior on invalidation, allowing fine-grained control over lock semantics.

Answer

/v1/kv/acquire

Answer

/v1/lock/init

Answer

/v1/session/renew

Question 7

When using multiple datacenters, what is the primary role of the 'consul-template' tool?

Accepted Answer

To generate configuration files based on Consul data.. consul-template is a daemon that watches Consul for changes (KV pairs, services, health checks) and renders configuration files from templates, optionally running commands when files change. Its primary role is dynamic configuration generation based on Consul data, commonly used to configure HAProxy, Nginx, or Vault. It does not provision infrastructure or manage the cluster.

Answer

To provision infrastructure.

Answer

To replicate KV stores.

Answer

To manage the Consul cluster nodes.

Question 8

You need to deny all traffic between 'service-a' and 'service-b' using intentions. What is the most efficient way to achieve this?

Accepted Answer

consul intention create -deny service-a service-b. Intentions can be set to 'deny' explicitly, which overrides any 'allow' rules.

Answer

consul intention create -allow-none service-a service-b

Answer

consul intention set -action=drop service-a service-b

Answer

consul intention delete service-a service-b

Question 9

Which protocol do Consul servers use to maintain the WAN gossip pool?

Accepted Answer

Serf (SWIM). Consul servers use the Serf library, which implements the SWIM gossip protocol, to maintain the WAN gossip pool across datacenters. Serf handles membership, failure detection, and lightweight message dissemination over UDP/TCP. This is distinct from Raft, which handles consensus for the replicated state.

Answer

gRPC

Answer

DNS

Answer

HTTP

Question 10

What is the recommended number of Consul servers per datacenter to ensure high availability?

Accepted Answer

3. The recommended number of Consul servers per datacenter for high availability is three, because it allows the cluster to tolerate the failure of one server while maintaining quorum. Consul uses the Raft consensus algorithm, which requires a majority of servers to be available for writes. With three servers, a single failure leaves two servers, still a majority, so the cluster remains operational.

Answer

2

Answer

1

Answer

10

Question 11

An operator is troubleshooting a Consul datacenter that was recently federated with another datacenter. They notice that cross-datacenter service discovery works, but ACL tokens created in the primary datacenter are not being recognized in the secondary datacenter. What is the most likely cause?

Accepted Answer

The secondary datacenter's servers are not configured with a valid acl_replication_token.. ACL replication in Consul is driven by the secondary datacenter, which uses acl_replication_token to authenticate to the primary and pull updates. Without a valid token, the secondary cannot fetch new tokens or policies, so tokens created in the primary will not be recognized. Other settings like retry_join_wan and gossip encryption affect WAN federation but not the ACL replication process itself.

Answer

The primary datacenter's servers are not configured with retry_join_wan pointing to the secondary.

Answer

The secondary datacenter's servers have a different gossip encryption key than the primary.

Answer

The secondary datacenter is configured with primary_datacenter set to its own name instead of the primary's name.

Question 12

An operator registers a service 'cache' with an HTTP health check pointing to https://10.0.0.5:8443/health. The service appears in the catalog, but DNS queries for cache.service.consul return no records, and the check status shows critical with the message 'Get https://10.0.0.5:8443/health: x509: certificate signed by unknown authority'. Which action resolves the issue while keeping the check functional?

Accepted Answer

Add the CA certificate to the agent's ca_file or ca_path configuration and reload the agent.. The critical status is caused by the agent's inability to verify the HTTPS endpoint's certificate. Supplying the issuing CA through the agent's ca_file or ca_path configuration lets the HTTP check complete TLS validation and report passing, which restores the instance to DNS answers. This corrects the trust configuration rather than disabling verification or weakening the check.

Answer

Set tls_skip_verify to true in the check definition.

Answer

Re-register the service with a TCP check on port 8443 instead of an HTTP check.

Answer

Change the check to use HTTP instead of HTTPS.

Question 13

You have a service that requires specific routing logic based on the environment. How can you distinguish between 'production' and 'staging' instances of the same service name using metadata?

Accepted Answer

Apply 'production' or 'staging' tags to the service definition.. Consul tags are arbitrary key-value-like labels attached to a service registration and are the standard mechanism for distinguishing instances of the same service across environments. By registering production instances with the tag 'production' and staging instances with 'staging', you can use service discovery queries (e.g., via DNS SRV or the HTTP API with tag filters) to route traffic to the correct environment. This preserves a single service name while enabling environment-aware routing.

Answer

Use different service names for every environment.

Answer

Modify the service's port number.

Answer

Assign different Consul datacenters.

Question 14

A service team wants its check to be automatically deregistered along with the service when the service is deregistered, but they also want the check to survive a Consul agent restart without being manually recreated. Which configuration achieves both goals?

Accepted Answer

Define the check inside the service block with a name but no explicit check ID, and register the service through the agent configuration directory.. Nesting a check inside a service block without an explicit check ID causes Consul to generate an ID linked to the service, so deregistering the service also removes the check. Declaring that service in the agent configuration directory means the agent re-registers it on every startup, providing restart persistence. API-only registration and in-memory reliance fail both the automatic removal and the restart-survival requirements.

Answer

Define the check in the service block with an explicit check ID that differs from the service ID.

Answer

Register the check separately through the HTTP API with a standalone check ID and no service association.

Answer

Register the service and check via the HTTP API and rely on the agent's in-memory state to persist across restarts.

Question 15

A Consul 1.15 cluster spans three datacenters: dc1 (primary), dc2, and dc3. The operations team wants to enable cross-datacenter service discovery for a service named 'web' that is deployed in all datacenters. They configure a prepared query with a failover policy. Which statement accurately describes how the failover block in the prepared query affects query results when the local datacenter's 'web' service has no healthy instances?

Accepted Answer

The failover block can specify a list of datacenters to try in order, and Consul will return results from the first datacenter in the list that has healthy instances.. Prepared queries support a failover block that lists datacenters in priority order. When the local datacenter has no healthy instances, Consul tries each listed datacenter in sequence and returns results from the first with healthy instances. This provides deterministic cross-datacenter failover for service discovery.

Answer

The failover block requires that all datacenters be in the same WAN gossip pool and have identical ACL tokens.

Answer

The failover block automatically selects the datacenter with the lowest latency, regardless of the order specified.

Answer

The failover block is only used for DNS queries, not for HTTP API queries.

Question 16

You are troubleshooting a Consul Connect service mesh and need to verify which intentions are currently configured. Which Consul CLI command lists all intentions?

Accepted Answer

consul intention list. The correct command to list all intentions is 'consul intention list'. This command retrieves and displays all intentions configured in the Consul datacenter. The other options are either non-existent commands or incorrect syntax. Being able to quickly list intentions is essential for troubleshooting and auditing Connect authorization.

Answer

consul connect intentions

Answer

consul intention get -all

Answer

consul catalog intentions

Question 17

What is the primary role of the Consul Connect 'upstream' configuration?

Accepted Answer

To define the services that a local service can connect to.. The Consul Connect 'upstream' configuration defines the services that a local service can connect to through the mesh. It specifies the destination service name, optional datacenter, and local port that the sidecar proxy listens on to forward traffic to the upstream. This is the core mechanism for establishing service-to-service connections in Consul Connect.

Answer

To set intention priority.

Answer

To register external services.

Answer

To define health check ports.

Question 18

Which TWO of the following are benefits of using Consul Connect?

Accepted Answer

Centralized authorization policies.. Consul Connect is HashiCorp's service mesh feature, and one of its core benefits is centralized authorization policies (Option A): intentions define which services may communicate with which others, and these policies are managed centrally in Consul and enforced by sidecar proxies, giving consistent, identity-based access control across the mesh. Option B is also correct because Consul Connect automatically manages mTLS: it provides built-in certificate authority functionality that issues, rotates, and distributes certificates to sidecar proxies, so service-to-service traffic is encrypted and mutually authenticated without application changes. Option C is wrong because Connect's sidecar proxies add only minimal overhead and are not intended to increase latency as a benefit. Option D is wrong because firewalls are still required for network segmentation and host-level security; Connect complements rather than eliminates them. Option E is wrong because Consul Connect is a service mesh for secure service communication, not a database replication tool.

Answer

Increased application latency.

Answer

Elimination of firewalls.

Answer

Automatic database replication.

Question 19

A DevOps engineer needs to register an external service that runs outside the Consul datacenter, such as a third-party API. The service has a static IP address and a known port. Which Consul feature should be used to make this service discoverable within Consul?

Accepted Answer

Consul's external service registration with a static address. To register an external service in Consul, you can use the service registration API or configuration files to define a service with a static address and port. Consul treats it as a regular service in the catalog, and it can be discovered via DNS or HTTP API. This is the correct approach for integrating external endpoints into Consul's service discovery.

Answer

Consul's intention-based access control

Answer

Consul's prepared queries with failover

Answer

Service mesh with sidecar proxies

Question 20

Which interface would you use to register a service dynamically using standard tools like 'curl'?

Accepted Answer

HTTP API. The HTTP API is the primary programmatic interface for Consul and exposes RESTful endpoints such as PUT /v1/agent/service/register, which can be invoked with standard tools like curl. This makes it the correct choice for dynamically registering a service without using the CLI or configuration files. The DNS interface is read-only for service discovery, and gossip is an internal membership protocol, not a registration mechanism.

Answer

DNS interface

Answer

Gossip protocol

Answer

CLI agent command