Consul 1.15 Practice Exam 4 — 20 Questions

Question 1

When using Consul KV for distributed locking, why is it recommended to use a session?

Accepted Answer

It allows for TTL-based automatic lock release.. Sessions in Consul provide a mechanism for TTL-based automatic lock release. When a lock is acquired using a session, the session must be periodically renewed; if the client fails to renew before the TTL expires, Consul automatically invalidates the session and releases any locks held by it, preventing deadlocks from crashed or partitioned clients.

Answer

It encrypts the lock data.

Answer

It allows for multiple lock holders.

Answer

It speeds up read operations.

Question 2

What is the primary difference between a 'script' check and an 'http' check in terms of how they are processed by the Consul agent?

Accepted Answer

Script checks require executing a local process. Script checks execute a local command or script on the Consul agent's host, while HTTP checks make an HTTP request to a specified URL. The key processing difference is that script checks spawn a subprocess, which can be resource-intensive and requires the script to be present on the node. HTTP checks are handled internally by the agent's HTTP client without executing external code.

Answer

HTTP checks are more secure

Answer

Only HTTP checks support intervals

Answer

Script checks are faster

Question 3

An engineer is designing a service that must coordinate access to a shared resource using Consul KV sessions and needs to understand the guarantees the lock provides. Which TWO statements accurately describe how Consul's KV locking with sessions behaves? (Choose two.)

Accepted Answer

A lock is acquired by writing a key with the `acquire` parameter and the session ID, and succeeds only if no other valid session currently holds it.. Consul locks are acquired with the `acquire` operation carrying a session ID, and they are released automatically when that session expires or is invalidated. Mutual exclusion is guaranteed because only one valid session can hold a given key. Release is performed through the same key-write path with the `release` operation, and session renewal happens at the session endpoint, not the KV endpoint.

Answer

Session TTL renewal must be performed through the `/v1/kv` endpoint rather than the session endpoint.

Answer

A lock key can be held simultaneously by multiple sessions as long as each session renews within its TTL.

Answer

Releasing a lock requires calling a dedicated `consul kv unlock` subcommand that is separate from the put operation.

Question 4

A security engineer is configuring intentions for a service mesh. They want to allow traffic from 'frontend' to 'backend' only when the connection is encrypted with mTLS and originates from a specific namespace in Consul Enterprise. Which intention attribute should they use to enforce the namespace constraint?

Accepted Answer

SourceNamespace. In Consul Enterprise, intentions support namespace and partition attributes to provide fine-grained authorization. To allow traffic only from a specific namespace, the SourceNamespace attribute must be set. This ensures that only service instances registered in that namespace can establish connections. Other attributes like SourceName or SourcePartition do not fulfill the namespace-specific requirement.

Answer

SourcePartition

Answer

SourceType

Answer

SourceName

Question 5

An operations team runs a legacy application that cannot expose an HTTP endpoint but does listen on TCP port 5432. They define a TCP health check in the service registration. During an incident, the port remains open but the application process is hung and no longer accepts new connections. What will Consul report for this check?

Accepted Answer

passing, because the TCP port is open. A TCP health check validates only that a connection to the specified host and port can be established. It does not perform any application-level handshake or data exchange. Because the port remains open in this scenario, the check stays passing even though the application is unresponsive. This is a common limitation when using TCP checks for services that can hang while keeping their socket open.

Answer

warning, because the TCP handshake is slow

Answer

critical, because the application is hung

Answer

maintenance, because the process is not accepting connections

Question 6

Which TWO of the following are true regarding the Consul Service Catalog?

Accepted Answer

It provides a unified view of all services in the cluster.. The catalog is replicated via Raft and can be queried via API or DNS.

Answer

It is strictly read-only.

Answer

It is only accessible via the CLI.

Answer

It is stored in the local disk of every agent.

Question 7

Which THREE of the following are valid ways to register a service in Consul?

Accepted Answer

Kubernetes Custom Resource Definitions.. Option A is correct because Consul supports Kubernetes Custom Resource Definitions (CRDs) such as ServiceRegistration (and previously ServiceDefaults/ServiceResolver via CRDs) as a declarative way to register services when running Consul on Kubernetes with the official Helm chart and CRDs enabled. Option B is correct because services can be defined in agent configuration files (HCL or JSON) placed in the agent's config directory, using a service block or services array, and Consul loads them at agent startup or reload. Option C is correct because the Consul HTTP API exposes the endpoint PUT /v1/agent/service/register, which accepts a JSON service definition and registers the service with the local agent. Option D is not valid because Consul stores state in a Raft-replicated log and snapshot files, not in a directly editable database file; modifying internals would corrupt state and is unsupported. Option E is not valid because the Raft log is an internal replicated log managed by the Raft consensus protocol, and manually editing it would break consistency and is not a supported registration method.

Answer

Directly modifying the Consul database file.

Answer

Manual editing of the Raft log.

Question 8

Which THREE of the following fields are returned in a typical Consul KV API GET response?

Accepted Answer

ModifyIndex. A Consul KV API GET response (e.g., GET /v1/kv/<key>) returns a JSON array of entries containing the fields Key, Value, Flags, CreateIndex, ModifyIndex, LockIndex, and Session. Option A (ModifyIndex) is correct because it is the index at which the key was last modified and is included in every KV read response. Option B (Key) is correct because the full key path is returned so the client knows which key the entry corresponds to. Option C (Value) is correct because the base64-encoded value stored at the key is returned (null if the key has no value). Option D (SessionTTL) is not part of the KV response; TTL is a property of sessions (returned by the session API, e.g., /v1/session/info), not of KV entries. Option E (CreateTime) is not a Consul KV field; Consul uses CreateIndex (a Raft index) rather than a timestamp to record when the key was created.

Answer

SessionTTL

Answer

CreateTime

Question 9

When a service check transitions to 'critical', what does Consul do with the service's DNS entry?

Accepted Answer

It removes the instance from the DNS response.. When a service check transitions to 'critical', Consul's DNS interface automatically removes that service instance from DNS query results. This is because Consul's DNS server only returns instances that are considered healthy (passing checks). The DNS entry for the service as a whole may still exist if other instances are healthy, but the critical instance is excluded. This behavior ensures that clients using DNS for service discovery do not route traffic to unhealthy instances.

Answer

It marks the record as 'stale'.

Answer

It returns the IP but with a low TTL.

Answer

It returns a 503 status code.

Question 10

You are designing a configuration system where multiple instances of a service must coordinate to elect a single leader using Consul KV. Which two statements accurately describe how to implement leader election with sessions? (Choose two.)

Accepted Answer

Each instance should create a session with a unique name and then attempt to acquire the same KV key using PUT /v1/kv/service/leader?acquire=<session_id>.. Leader election with Consul KV relies on sessions and the acquire operation. Each candidate creates a unique session and attempts to acquire a shared key. The holder must renew its session to keep the lock; if renewal fails, the session expires and the lock is released. Deleting the key or sharing sessions does not provide correct coordination, and KV entries do not support TTLs.

Answer

To release leadership, the leader can simply delete the KV key, which automatically invalidates its session and allows another instance to acquire the lock.

Answer

All instances should use the same session ID to ensure they can all attempt to acquire the lock simultaneously, and the first one to call acquire becomes the leader.

Answer

The KV key used for leader election must have a TTL set via the ?ttl= query parameter, so that it expires automatically if the leader fails.

Question 11

You are designing a distributed leader election system using Consul. A service instance must hold a lock on the KV key 'service/leader' to become the leader. You need to ensure that if the instance crashes or loses network connectivity, the lock is automatically released so another instance can acquire it. Which Consul feature should you use to achieve this?

Accepted Answer

Consul sessions with a TTL and the acquire parameter on a KV PUT request. Sessions are the correct mechanism for distributed locks in Consul. By creating a session with a TTL and using the acquire parameter when writing to a KV key, the key becomes locked to that session. If the session expires because the instance fails to renew it, Consul releases the lock, enabling another instance to acquire it. This pattern is fundamental for leader election.

Answer

Consul watches on the KV key with a script that releases the lock

Answer

Consul KV key with a long TTL and manual cleanup by an operator

Answer

Consul prepared queries with failover to another datacenter

Question 12

You are deploying a service that must store a critical configuration value in Consul KV. The value must only be visible to services with a token that has read access to that specific key. You also need to ensure that any write to the key can only be performed by a token with write access. Which Consul feature should you use?

Accepted Answer

Consul ACLs with a policy that restricts access to the KV path.. The requirement is to restrict read and write access to a specific KV key based on tokens. Consul ACLs with policies that define rules for the KV path are the correct mechanism. They allow you to specify exact permissions for tokens, ensuring that only authorized clients can read or write the key. Other options do not provide this level of access control.

Answer

Consul namespaces with a default policy that allows all operations.

Answer

Consul KV key-level encryption using the gossip encryption key.

Answer

Consul intentions that define which services can communicate with the KV store.

Question 13

When configuring ACL replication, where must the 'acl_replication_token' be defined?

Accepted Answer

In the secondary datacenter's server agents.. ACL replication flows from the primary datacenter to secondary datacenters, and the token that authorizes this replication must be configured on the server agents in the secondary datacenter. The secondary servers use this token to authenticate to the primary and pull ACL data. Client agents do not perform ACL replication, so the token is not needed there.

Answer

In the primary datacenter's client agents.

Answer

In the Consul Enterprise license file.

Answer

On all nodes in both datacenters.

Question 14

When using 'prepared_queries' for cross-datacenter failover, what does the 'failover' block allow you to specify?

Accepted Answer

A list of datacenters to attempt for service resolution.. The failover block in a prepared query specifies a list of datacenters to attempt for service resolution when the local datacenter has no healthy instances. This enables cross-datacenter failover by defining an ordered fallback list. It does not control timeouts, encryption, or retry counts.

Answer

The timeout for the WAN gossip.

Answer

The encryption algorithm for failover traffic.

Answer

The number of retries per node.

Question 15

What is the consequence of having a service with no health checks registered?

Accepted Answer

The service status is 'passing'. In Consul, a service registered without any health checks is treated as healthy by default, so its status is reported as 'passing'. Consul only marks a service as critical if an associated check fails; with no check defined, there is nothing to fail, so the service remains passing and is returned by DNS and service discovery queries.

Answer

The agent will error out

Answer

The service is ignored by DNS

Answer

The service is critical

Question 16

When using the Consul KV store, what is the maximum size allowed for a single value in a key?

Accepted Answer

512 KB. The Consul KV store enforces a maximum value size of 512 KB per key. This limit is a hard constraint imposed by the Raft consensus protocol, which replicates all writes across the cluster. Values larger than 512 KB are rejected by the server to prevent excessive memory usage and network overhead during replication. This is documented in the official Consul limits and is consistent across versions, including 1.15.

Answer

There is no limit.

Answer

128 KB

Answer

1 MB

Question 17

A team wants to store structured configuration for several microservices in Consul's KV store and retrieve an entire service's configuration with a single CLI call. They plan to keep all keys for `payments` under `services/payments/`. Which command retrieves every key under that prefix in one invocation?

Accepted Answer

consul kv get -recurse services/payments/. Listing all keys under a prefix requires the recursive read behavior. Passing `-recurse` to `consul kv get` returns every key beneath the specified path in a single call, which is precisely how a service loads its whole configuration subtree. A trailing slash alone does nothing, and the other commands either write data or produce a backup-oriented export format.

Answer

consul kv get services/payments/

Answer

consul kv put -recurse services/payments/

Answer

consul kv export services/payments/

Question 18

You are configuring Consul Connect for a service named 'payments'. You want to allow incoming connections only from services that present a valid client certificate from a specific CA and also enforce that the source service is 'checkout'. What combination of Consul features should you use?

Accepted Answer

Configure an intention with source 'checkout' and action 'allow', and enable mutual TLS in the mesh.. To restrict incoming connections to a specific source service, Consul intentions are the correct mechanism. They define which services are allowed to connect based on service identity. Enabling mTLS ensures that connections are authenticated with certificates issued by Consul's CA, providing encryption and identity verification. Together, they enforce that only 'checkout' can connect to 'payments' and that the connection is secure.

Answer

Enable ACLs with a token that has 'service:write' for 'payments' and distribute it only to 'checkout'.

Answer

Configure a service resolver with a subset that includes only 'checkout' and set the default subset to that.

Answer

Use a network segment to isolate 'payments' and a firewall rule to allow only 'checkout'.

Question 19

You are deploying a service that requires distributed locking with automatic release if the service instance fails. You have created a session named 'lock-session' and acquired a lock on the KV key 'locks/db'. After a few minutes, the lock is unexpectedly released even though the service instance is still running. Which action should you take to diagnose the most likely cause?

Accepted Answer

Verify that the service is sending session renewals within the TTL period.. Consul sessions have a TTL and must be periodically renewed by the client. If the service fails to renew within the TTL, the session is invalidated and any locks held by that session are released. In this scenario, the service is still running but likely not renewing the session, causing the lock to be released. Verifying renewal activity is the correct diagnostic step.

Answer

Inspect the KV key's metadata to see if it was modified externally.

Answer

Check the Consul server logs for errors related to the session.

Answer

Restart the Consul agent on the node where the service is running.

Question 20

You need to store a value in Consul KV that will be read by a service. The value should be retrievable by a simple HTTP GET request to the Consul API. Which HTTP endpoint should you use to read the value of a key named 'app/config/db_host'?

Accepted Answer

GET /v1/kv/app/config/db_host. The Consul KV API uses the /v1/kv/ prefix for all key operations. To read a key, you perform a GET request to /v1/kv/<key>. This returns a JSON response containing the value and metadata. Other paths like /v1/store or /v1/kv/read are not valid. The ?raw parameter is optional and returns the value directly, but the standard endpoint is without it.

Answer

GET /v1/kv/read/app/config/db_host

Answer

GET /v1/store/app/config/db_host

Answer

GET /v1/kv/app/config/db_host?raw