Consul 1.15 Practice Test 21 — 15 Questions

Question 1

You have enabled ACL replication between a primary and secondary datacenter. What is the effect of changing an ACL policy in the primary datacenter?

Accepted Answer

The changes are asynchronously replicated to all secondary datacenters.. Consul ACL replication from a primary datacenter to secondary datacenters is asynchronous by design. When an ACL policy, token, or role is modified in the primary, the change is queued and replicated to all secondaries without manual intervention, though there may be a short propagation delay. This matches the documented behavior of the `acl-replication` mechanism.

Answer

The changes only propagate if the secondary is in maintenance mode.

Answer

The changes require a manual trigger on secondary servers.

Answer

The changes are ignored by secondary datacenters.

Question 2

A company runs Consul 1.15 in three datacenters: dc1 (primary), dc2, and dc3 (secondaries). The operations team wants to ensure that if dc1 becomes unavailable, the remaining datacenters can still authenticate services using existing ACL tokens. They have already configured ACL replication and WAN federation. Which statement best describes the expected behavior of ACL tokens in dc2 and dc3 during a primary datacenter outage?

Accepted Answer

Existing ACL tokens in dc2 and dc3 continue to work for authorization because the replicated ACL data is stored locally.. ACL replication stores a local copy of ACL data in each secondary datacenter. During a primary outage, secondary datacenters can continue to authorize requests using the replicated tokens and policies. New token creation in secondaries is not replicated back to the primary, but existing tokens remain valid for local authorization.

Answer

ACL tokens in dc2 and dc3 continue to work, but only for read operations, because write operations require primary approval.

Answer

New ACL tokens can still be created in dc2 and dc3 during the outage, and they will be automatically synchronized back to dc1 when it recovers.

Answer

ACL tokens in dc2 and dc3 immediately become invalid because the primary datacenter is the only place that can validate tokens.

Question 3

You are deploying a legacy Java application that cannot expose an HTTP endpoint, but it does listen on TCP port 8443. You need Consul to verify the port is accepting connections and mark the service unhealthy if it is not. Which health check definition should you use?

Accepted Answer

A TCP check with `tcp: "127.0.0.1:8443"` and an appropriate interval.. The TCP check type is the correct choice because it directly tests whether a TCP port is open and accepting connections without requiring the application to expose HTTP or run external scripts. It uses only the address and port, making it ideal for legacy services that cannot be instrumented. Other check types either demand capabilities the application lacks or add unnecessary dependencies.

Answer

A TTL check that the application updates via the `/v1/agent/check/pass/<check_id>` endpoint.

Answer

An HTTP check with `http: "https://127.0.0.1:8443/health"` and TLS skip verify.

Answer

A script check that runs `nc -z 127.0.0.1 8443` every 10 seconds.

Question 4

A security team stores application secrets under the Consul KV prefix `app/prod/`. They want to be notified whenever any key under that prefix changes, without repeatedly polling the entire prefix. They have access to the Consul HTTP API and the `consul watch` command. Which approach should they use?

Accepted Answer

Use `consul watch -type=keyprefix -prefix=app/prod/` to monitor all keys under the prefix.. The `keyprefix` watch type is designed to monitor all keys under a given prefix and trigger notifications on any change. It uses blocking queries internally, so it is efficient and immediate. The other watch types target single keys, health checks, or events, none of which would detect changes across the entire `app/prod/` prefix.

Answer

Use `consul watch -type=checks -service=app` to monitor the health of the application service.

Answer

Use `consul watch -type=event -name=app/prod/` to watch for custom events with that name.

Answer

Use `consul watch -type=key -key=app/prod/` to monitor the prefix as a single key.

Question 5

A platform team runs Consul 1.15 with Connect enabled. Their service 'api' is registered with a sidecar proxy, and its upstream 'database' is also mesh-enabled. The team wants 'api' to resolve 'database' through the mesh without hard-coding an IP address in the application. Which configuration in the service registration enables the sidecar to expose a stable local listener for the upstream?

Accepted Answer

Add an 'upstreams' block inside api's 'connect.sidecar_service' stanza with a 'destination_name' of 'database'.. For a mesh-enabled consumer, upstreams are declared on the consuming service's sidecar proxy. The upstream block names the destination service and optionally sets a local bind port, causing the sidecar to listen locally and forward to the destination over the mesh. This gives the application a stable local address and avoids hard-coded IPs.

Answer

Define a 'connect' block in the 'database' service registration with a 'sidecar_service' stanza.

Answer

Create a service-resolver config entry that maps 'database' to a fixed IP address.

Answer

Register 'database' with a 'tagged_addresses' entry containing a LAN address.

Question 6

A Consul 1.15 operator needs to register a service with a health check that verifies the service is accepting TCP connections on port 9200. The check must run every 10 seconds. Which check configuration should be used?

Accepted Answer

"check": { "tcp": "localhost:9200", "interval": "10s" }. The TCP health check is designed to verify that a service is accepting TCP connections on a specified address and port. By setting the tcp field to localhost:9200 and an interval of 10s, Consul will attempt a connection every 10 seconds. This matches the requirement of checking TCP connectivity on port 9200 at the specified interval.

Answer

"check": { "ttl": "10s" }

Answer

"check": { "script": "nc -z localhost 9200", "interval": "10s" }

Answer

"check": { "http": "http://localhost:9200", "interval": "10s" }

Question 7

A team runs Consul 1.15 with Connect. They want to observe which services are allowed to communicate with a specific service named 'inventory' and confirm whether a particular source is permitted, without sending real traffic. Which command should they use to query the effective intention decision for a source and destination?

Accepted Answer

consul intention check -source billing -destination inventory. The intention check subcommand evaluates the effective decision for a source and destination pair, factoring in matching intentions and the default policy. It is the direct way to verify whether a source is permitted to reach a destination without generating real traffic, which is exactly what the team needs.

Answer

consul catalog nodes -service inventory

Answer

consul intention list -destination inventory

Answer

consul connect envoy -sidecar-for inventory --dry-run

Question 8

An operator registers a service with a script health check that runs a custom binary. The binary exits with status code 1. What status will Consul assign to the service's health check?

Accepted Answer

critical. In Consul, script health checks use the exit code of the script to determine health status. An exit code of 0 indicates passing, while any non-zero exit code indicates a failure. Specifically, Consul treats exit code 1 as critical for script checks, not warning. Therefore, when the custom binary exits with 1, the check status becomes critical, and the service is considered unhealthy.

Answer

maintenance

Answer

passing

Answer

warning

Question 9

An operator is configuring a new Consul 1.15 datacenter 'dc3' to join an existing WAN federation with primary datacenter 'dc1'. The operator wants to ensure that dc3 can automatically rejoin the WAN gossip pool after a restart. Which configuration parameter should be set in dc3's server configuration?

Accepted Answer

retry_join_wan. retry_join_wan is the correct parameter to configure automatic rejoining of the WAN gossip pool. It accepts a list of WAN addresses and continuously retries until successful. This ensures that dc3 remains federated with dc1 even after restarts or network interruptions. The other parameters either apply to LAN joining or are deprecated or invalid.

Answer

start_join_wan

Answer

join_wan

Answer

retry_join

Question 10

A Consul operator needs to deregister a specific service instance named 'web-01' from a node without affecting other instances of the same service. The service was registered with the ID 'web-01'. Which action accomplishes this?

Accepted Answer

Send a PUT request to /v1/agent/service/deregister/web-01. Deregistering a single instance requires the unique service ID, which is web-01. The agent endpoint /v1/agent/service/deregister/<serviceID> removes exactly that instance from the local agent and propagates the change to the catalog. Targeting the service name or using a nonexistent command leaves other instances intact but fails to remove the intended one.

Answer

Run consul services deregister -id=web-01

Answer

Send a PUT request to /v1/agent/service/deregister with the service name 'web' in the body

Answer

Send a PUT request to /v1/catalog/deregister with the service name 'web'

Question 11

A Consul 1.15 operator configures an HTTP health check for a service with the following settings: http = "https://api.example.com/health", tls_skip_verify = false, and method = "GET". The check is failing with a certificate error. Which configuration change should the operator make to allow the check to succeed while maintaining security?

Accepted Answer

Provide a valid CA certificate using the ca_file or ca_path option in the check configuration.. When an HTTP health check fails due to a certificate error, it means Consul cannot verify the server's TLS certificate. To resolve this securely, the operator should provide the appropriate CA certificate using ca_file or ca_path. This allows Consul to trust the certificate while still performing verification, unlike disabling verification with tls_skip_verify.

Answer

Set tls_skip_verify to true.

Answer

Set the method to HEAD instead of GET.

Answer

Change the check type to TCP on port 443.

Question 12

An operator needs to update the value of `config/database/url` in Consul KV, but only if the current value is exactly `postgres://old:5432`. They want to use the Consul CLI to perform a compare-and-swap operation. Which command should they use?

Accepted Answer

First retrieve the current ModifyIndex of `config/database/url` and verify the value is `postgres://old:5432`, then use `consul kv put -cas=<index> config/database/url postgres://new:5432`.. Consul KV does not support value-based compare-and-swap directly. The `-cas` flag uses the ModifyIndex to ensure atomic updates. The correct approach is to read the key, verify the value, and then use the ModifyIndex with `-cas`. This prevents lost updates if another client modifies the key in between.

Answer

consul kv put -cas=123 config/database/url postgres://new:5432

Answer

consul kv put -cas -value=postgres://old:5432 config/database/url postgres://new:5432

Answer

consul kv put -cas -modify-index=123 config/database/url postgres://new:5432

Question 13

A Consul 1.15 operator registers a service with an alias health check that points to another service's check. The aliased check is currently in a warning state. What status will the alias check report?

Accepted Answer

warning. An alias health check in Consul mirrors the status of another check. When the aliased check is in a warning state, the alias check will also report warning. This allows services to depend on the health of other services without reimplementing the same check logic. The alias check does not alter the status; it simply reflects it.

Answer

maintenance

Answer

critical

Answer

passing

Question 14

A developer notices that the application process in a Connect-enabled pod connects to 127.0.0.1:8080 to reach an upstream, but the sidecar proxy's actual listener was assigned a different port. The application is failing to reach the upstream. Which action should the developer take to provide a predictable local address for the upstream?

Accepted Answer

Set 'local_bind_port' in the upstream definition to 8080 and restart the sidecar.. Upstream listeners are configured per consuming sidecar. When no local bind port is specified, Consul chooses an ephemeral port, which breaks applications that assume a fixed address. Explicitly setting local_bind_port to the expected value gives the application a stable local endpoint that the sidecar forwards over the mesh.

Answer

Change the application to connect to the upstream service's registered LAN address directly.

Answer

Add a 'port' field to the upstream block that matches the destination service's port.

Answer

Register the application with a 'tagged_addresses' entry pointing to the sidecar's port.

Question 15

A platform engineer is adding a new service to Consul. The service must appear in the catalog with the name 'billing', be reachable over DNS at billing.service.consul, and be associated with the tag 'prod'. Which registration block correctly achieves this when using the HTTP API?

Accepted Answer

{"Name": "billing", "Tags": ["prod"], "Address": "10.0.0.5", "Port": 8080}. The agent service registration API requires a JSON object with Name for the catalog service identifier, Tags as an array of strings, and Address plus Port for the reachable endpoint. That combination makes the service resolvable at billing.service.consul and allows tag-based filtering such as prod. Any deviation in field naming or tag type causes registration failure or missing discovery data.

Answer

{"Service": "billing", "Tag": "prod", "IP": "10.0.0.5", "Port": 8080}

Answer

{"Name": "billing", "Tags": "prod", "Address": "10.0.0.5", "Port": 8080}

Answer

{"Name": "billing", "Tags": ["prod"], "Host": "10.0.0.5", "Port": 8080}