Consul 1.15 Practice Test 4 — 25 Questions

Question 1

When using the Consul KV store, what is the maximum size allowed for a single value in a key?

Accepted Answer

512 KB. The Consul KV store enforces a maximum value size of 512 KB per key. This limit is a hard constraint imposed by the Raft consensus protocol, which replicates all writes across the cluster. Values larger than 512 KB are rejected by the server to prevent excessive memory usage and network overhead during replication. This is documented in the official Consul limits and is consistent across versions, including 1.15.

Answer

There is no limit.

Answer

128 KB

Answer

1 MB

Question 2

A team wants to store structured configuration for several microservices in Consul's KV store and retrieve an entire service's configuration with a single CLI call. They plan to keep all keys for `payments` under `services/payments/`. Which command retrieves every key under that prefix in one invocation?

Accepted Answer

consul kv get -recurse services/payments/. Listing all keys under a prefix requires the recursive read behavior. Passing `-recurse` to `consul kv get` returns every key beneath the specified path in a single call, which is precisely how a service loads its whole configuration subtree. A trailing slash alone does nothing, and the other commands either write data or produce a backup-oriented export format.

Answer

consul kv get services/payments/

Answer

consul kv put -recurse services/payments/

Answer

consul kv export services/payments/

Question 3

You are configuring Consul Connect for a service named 'payments'. You want to allow incoming connections only from services that present a valid client certificate from a specific CA and also enforce that the source service is 'checkout'. What combination of Consul features should you use?

Accepted Answer

Configure an intention with source 'checkout' and action 'allow', and enable mutual TLS in the mesh.. To restrict incoming connections to a specific source service, Consul intentions are the correct mechanism. They define which services are allowed to connect based on service identity. Enabling mTLS ensures that connections are authenticated with certificates issued by Consul's CA, providing encryption and identity verification. Together, they enforce that only 'checkout' can connect to 'payments' and that the connection is secure.

Answer

Enable ACLs with a token that has 'service:write' for 'payments' and distribute it only to 'checkout'.

Answer

Configure a service resolver with a subset that includes only 'checkout' and set the default subset to that.

Answer

Use a network segment to isolate 'payments' and a firewall rule to allow only 'checkout'.

Question 4

You are deploying a service that requires distributed locking with automatic release if the service instance fails. You have created a session named 'lock-session' and acquired a lock on the KV key 'locks/db'. After a few minutes, the lock is unexpectedly released even though the service instance is still running. Which action should you take to diagnose the most likely cause?

Accepted Answer

Verify that the service is sending session renewals within the TTL period.. Consul sessions have a TTL and must be periodically renewed by the client. If the service fails to renew within the TTL, the session is invalidated and any locks held by that session are released. In this scenario, the service is still running but likely not renewing the session, causing the lock to be released. Verifying renewal activity is the correct diagnostic step.

Answer

Inspect the KV key's metadata to see if it was modified externally.

Answer

Check the Consul server logs for errors related to the session.

Answer

Restart the Consul agent on the node where the service is running.

Question 5

You need to store a value in Consul KV that will be read by a service. The value should be retrievable by a simple HTTP GET request to the Consul API. Which HTTP endpoint should you use to read the value of a key named 'app/config/db_host'?

Accepted Answer

GET /v1/kv/app/config/db_host. The Consul KV API uses the /v1/kv/ prefix for all key operations. To read a key, you perform a GET request to /v1/kv/<key>. This returns a JSON response containing the value and metadata. Other paths like /v1/store or /v1/kv/read are not valid. The ?raw parameter is optional and returns the value directly, but the standard endpoint is without it.

Answer

GET /v1/kv/read/app/config/db_host

Answer

GET /v1/store/app/config/db_host

Answer

GET /v1/kv/app/config/db_host?raw

Question 6

You are using Consul KV to coordinate a distributed job scheduler. A worker acquires a lock on a key to ensure only one worker runs a job at a time. The lock is tied to a session. The worker crashes and the session expires after its TTL. What happens to the lock on the key?

Accepted Answer

The lock is automatically released and the key's LockIndex is incremented.. When a session expires, Consul automatically releases any locks held by that session. The lock release is indicated by clearing the Session field on the key and incrementing the LockIndex. The key and its value are not deleted. This allows other workers to acquire the lock and continue operation. Manual intervention is not required.

Answer

The key is deleted and the lock is released.

Answer

The lock is automatically released and the key's value is deleted.

Answer

The lock remains held until a Consul operator manually releases it.

Question 7

A platform team runs Consul 1.15 with Connect enabled in a single datacenter. They register a new service 'payments' with a sidecar proxy, but when the application team tries to reach 'payments' through its local proxy, the connection is refused. Running 'consul intention check web payments' returns 'Result: denied'. No intentions have been created yet. What should the team do to allow the traffic while following Consul's default security model?

Accepted Answer

Create an intention that allows 'web' to 'payments' and apply it to the datacenter with 'consul intention create web payments'.. Connect evaluates intentions for every proxied connection and, absent a match, defaults to deny. The 'consul intention check' output confirms denial. Creating an allow intention between the source service 'web' and destination 'payments' establishes the required authorization. Environment toggles, re-registration, and explicit deny intentions do not open the path under the default-deny posture.

Answer

Modify the 'payments' service definition to include 'connect: { sidecar_service: {} }' under the service stanza and reregister it.

Answer

Set the environment variable CONSUL_ALLOW_INSECURE_TRAFFIC=true on the 'payments' sidecar and restart it.

Answer

Run 'consul intention create -deny web payments' and then restart the 'web' sidecar proxy.

Question 8

A developer needs to remove an obsolete configuration key `app/legacy/timeout` from Consul's KV store so the application no longer reads it. Which command deletes this single key?

Accepted Answer

consul kv delete app/legacy/timeout. Removing a specific key is done with `consul kv delete` pointed at the exact path. That command eliminates the entry so the application stops seeing the obsolete timeout. Reading, overwriting with an empty value, or exporting the key all leave it in place, so none of them achieve the intended removal.

Answer

consul kv put app/legacy/timeout ""

Answer

consul kv get app/legacy/timeout

Answer

consul kv export app/legacy/timeout

Question 9

An operator runs `consul kv put config/app/timeout 30s` and then `consul kv get config/app/timeout`. The second command prints only `30s` with no metadata. The operator wants to see the key's `CreateIndex`, `ModifyIndex`, and `Flags` from the command line without writing code against the HTTP API. Which command should be used?

Accepted Answer

`consul kv get -detailed config/app/timeout`. The CLI exposes KV metadata through the `-detailed` flag on `consul kv get`, which prints `CreateIndex`, `ModifyIndex`, `LockIndex`, `Flags`, `Session`, and the value. Plain `get` and `-recurse` show only names and values, while `export` emits a JSON tree for backup. To see index and flag fields from the shell, `-detailed` is the correct choice.

Answer

`consul catalog nodes -service=config/app/timeout`

Answer

`consul kv export config/app/timeout`

Answer

`consul kv get -recurse config/app/timeout`

Question 10

How do you enable WAN federation between two Consul datacenters that do not share a network?

Accepted Answer

By deploying Mesh Gateways.. Mesh Gateways are the correct solution for enabling WAN federation between datacenters that do not share a network, such as when they are behind NAT or firewalls with no direct WAN gossip connectivity. Mesh gateways relay WAN gossip and service traffic over the LAN, allowing federation without direct server-to-server WAN links. This is the standard Consul pattern for isolated datacenters.

Answer

By disabling ACLs.

Answer

By increasing the gossip interval.

Answer

By using a load balancer in front of the servers.

Question 11

An operator is configuring a Connect sidecar proxy in a service definition so that outbound calls to a dependency are routed through the mesh. The dependency is registered as 'redis' in the same datacenter, listening on port 6379. The application expects to reach it at localhost:6379. Which upstream block in the sidecar_service definition achieves this?

Accepted Answer

upstreams = [{ destination_name = "redis", local_bind_port = 6379 }]. Upstreams in a sidecar_service definition require a destination_name and a local_bind_port. The local_bind_port is what the application dials on localhost, and the sidecar handles discovery, mTLS, and load balancing to the destination. Fields such as destination_port or service/port are not valid in this context, and a datacenter field is only needed for cross-datacenter upstreams.

Answer

upstreams = [{ destination_name = "redis", datacenter = "dc1", local_bind_port = 6379 }]

Answer

upstreams = [{ destination_name = "redis", destination_port = 6379 }]

Answer

upstreams = [{ service = "redis", port = 6379 }]

Question 12

A microservice uses a Consul session with a 30-second TTL and holds a lock on `locks/leader` via `acquire`. The service process is alive and healthy but its network link to the Consul servers is severed for several minutes. When connectivity is restored, the service finds it no longer owns the lock. Which behavior explains this outcome?

Accepted Answer

The session TTL expired because the service failed to renew it within the TTL window, so Consul invalidated the session and released its locks.. Session-based locks in Consul are leases: the client must renew the session before its TTL elapses, and failure to renew causes the session to expire, which deletes the session and releases all locks and keys it held. A network partition that blocks renewal therefore forfeits the lock, which is the intended safety behavior preventing a partitioned leader from retaining ownership indefinitely.

Answer

The lock was released because Consul applies a fixed maximum lock hold time of 15 seconds regardless of session TTL settings.

Answer

Consul invalidated the session because the node's health check for the service was marked critical during the outage.

Answer

The lock moved to another session immediately after the partition began because Consul rebalances locks among active sessions automatically.

Question 13

A platform team runs a Consul 1.15 datacenter with Connect enabled. They deploy a new service called 'payments' and register it with a sidecar proxy. Security policy requires that only the 'checkout' service may initiate connections to 'payments', and all other services must be denied, even if they present a valid service token. No intentions exist yet for this pair. Which action should the team take to enforce this requirement with the least operational overhead?

Accepted Answer

Create an allow intention from 'checkout' to 'payments' and rely on the default deny behavior for all other sources.. Intentions are the Connect authorization mechanism, and Consul denies any connection that does not match an allow intention. Creating a single allow intention from checkout to payments satisfies the requirement because all other sources are denied by default. Adding a wildcard deny is redundant and complicates the intention set, while ACLs and proxy upstream settings address different concerns.

Answer

Configure the 'payments' sidecar proxy with a restrictive upstream and set 'protocol' to 'tcp' in the service registration.

Answer

Create a deny intention from '*' to 'payments' and a separate allow intention from 'checkout' to 'payments'.

Answer

Enable ACLs in default-deny mode and grant the 'payments' service token only to 'checkout'.

Question 14

A service mesh operator is troubleshooting a connectivity issue between two services in a Consul 1.15 datacenter. The sidecar proxy for the 'frontend' service cannot reach the 'backend' upstream. The operator has confirmed that intentions allow the traffic. Which log should they inspect first to diagnose the issue on the sidecar proxy?

Accepted Answer

The Envoy proxy logs for the frontend sidecar.. The Envoy sidecar proxy logs are the most detailed source for diagnosing connectivity issues between services in a Connect mesh. They record upstream connection attempts, TLS errors, and response flags. While Consul agent and server logs can provide context, they lack the granularity needed to pinpoint why a specific proxy cannot reach its upstream. Checking the proxy logs first is the most efficient troubleshooting step.

Answer

The systemd journal for the 'backend' service.

Answer

The Consul agent logs on the node running the frontend service.

Answer

The Consul server logs on the leader.

Question 15

An operator manages a Consul 1.15 cluster where Connect is enabled and mTLS is active. They need to rotate the Connect CA root certificate for the datacenter. The new root must be distributed to all sidecar proxies without dropping existing connections, and the old root must remain trusted during the transition. Which sequence of actions accomplishes this?

Accepted Answer

Generate a new CA, cross-sign the new intermediate with the old root, update the CA configuration with the cross-signed bundle, then allow proxies to rotate leaf certificates via the existing CA provider.. The safe rotation path uses cross-signing: the new intermediate is signed by the old root so both roots are trusted during the transition. Updating the CA configuration with the cross-signed bundle lets Consul distribute the new root, and leaf certificates rotate automatically through the CA provider. This avoids downtime and preserves existing connections, unlike replacing the root outright or toggling mTLS.

Answer

Disable Connect, replace the CA, re-enable Connect, and re-register all services with new sidecar proxies.

Answer

Use 'consul connect ca set-config' to update the root certificate and private key, then restart all sidecar proxies to pick up the new root.

Answer

Set 'connect.enable_mtls' to false, update the CA, then set it back to true to force proxies to fetch new certificates.

Question 16

What is the role of a Consul server in a non-primary datacenter regarding ACLs?

Accepted Answer

They replicate the ACL state from the primary.. In a multi-datacenter Consul deployment, ACL state is authoritative only in the primary datacenter. Non-primary datacenters, including their servers, do not accept ACL writes; instead, they replicate the ACL state (tokens, policies, roles, and bindings) from the primary datacenter. This ensures a single source of truth for ACLs and prevents conflicting policies across datacenters. The replication is one-way, from primary to secondary, and is performed by the Consul servers in the secondary datacenter.

Answer

They ignore all ACLs.

Answer

They can write new ACL policies independently.

Answer

They become the primary if the original primary fails.

Question 17

A service 'orders' must call an upstream database service through its sidecar proxy. The upstream is registered in the same Consul datacenter and the operator wants the sidecar to discover it dynamically rather than hard-code an address. Which upstream configuration entry in the sidecar_service stanza accomplishes this?

Accepted Answer

destination_name set to the upstream service name, with no destination_type or fixed address.. Dynamic discovery for a sidecar upstream is achieved by naming the target service and letting the default service destination type drive catalog lookups. The proxy then watches Consul for healthy instances and balances across them. Static addressing, remote datacenter scoping, and prepared queries all change that behavior in ways the scenario does not require.

Answer

A local_bind_port and a destination_name, but with destination_type omitted and datacenter set to a remote value.

Answer

destination_type set to 'static' with a destination_name equal to the upstream's DNS name.

Answer

destination_type set to 'prepared_query' with a destination_name matching the upstream service.

Question 18

A service is registered with Consul using the HTTP API, but it is not appearing in DNS queries. The service definition includes a health check that is currently critical. What is the most likely reason for the DNS query failure?

Accepted Answer

The service's health check is critical, so Consul excludes it from DNS results.. Consul DNS returns only healthy service instances. When a service's health check is critical, the service is considered unhealthy and is excluded from DNS responses. Even though the service is registered and visible in the catalog, it will not resolve via DNS until the health check passes. This behavior ensures that clients only receive addresses of healthy instances, which is a core principle of service discovery in Consul.

Answer

The service is registered in a different datacenter than the DNS query.

Answer

The service name contains uppercase letters, which are not allowed in DNS queries.

Answer

The DNS interface is disabled by default and must be enabled in the agent configuration.

Question 19

A financial services firm requires that all service-to-service traffic inside its Consul 1.15 datacenter be encrypted and that services accept connections only when an explicit intention permits them. An operator enables Connect on all agents but services still accept plaintext traffic from non-mesh clients. Which additional step is required to enforce encryption and deny-by-default for the whole datacenter?

Accepted Answer

Set 'connect.enabled = true' in the agent configuration and register a default-deny intention, then ensure services only listen on loopback or are reachable solely through their sidecar proxy.. Enabling Connect provides the mTLS data plane, and a default-deny intention establishes least privilege so every allowed path must be stated explicitly. However, if the application still listens on a routable address, non-mesh clients can connect in plaintext and bypass the proxy entirely. Binding the workload to loopback or exposing it only through the proxy closes that gap, making encryption and deny-by-default enforceable for all traffic.

Answer

Enable TLS on the agents and rely on gossip encryption to protect service traffic.

Answer

Create a default-deny intention and set 'connect.enabled = true' in the server configuration only.

Answer

Configure the sidecar proxies to bind the service's original port and set a default-deny intention, so all inbound traffic must pass through the proxy.

Question 20

An operator wants to query the Consul catalog for all nodes that provide a service named `api` in the `us-east` datacenter. They need to retrieve the node names and addresses. Which Consul HTTP API endpoint should they use?

Accepted Answer

`GET /v1/catalog/service/api?dc=us-east`. The `/v1/catalog/service/:service` endpoint is designed to return all nodes and service instances for a specific service, optionally filtered by datacenter using the `dc` parameter. The health endpoint is more focused on health status, while the nodes endpoint lists all nodes. The agent services endpoint is local only.

Answer

`GET /v1/agent/services`

Answer

`GET /v1/catalog/nodes?dc=us-east`

Answer

`GET /v1/health/service/api?dc=us-east`