Consul 1.15 Practice Test 5 — 25 Questions

Question 1

You are deploying a new Consul datacenter and need to configure the servers to join the existing WAN gossip pool. Which configuration parameter should you set on the new servers to specify the addresses of the existing WAN servers?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

`retry_join_wan`. To join a new datacenter to an existing WAN gossip pool, you must configure `retry_join_wan` on the servers in the new datacenter. This parameter accepts a list of addresses of servers in other datacenters. The agent will continuously attempt to join the WAN pool using these addresses, providing resilience. This is the standard method for WAN federation in Consul 1.15.

Answer

`start_join_wan`

Answer

`join_wan`

Answer

`retry_join`

Question 2

A platform team operates two Consul datacenters, 'dc1' and 'dc2', and wants operators in dc2 to resolve service names registered in dc1 without a full mesh of local agents. They have already used 'consul join -wan' to link the server agents. Which feature should they rely on for DNS lookups of remote services?

Accepted Answer

The built-in remote datacenter query capability, where a lookup such as 'web.service.dc1.consul' is forwarded to dc1's servers over the WAN federation link.. Once server agents are joined over the WAN, Consul's DNS interface resolves remote services using the datacenter label in the query name, forwarding the request to the owning datacenter's servers. No recursor changes, address translation, or snapshot copying are needed. The federation link itself provides the cross-datacenter query path for both DNS and HTTP interfaces.

Answer

Deploying a second Consul cluster in dc2 that mirrors dc1 using the 'consul snapshot restore' command on a schedule.

Answer

Configuring 'recursors' on every dc2 client agent so that queries for dc1 services are sent to dc1's DNS port on 8600.

Answer

Enabling 'translate_wan_addrs' on dc1 servers so that dc2 agents can resolve remote service names locally.

Question 3

Which TWO of the following are features of Consul Connect native integration?

Accepted Answer

The app handles its own mTLS handshake.. Consul Connect native integration means the application itself participates directly in the service mesh rather than relying on a sidecar proxy, so option A is correct: the app performs its own mTLS handshake to establish mutually authenticated, encrypted connections with other services. Option B is also correct because a natively integrated app uses the Consul agent's local HTTP API (e.g., the /v1/agent/connect/ca/leaf/ endpoint) to obtain its leaf certificate and CA roots for that mTLS handshake. Option C is wrong because native integration is language-agnostic — Consul provides client libraries for multiple languages and the API can be called from any runtime, not just Go. Option D is wrong because the whole point of native integration is that no sidecar proxy is required for routing or encryption. Option E is wrong because native integration specifically enables secure mTLS traffic, not merely non-secure traffic.

Answer

The app must be written in Go.

Answer

The sidecar proxy is still required for routing.

Answer

It supports only non-secure traffic.

Question 4

An operator registers a web service with an HTTP health check. The check is configured with http = "http://localhost:8080/health" and method = "GET". The service's health endpoint returns HTTP 500 when the application is running but has a database connection problem. What status will Consul report for this check?

Accepted Answer

critical. Consul's HTTP health check considers only HTTP 2xx responses as passing. Any other response code, including 500, results in a critical status. The endpoint is reachable, but the server error indicates an unhealthy application state. Warning and maintenance are not automatically applied based on HTTP status codes.

Answer

passing

Answer

warning

Answer

maintenance

Question 5

A Consul cluster is used for service discovery across multiple datacenters. A service named 'api' is registered in both datacenter 'dc1' and 'dc2'. A client in 'dc1' needs to discover instances of 'api' in 'dc2' using DNS. Which DNS query format should the client use?

Accepted Answer

api.service.dc2.consul. Consul DNS allows querying services in other datacenters by including the datacenter name in the domain. The correct format is '.service..consul'. For example, 'api.service.dc2.consul' returns instances of 'api' in 'dc2'. Other formats either misplace the datacenter or use unsupported query parameters. This feature enables cross-datacenter service discovery without direct API calls.

Answer

api.service.consul?dc=dc2

Answer

api.dc2.service.consul

Answer

api.service.consul.dc2

Question 6

A Consul operator wants to ensure that if the primary datacenter becomes unavailable, the secondary datacenter can continue to operate for existing services and intentions. Which statement best describes Consul's behavior in this scenario?

Accepted Answer

The secondary datacenter will continue to serve existing services and enforce replicated intentions, but new ACL tokens or intention changes cannot be made until the primary is restored.. Consul's multi-datacenter design allows secondary datacenters to remain operational for existing services and enforce replicated intentions even if the primary is down. However, administrative changes to ACLs or intentions require the primary, so they are blocked until connectivity is restored. This provides high availability for data plane operations while maintaining centralized control.

Answer

The secondary datacenter will switch to using its local ACLs and intentions, ignoring the primary's configuration entirely.

Answer

The secondary datacenter will immediately stop all services and return errors until the primary datacenter is reachable again.

Answer

The secondary datacenter will automatically promote itself to primary and continue operating without interruption.

Question 7

A Consul operator is defining an HTTP health check for a service and wants to ensure the check request includes custom headers and that the check tolerates a slow endpoint. Which two check definition fields should be used to accomplish these goals? (Choose two.)

Accepted Answer

timeout. To add custom headers, the header field is used within the HTTP check definition. To tolerate a slow endpoint, the timeout field must be increased to allow more time for the response. Together these two fields satisfy the stated requirements, while method, interval, and tls_skip_verify address different aspects of check behavior.

Answer

tls_skip_verify

Answer

interval

Answer

method

Question 8

A Consul operator registers a web service on a node with a service-level health check that uses the HTTP type and points to http://127.0.0.1:8080/health. The check has been passing for weeks, but the team now wants to stop advertising the service in DNS and the service catalog when the /health endpoint returns HTTP 500. Which Consul check status will the service health be reported as when the endpoint returns 500?

Accepted Answer

critical. HTTP health checks in Consul treat only HTTP 200 as passing. Any other response, including 500, connection refused, or timeout, is reported as critical. This is why the service will be removed from healthy DNS and catalog queries when the endpoint fails. The warning state requires explicit configuration or a script exit code, and maintenance mode is operator-initiated.

Answer

warning

Answer

passing

Answer

maintenance

Question 9

An operator is configuring a new Consul datacenter that must be able to resolve services in a remote datacenter using the DNS interface. The remote datacenter is already federated and reachable. Which query format should the operator use to resolve a service named 'web' in the remote datacenter 'dc2'?

Accepted Answer

web.service.dc2.consul. Consul DNS encodes the datacenter as a label positioned directly after the 'service' label. The canonical form is .service..consul. Other label orders or query parameters are not recognized by the DNS interface, so only the format with the datacenter immediately following 'service' will trigger a WAN-forwarded lookup to the remote catalog.

Answer

dc2.web.service.consul

Answer

web.service.consul?dc=dc2

Answer

web.dc2.service.consul

Question 10

A team configures a script health check on a client agent with `interval` set to 30s and `timeout` set to 5s. The script normally finishes in under a second, but during a nightly batch job it occasionally blocks on a lock for over a minute. The team wants Consul to mark the service unhealthy when the script exceeds the timeout instead of waiting indefinitely. What does Consul do when the script has not exited by the timeout value?

Accepted Answer

The agent marks the check critical and retries the script at the next configured interval.. A script check that outlives its configured `timeout` is failed: the agent records the check as critical without blocking the check loop, and the script runs again at the next interval. This is the mechanism that turns a hung batch job into a visible unhealthy status. The agent does not kill the stray process, so overlapping executions are possible if scripts routinely exceed the timeout.

Answer

The agent pauses the check and marks it as maintenance until the script returns.

Answer

The agent waits for the script to exit, then records the result with a warning status.

Answer

The agent marks the check critical immediately and attempts to terminate the running process.

Question 11

You are configuring a Consul Connect service mesh and need to enable mTLS for all services in the datacenter. Which configuration setting must be enabled in the Consul server agent configuration to turn on Connect and enforce mTLS globally?

Accepted Answer

connect { enabled = true }. To enable Consul Connect and mTLS globally, the 'connect' stanza with 'enabled = true' must be set in the Consul agent configuration, typically on all servers and clients. This activates the Connect subsystem, allowing services to obtain certificates and use sidecar proxies. Other settings like TLS verification for the agent, HTTPS port, or ACLs do not enable Connect.

Answer

tls { defaults { verify_incoming = true } }

Answer

ports { https = 8501 }

Answer

acl { enabled = true, default_policy = "deny" }

Question 12

You are configuring a Consul secondary datacenter to replicate ACLs from the primary. You have set 'primary_datacenter' and 'acl_replication_token' on the servers. However, replication is failing. Which of the following is the most likely cause?

Accepted Answer

The 'acl_replication_token' does not have 'acl:read' permissions on the primary datacenter.. ACL replication requires a token with 'acl:read' permissions on the primary datacenter. Without it, the secondary servers cannot fetch ACL data, leading to replication failure. Other issues like encryption key mismatch would prevent WAN communication entirely, but the scenario indicates that the token and primary datacenter are configured, pointing to a permissions problem.

Answer

The secondary datacenter does not have 'verify_outgoing' enabled for TLS.

Answer

The 'encrypt' key is different between the primary and secondary datacenters.

Answer

The 'acl_replication_token' is set on the client agents instead of the servers.

Question 13

A platform team runs a gRPC service and wants Consul to use the standard gRPC health checking protocol rather than a custom script. The service listens on port 50051 and exposes the standard health service. Which check definition should they use?

Accepted Answer

check { name = "grpc-api" grpc = "127.0.0.1:50051" interval = "10s" }. Consul's grpc check type natively implements the standard gRPC health checking protocol, calling the health service and interpreting SERVING as passing. The http check cannot speak the gRPC wire format, h2ping only validates HTTP/2 connectivity without consulting the health service, and tcp merely opens a socket. Only the grpc check actually queries the service's reported health status.

Answer

check { name = "grpc-api" tcp = "127.0.0.1:50051" interval = "10s" }

Answer

check { name = "grpc-api" http = "127.0.0.1:50051" interval = "10s" }

Answer

check { name = "grpc-api" h2ping = "127.0.0.1:50051" interval = "10s" }

Question 14

A platform team runs a fleet of Consul 1.15 server agents behind a strict network policy that blocks all outbound DNS traffic from the server hosts. The team wants the servers to periodically verify that each registered catalog node's DNS name resolves, without installing any extra binaries. Which check definition should they use, and what must they configure so the check can run?

Accepted Answer

A dns check with a name or address field, pointed at a resolver the hosts are still permitted to reach.. The dns check type runs inside the Consul agent and resolves a hostname through the system resolver or an address supplied in the check definition, which satisfies the no-extra-binaries requirement. The network policy still matters: the check needs a resolver it can actually reach, so the team must point the check at a permitted DNS server or lift the block for that destination.

Answer

A script check that invokes getent hosts, because Consul has no built-in DNS resolution check type.

Answer

An alias check that aliases the node's own Consul DNS name, because alias checks resolve names locally.

Answer

An http check targeting https://127.0.0.1:8500/v1/catalog/nodes, because the HTTP API exposes node health.

Question 15

You are configuring a health check that should be considered passing as long as the HTTP response code is in the 2xx range. Which HTTP check configuration achieves this?

Accepted Answer

Use the default HTTP check without specifying any `status` codes.. Consul's HTTP check by default treats any 2xx response code as passing. No additional configuration is needed to achieve this behavior; specifying a URL and interval is sufficient. Other options either set initial status, control request formatting, or manage TLS verification, none of which alter the default status code evaluation. The correct choice is to rely on the default behavior.

Answer

Set `status: "passing"` in the check definition.

Answer

Set `method: "GET"` and `header: { "Accept": ["application/json"] }`.

Answer

Add `tls_skip_verify: true` to the check.

Question 16

A new engineer is configuring a Consul server agent for a datacenter named 'west' and wants the agent to automatically rejoin the WAN federation after a restart without manual intervention. Which configuration setting should they use?

Accepted Answer

'retry_join_wan' with the addresses of server agents in the other datacenter, so the agent retries WAN join attempts on startup and after failures.. 'retry_join_wan' is the supported mechanism for resilient WAN federation membership. It lists remote server addresses and retries joins with backoff, so a restarted or temporarily disconnected server agent rejoins the WAN pool without operator action. Options that address LAN joins or address translation do not restore cross-datacenter membership.

Answer

'retry_join' with the LAN addresses of servers in the same datacenter, which also covers WAN rejoin as a side effect.

Answer

'translate_wan_addrs' set to true, which causes the agent to discover and join the WAN pool automatically.

Answer

'start_join_wan' with a single remote server address, which retries only once at startup and then stops.

Question 17

What is true about Consul health checks? (Select TWO)

Accepted Answer

They run on the local agent. They run locally on the agent and can be associated with specific services.

Answer

They only support GET requests

Answer

They always run on the server

Answer

They cannot be disabled

Question 18

An operations engineer registers an external PostgreSQL service on a Consul 1.15 client agent. The database listens on 10.20.30.40:5432 and is not managed by Consul, but a co-located exporter on the same VM exposes readiness at http://127.0.0.1:9187/ready. The engineer wants Consul to gate the service on the exporter's readiness signal while still advertising the database's real address and port to consumers. Which registration best achieves this?

Accepted Answer

Register the service with address 10.20.30.40 and port 5432, and attach an http check with target http://127.0.0.1:9187/ready.. A service definition's address and port fields describe where consumers should connect, while checks are independent probes the agent executes. Pointing an http check at the loopback exporter while advertising the database's real endpoint gives accurate discovery plus a meaningful readiness gate. The other approaches either mispublish the endpoint, detach the check from the service, or substitute a weaker signal.

Answer

Register only an http check named postgres-ready and rely on the check ID to imply the backing service.

Answer

Register the service with address 127.0.0.1 and port 9187, and attach a tcp check on the exporter port.

Answer

Register the service with address 10.20.30.40 and port 5432, and attach a tcp check to 10.20.30.40:5432 with a short interval.

Question 19

A Consul administrator is reviewing how check results propagate and wants to understand which factors determine whether a service instance is considered healthy in the catalog. Which two factors directly determine a service's aggregate health status in Consul? (Choose two.)

Accepted Answer

The status of the node-level checks associated with the agent hosting the service. Consul determines a service instance's health from two sources: the checks attached to that service and the checks attached to the node hosting it. A critical node check, such as a failed serfHealth, makes every service on that node unhealthy, while a critical service check makes only that instance unhealthy. Other attributes such as sibling service count, datacenter, or server version do not participate in the health computation.

Answer

The number of other services registered on the same agent

Answer

The Consul version running on the server that handles the catalog write

Answer

The datacenter in which the service is registered

Question 20

A service is registered with a check that has deregister_critical_service_after set to 30m. The service's check enters the critical state due to a transient network partition. The partition is resolved after 20 minutes, and the check returns to passing. What is the effect on the service registration?

Accepted Answer

The service remains registered because the check returned to passing before the 30-minute deregistration timer expired. The deregister_critical_service_after field starts a timer when a check becomes critical and resets that timer if the check leaves the critical state. In this scenario, the check returned to passing after 20 minutes, before the 30-minute threshold, so the service remains registered. Deregistration only happens if the check stays critical continuously for the full configured duration.

Answer

The service is deregistered immediately when the check becomes critical

Answer

The service is deregistered after 30 minutes from the initial registration, regardless of check state

Answer

The service is deregistered because it was critical at any point