Consul 1.15 Practice Test 3 — 10 Questions

Question 1

A Consul cluster spans multiple datacenters. A service `user-auth` is registered in both `dc1` and `dc2`. A client in `dc1` queries the DNS interface for `user-auth.service.consul`. By default, which instances will be returned?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Only instances from `dc1`.. By default, Consul DNS queries are limited to the local datacenter of the agent that receives the query. A client in `dc1` querying `user-auth.service.consul` will only get instances from `dc1`. To discover instances in other datacenters, the query must explicitly include the datacenter, such as `user-auth.service.dc2.consul`. This design promotes locality and avoids unintended cross-datacenter traffic.

Answer

Only instances from `dc2` if `dc1` has no healthy instances.

Answer

Instances from both `dc1` and `dc2`, load-balanced.

Answer

Instances from all datacenters, sorted by latency.

Question 2

Which command is used to check the status of a registered service?

Accepted Answer

consul health service. The 'consul health service' command queries the health of all instances of a named service, returning the nodes, their health check statuses, and associated metadata. It is the standard CLI way to inspect whether a registered service is passing its checks and is reachable through the catalog.

Answer

consul check

Answer

consul status

Answer

consul list

Question 3

You are troubleshooting a health check that seems to be hanging. Which flag, if available, would provide more information about the check's execution within the agent logs?

Accepted Answer

-log-level=debug. Increasing the agent's log level to 'debug' provides detailed information about check execution and processing.

Answer

-verbose

Answer

-monitor-checks

Answer

-trace

Question 4

A service is intermittently failing to resolve via DNS because it has multiple health checks, some of which are 'warning'. How do you ensure it is only returned when all checks are 'passing'?

Accepted Answer

Use the 'passing' query parameter in the DNS request.. Consul DNS supports a 'passing' query parameter that filters results to only those service instances whose health checks are all passing — warning and critical instances are excluded. Appending ?passing to the DNS query (e.g., 'dig @127.0.0.1 web.service.consul SRV?passing') ensures the service is returned only when every check is green. This is the standard mechanism for strict health-based DNS filtering.

Answer

Configure 'service_prefix' in DNS settings.

Answer

Use the 'stale' query parameter.

Answer

Set 'enable_tag_override' to true.

Question 5

What is the function of the 'consul connect envoy' command?

Accepted Answer

To launch and manage the Envoy proxy sidecar for a service.. This command bootstraps and manages the lifecycle of the Envoy sidecar process.

Answer

To generate TLS certificates for Envoy.

Answer

To verify the Envoy binary installation.

Answer

To update the Envoy configuration via CLI.

Question 6

What is the purpose of the 'upstreams' block in a service definition?

Accepted Answer

To configure the outbound dependencies of the service.. It defines the targets that the sidecar proxy should be allowed to proxy requests to.

Answer

To set the service's health check interval.

Answer

To limit the total number of connections.

Answer

To define the ingress rules.

Question 7

An operator configures a TCP health check for a database service on port 5432, specifying tcp = "localhost:5432" and interval = "10s". The database process is running and accepting connections, but the check is reported as critical. What is the most likely explanation?

Accepted Answer

The Consul agent does not have network permissions or the database is bound only to a specific interface not matching localhost.. A TCP health check succeeds only if the agent can establish a TCP connection to the specified address and port. Even if the database is running, it might be listening on a different interface (e.g., only on a specific IP, not localhost) or the agent might lack the necessary permissions. The configured address localhost:5432 must match where the database is actually listening. Therefore, the most likely explanation is a mismatch in the listening address or a permission issue preventing the connection.

Answer

The check is being executed from a different network namespace than the database process.

Answer

The interval is too short; Consul requires a minimum interval of 30 seconds for TCP checks.

Answer

The TCP check requires an explicit timeout value, and without it the check immediately fails.

Question 8

When using the HTTP health check type, how can you verify that a specific header is included in the health check request?

Accepted Answer

By adding the 'header' object to the check definition. In Consul's HTTP health check definition, you can specify custom headers using the 'header' object, which is a map of header names to arrays of values. This allows the health check request to include specific headers required by the application.

Answer

By appending it to the URL string

Answer

It is not possible

Answer

By setting the environment variable

Question 9

Which THREE of the following are benefits of using the Consul DNS interface?

Accepted Answer

No application code changes required.. Ease of use, platform-agnostic, and no application changes are benefits.

Answer

Provides advanced traffic shifting.

Answer

Encrypts all traffic between services.

Question 10

When troubleshooting a service that fails to start its Envoy proxy, which service definition field should you check for incorrect configuration?

Accepted Answer

proxy. The proxy field in a Consul service definition configures the Envoy sidecar, including upstreams, protocol, and the sidecar's port and configuration. If Envoy fails to start, the proxy stanza is the first place to inspect for malformed upstream definitions, invalid protocol values, or missing sidecar service registration.

Answer

checks

Answer