Consul 1.15 Practice Test 2 — 30 Questions

Question 1

What components can affect the outcome of a health check? (Select THREE)

Accepted Answer

Network connectivity. Network connectivity (A) is correct because a health check must be able to reach the target service or node over the network; if the path is blocked, the check fails regardless of the service's actual state. Application responsiveness (C) is correct because the check's result depends on whether the application actually answers within the configured timeout and returns the expected status. Agent configuration (D) is correct because settings such as check interval, timeout, and the check definition itself determine when and how the check runs and what result is reported. The client browser (B) is not involved, since health checks are performed by agents or servers, not by end-user browsers. Consul server uptime (E) is not a direct component of an individual health check outcome, as checks are executed by the local agent and only aggregated by the servers.

Answer

Client browser

Answer

Consul server uptime

Question 2

A developer registers a service named 'orders' on a Consul node and wants DNS queries for orders.service.consul to return the service's SRV records so clients can discover both the address and the port. The developer is verifying that the registration contains everything needed for SRV resolution. Which two registration elements must be present for SRV queries to return usable records? (Choose two.)

Accepted Answer

A port value in the service definition. SRV answers combine a target host and a port, so Consul needs both a port from the service definition and a resolvable address, taken from the service address or inherited from the node. Health checks, tags, and naming conventions affect filtering or presentation but are not prerequisites for generating SRV records. The two required elements are therefore the port and the address.

Answer

An explicit tag on the service

Answer

A health check attached to the service

Answer

A DNS-friendly service name with no underscores

Question 3

Which THREE of the following are valid check types in Consul?

Accepted Answer

TCP. Consul supports HTTP, TCP, and Script (external) health checks.

Answer

SSH

Answer

FTP

Question 4

You want to perform a list operation on a KV prefix to see all keys, but you don't want the values returned. Which API parameter helps reduce payload size?

Accepted Answer

keys=true. The `keys=true` query parameter on the Consul KV list endpoint instructs the API to return only the key names under the given prefix, omitting the associated values. This dramatically reduces the response payload size when you only need to enumerate keys rather than retrieve their contents. It is the documented way to perform a lightweight listing operation against a KV prefix.

Answer

raw=true

Answer

list=true

Answer

summarize=true

Question 5

Which Consul feature allows you to observe the KV store for changes and run a command in response?

Accepted Answer

Consul Watches. Consul Watches are a mechanism that allows you to monitor specific Consul data (such as KV pairs, health checks, or service listings) for changes and trigger an external handler (e.g., a script or HTTP endpoint) when a change occurs. The watch polls the Consul API at a specified interval and invokes the handler with the updated data. This is the intended feature for reacting to KV store modifications.

Answer

KV Hooks

Answer

Consul Events

Answer

Consul Connect

Question 6

What is the 'Consul Connect proxy' kind used for?

Accepted Answer

To mark a service definition as a sidecar proxy.. It defines a service that is explicitly a sidecar proxy.

Answer

To define a gateway.

Answer

To define the service that the proxy runs in front of.

Answer

To enable mTLS for the service.

Question 7

In a Consul health check, what does the 'notes' field provide?

Accepted Answer

A human-readable description. The 'notes' field in a Consul health check is a free-form, human-readable string that operators use to document the purpose, ownership, or remediation guidance for the check. It is displayed in the Consul UI and API responses but has no effect on the check's pass/fail evaluation. This makes it purely informational metadata for operators and dashboards.

Answer

The trigger time

Answer

The expected result

Answer

The logic for the check

Question 8

You want to perform a blocking query on a KV key to watch for updates. Which parameter must you provide in your request based on the last observed index?

Accepted Answer

index. To perform a blocking query on a KV key, you must provide the 'index' parameter, which specifies the last observed ModifyIndex. Consul will hold the request until the key's index exceeds this value or the wait time expires.

Answer

consistency

Answer

wait

Answer

timeout

Question 9

Which THREE of the following are key components of a service definition?

Accepted Answer

Check/Health Check. In a service definition (as used by service discovery/registry tools such as Consul), the Service Name (E) is the fundamental identifier that registers the service and lets other services and DNS/API lookups discover it, so it is a required key component. The Port (D) is also essential because it tells clients and the registry on which TCP/UDP port the service is listening, enabling correct routing and connection. A Check/Health Check (C) is likewise a core part of the definition, since it defines how the registry verifies the instance is healthy (e.g., an HTTP, TCP, or script check with an interval and timeout) and removes unhealthy instances from discovery. By contrast, a Secret Key (A) is a credential/security artifact, not a structural element of a service definition, and a Node BIOS version (B) is hardware/firmware inventory data that has no role in describing or discovering a service.

Answer

Secret Key

Answer

Node BIOS version

Question 10

A Consul cluster has a service registered with an HTTP health check pointing to https://10.0.0.5:8443/health. The check is failing with a TLS certificate verification error even though the service is healthy. The operator wants Consul to skip certificate verification for this specific check without disabling TLS globally. Which check configuration field should be set?

Accepted Answer

tls_skip_verify. HTTP health checks in Consul support a tls_skip_verify boolean that disables certificate verification for that individual check. This allows checks against services with self-signed or internal CA certificates to succeed without weakening the agent's global TLS posture. The other listed fields either apply to agent-level TLS settings or to unrelated aspects of the check request.

Answer

ca_file

Answer

verify_outgoing

Answer

method

Question 11

If a Consul agent is configured with 'disable_remote_exec = true', how does this affect the KV store?

Accepted Answer

It has no effect on the KV store.. 'disable_remote_exec' controls whether Consul's remote execution feature (the 'consul exec' command) is allowed on the agent. It has no relationship to the KV store — KV reads, writes, watches, and consistency modes are governed by separate ACL and query parameters. Setting this flag simply blocks remote command execution for security hardening.

Answer

It forces all KV reads to be consistent.

Answer

It prevents all KV writes.

Answer

It disables KV watches.

Question 12

Which of the following best describes the 'consul agent -dev' mode in relation to service discovery?

Accepted Answer

It provides a single-node Consul environment for testing.. The 'consul agent -dev' flag starts a single-node Consul agent configured as a server and client in one process, with an in-memory datastore, no persistence, and no cluster join. It is explicitly designed for local development, testing, and demos — not for production — and it still exposes the DNS interface, HTTP API, and service catalog so you can exercise service discovery locally.

Answer

It disables DNS interfaces.

Answer

It forces the service catalog to be stored in Redis.

Answer

It is suitable for production clusters.

Question 13

You notice that the KV store is not consistent across datacenters. What is the cause?

Accepted Answer

KV store is datacenter-local by design.. Consul's KV store is datacenter-local by design — each datacenter maintains its own independent KV namespace with no automatic replication to peer datacenters. When you write a key in dc1, it does not appear in dc2 unless you explicitly write it there or use a tool like consul-replicate. This is expected behaviour, not a fault.

Answer

The Raft protocol is broken.

Answer

The ACL token lacks the 'write' permission.

Answer

The WAN gossip is disabled.

Question 14

Which command line tool can you use to manually trigger a TTL check update for a specific service?

Accepted Answer

curl -X PUT http://localhost:8500/v1/agent/check/pass/checkID. The Consul HTTP API exposes agent check endpoints that allow external systems to push health status updates. A TTL check registered with the local agent can be manually marked passing by sending an HTTP PUT to /v1/agent/check/pass/<checkID> on port 8500. This is the documented mechanism for scripts and external monitors to report liveness without waiting for the TTL to expire.

Answer

consul kv put

Answer

consul agent -check-update

Answer

consul health update

Question 15

Which TWO of the following statements are true about the 'passing' parameter in DNS queries?

Accepted Answer

It returns only services with passing health checks.. Option B is correct because the 'passing' parameter filters DNS query results so that only service instances whose health checks are currently passing are returned, which is essential for service discovery in tools like Consul. Option E is correct because 'passing' is appended as a query string parameter in the DNS query URL, for example when querying a service name with ?passing to restrict results to healthy instances. Option A is incorrect because the 'passing' parameter does not require manual service registration; services are registered through the service registry or API, not through this query parameter. Option C is incorrect because 'passing' is a query-time filter and has no effect on restarting the DNS server. Option D is incorrect because 'passing' is a per-query parameter, not a permanent configuration setting.

Answer

It requires manual service registration.

Answer

It forces the DNS server to restart.

Answer

It is a permanent configuration setting.

Question 16

Which Consul API endpoint is used to create a new session that can be used for locking KV keys?

Accepted Answer

/v1/session/create. The correct endpoint is /v1/session/create because it is specifically designed to create a new session in Consul. Sessions are the foundation for distributed locks and KV key acquisition. When you create a session, Consul returns a session ID that can be used with the KV acquire endpoint to obtain a lock on a key. This endpoint accepts parameters like name, TTL, and behavior on invalidation, allowing fine-grained control over lock semantics.

Answer

/v1/kv/acquire

Answer

/v1/lock/init

Answer

/v1/session/renew

Question 17

When using multiple datacenters, what is the primary role of the 'consul-template' tool?

Accepted Answer

To generate configuration files based on Consul data.. consul-template is a daemon that watches Consul for changes (KV pairs, services, health checks) and renders configuration files from templates, optionally running commands when files change. Its primary role is dynamic configuration generation based on Consul data, commonly used to configure HAProxy, Nginx, or Vault. It does not provision infrastructure or manage the cluster.

Answer

To provision infrastructure.

Answer

To replicate KV stores.

Answer

To manage the Consul cluster nodes.

Question 18

You need to deny all traffic between 'service-a' and 'service-b' using intentions. What is the most efficient way to achieve this?

Accepted Answer

consul intention create -deny service-a service-b. Intentions can be set to 'deny' explicitly, which overrides any 'allow' rules.

Answer

consul intention create -allow-none service-a service-b

Answer

consul intention set -action=drop service-a service-b

Answer

consul intention delete service-a service-b

Question 19

Which protocol do Consul servers use to maintain the WAN gossip pool?

Accepted Answer

Serf (SWIM). Consul servers use the Serf library, which implements the SWIM gossip protocol, to maintain the WAN gossip pool across datacenters. Serf handles membership, failure detection, and lightweight message dissemination over UDP/TCP. This is distinct from Raft, which handles consensus for the replicated state.

Answer

gRPC

Answer

DNS

Answer

HTTP

Question 20

What is the recommended number of Consul servers per datacenter to ensure high availability?

Accepted Answer

3. The recommended number of Consul servers per datacenter for high availability is three, because it allows the cluster to tolerate the failure of one server while maintaining quorum. Consul uses the Raft consensus algorithm, which requires a majority of servers to be available for writes. With three servers, a single failure leaves two servers, still a majority, so the cluster remains operational.

Answer

2

Answer

1

Answer

10