Consul 1.15 Practice Test 6 — 10 Questions

Question 1

An operator is troubleshooting a Consul datacenter that was recently federated with another datacenter. They notice that cross-datacenter service discovery works, but ACL tokens created in the primary datacenter are not being recognized in the secondary datacenter. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The secondary datacenter's servers are not configured with a valid acl_replication_token.. ACL replication in Consul is driven by the secondary datacenter, which uses acl_replication_token to authenticate to the primary and pull updates. Without a valid token, the secondary cannot fetch new tokens or policies, so tokens created in the primary will not be recognized. Other settings like retry_join_wan and gossip encryption affect WAN federation but not the ACL replication process itself.

Answer

The primary datacenter's servers are not configured with retry_join_wan pointing to the secondary.

Answer

The secondary datacenter's servers have a different gossip encryption key than the primary.

Answer

The secondary datacenter is configured with primary_datacenter set to its own name instead of the primary's name.

Question 2

An operator registers a service 'cache' with an HTTP health check pointing to https://10.0.0.5:8443/health. The service appears in the catalog, but DNS queries for cache.service.consul return no records, and the check status shows critical with the message 'Get https://10.0.0.5:8443/health: x509: certificate signed by unknown authority'. Which action resolves the issue while keeping the check functional?

Accepted Answer

Add the CA certificate to the agent's ca_file or ca_path configuration and reload the agent.. The critical status is caused by the agent's inability to verify the HTTPS endpoint's certificate. Supplying the issuing CA through the agent's ca_file or ca_path configuration lets the HTTP check complete TLS validation and report passing, which restores the instance to DNS answers. This corrects the trust configuration rather than disabling verification or weakening the check.

Answer

Set tls_skip_verify to true in the check definition.

Answer

Re-register the service with a TCP check on port 8443 instead of an HTTP check.

Answer

Change the check to use HTTP instead of HTTPS.

Question 3

You have a service that requires specific routing logic based on the environment. How can you distinguish between 'production' and 'staging' instances of the same service name using metadata?

Accepted Answer

Apply 'production' or 'staging' tags to the service definition.. Consul tags are arbitrary key-value-like labels attached to a service registration and are the standard mechanism for distinguishing instances of the same service across environments. By registering production instances with the tag 'production' and staging instances with 'staging', you can use service discovery queries (e.g., via DNS SRV or the HTTP API with tag filters) to route traffic to the correct environment. This preserves a single service name while enabling environment-aware routing.

Answer

Use different service names for every environment.

Answer

Modify the service's port number.

Answer

Assign different Consul datacenters.

Question 4

A service team wants its check to be automatically deregistered along with the service when the service is deregistered, but they also want the check to survive a Consul agent restart without being manually recreated. Which configuration achieves both goals?

Accepted Answer

Define the check inside the service block with a name but no explicit check ID, and register the service through the agent configuration directory.. Nesting a check inside a service block without an explicit check ID causes Consul to generate an ID linked to the service, so deregistering the service also removes the check. Declaring that service in the agent configuration directory means the agent re-registers it on every startup, providing restart persistence. API-only registration and in-memory reliance fail both the automatic removal and the restart-survival requirements.

Answer

Define the check in the service block with an explicit check ID that differs from the service ID.

Answer

Register the check separately through the HTTP API with a standalone check ID and no service association.

Answer

Register the service and check via the HTTP API and rely on the agent's in-memory state to persist across restarts.

Question 5

A Consul 1.15 cluster spans three datacenters: dc1 (primary), dc2, and dc3. The operations team wants to enable cross-datacenter service discovery for a service named 'web' that is deployed in all datacenters. They configure a prepared query with a failover policy. Which statement accurately describes how the failover block in the prepared query affects query results when the local datacenter's 'web' service has no healthy instances?

Accepted Answer

The failover block can specify a list of datacenters to try in order, and Consul will return results from the first datacenter in the list that has healthy instances.. Prepared queries support a failover block that lists datacenters in priority order. When the local datacenter has no healthy instances, Consul tries each listed datacenter in sequence and returns results from the first with healthy instances. This provides deterministic cross-datacenter failover for service discovery.

Answer

The failover block requires that all datacenters be in the same WAN gossip pool and have identical ACL tokens.

Answer

The failover block automatically selects the datacenter with the lowest latency, regardless of the order specified.

Answer

The failover block is only used for DNS queries, not for HTTP API queries.

Question 6

You are troubleshooting a Consul Connect service mesh and need to verify which intentions are currently configured. Which Consul CLI command lists all intentions?

Accepted Answer

consul intention list. The correct command to list all intentions is 'consul intention list'. This command retrieves and displays all intentions configured in the Consul datacenter. The other options are either non-existent commands or incorrect syntax. Being able to quickly list intentions is essential for troubleshooting and auditing Connect authorization.

Answer

consul connect intentions

Answer

consul intention get -all

Answer

consul catalog intentions

Question 7

What is the primary role of the Consul Connect 'upstream' configuration?

Accepted Answer

To define the services that a local service can connect to.. The Consul Connect 'upstream' configuration defines the services that a local service can connect to through the mesh. It specifies the destination service name, optional datacenter, and local port that the sidecar proxy listens on to forward traffic to the upstream. This is the core mechanism for establishing service-to-service connections in Consul Connect.

Answer

To set intention priority.

Answer

To register external services.

Answer

To define health check ports.

Question 8

Which TWO of the following are benefits of using Consul Connect?

Accepted Answer

Centralized authorization policies.. Consul Connect is HashiCorp's service mesh feature, and one of its core benefits is centralized authorization policies (Option A): intentions define which services may communicate with which others, and these policies are managed centrally in Consul and enforced by sidecar proxies, giving consistent, identity-based access control across the mesh. Option B is also correct because Consul Connect automatically manages mTLS: it provides built-in certificate authority functionality that issues, rotates, and distributes certificates to sidecar proxies, so service-to-service traffic is encrypted and mutually authenticated without application changes. Option C is wrong because Connect's sidecar proxies add only minimal overhead and are not intended to increase latency as a benefit. Option D is wrong because firewalls are still required for network segmentation and host-level security; Connect complements rather than eliminates them. Option E is wrong because Consul Connect is a service mesh for secure service communication, not a database replication tool.

Answer

Increased application latency.

Answer

Elimination of firewalls.

Answer

Automatic database replication.

Question 9

A DevOps engineer needs to register an external service that runs outside the Consul datacenter, such as a third-party API. The service has a static IP address and a known port. Which Consul feature should be used to make this service discoverable within Consul?

Accepted Answer

Consul's external service registration with a static address. To register an external service in Consul, you can use the service registration API or configuration files to define a service with a static address and port. Consul treats it as a regular service in the catalog, and it can be discovered via DNS or HTTP API. This is the correct approach for integrating external endpoints into Consul's service discovery.

Answer

Consul's intention-based access control

Answer

Consul's prepared queries with failover

Answer

Service mesh with sidecar proxies

Question 10

Which interface would you use to register a service dynamically using standard tools like 'curl'?

Accepted Answer

HTTP API. The HTTP API is the primary programmatic interface for Consul and exposes RESTful endpoints such as PUT /v1/agent/service/register, which can be invoked with standard tools like curl. This makes it the correct choice for dynamically registering a service without using the CLI or configuration files. The DNS interface is read-only for service discovery, and gossip is an internal membership protocol, not a registration mechanism.

Answer

DNS interface

Answer

Gossip protocol

Answer

CLI agent command