Consul 1.15 Practice Test 7 — 10 Questions

Question 1

When using Consul KV for distributed locking, why is it recommended to use a session?

Accepted Answer

It allows for TTL-based automatic lock release.. Sessions in Consul provide a mechanism for TTL-based automatic lock release. When a lock is acquired using a session, the session must be periodically renewed; if the client fails to renew before the TTL expires, Consul automatically invalidates the session and releases any locks held by it, preventing deadlocks from crashed or partitioned clients.

Answer

It encrypts the lock data.

Answer

It allows for multiple lock holders.

Answer

It speeds up read operations.

Question 2

What is the primary difference between a 'script' check and an 'http' check in terms of how they are processed by the Consul agent?

Accepted Answer

Script checks require executing a local process. Script checks execute a local command or script on the Consul agent's host, while HTTP checks make an HTTP request to a specified URL. The key processing difference is that script checks spawn a subprocess, which can be resource-intensive and requires the script to be present on the node. HTTP checks are handled internally by the agent's HTTP client without executing external code.

Answer

HTTP checks are more secure

Answer

Only HTTP checks support intervals

Answer

Script checks are faster

Question 3

An engineer is designing a service that must coordinate access to a shared resource using Consul KV sessions and needs to understand the guarantees the lock provides. Which TWO statements accurately describe how Consul's KV locking with sessions behaves? (Choose two.)

Accepted Answer

A lock is acquired by writing a key with the `acquire` parameter and the session ID, and succeeds only if no other valid session currently holds it.. Consul locks are acquired with the `acquire` operation carrying a session ID, and they are released automatically when that session expires or is invalidated. Mutual exclusion is guaranteed because only one valid session can hold a given key. Release is performed through the same key-write path with the `release` operation, and session renewal happens at the session endpoint, not the KV endpoint.

Answer

Session TTL renewal must be performed through the `/v1/kv` endpoint rather than the session endpoint.

Answer

A lock key can be held simultaneously by multiple sessions as long as each session renews within its TTL.

Answer

Releasing a lock requires calling a dedicated `consul kv unlock` subcommand that is separate from the put operation.

Question 4

A security engineer is configuring intentions for a service mesh. They want to allow traffic from 'frontend' to 'backend' only when the connection is encrypted with mTLS and originates from a specific namespace in Consul Enterprise. Which intention attribute should they use to enforce the namespace constraint?

Accepted Answer

SourceNamespace. In Consul Enterprise, intentions support namespace and partition attributes to provide fine-grained authorization. To allow traffic only from a specific namespace, the SourceNamespace attribute must be set. This ensures that only service instances registered in that namespace can establish connections. Other attributes like SourceName or SourcePartition do not fulfill the namespace-specific requirement.

Answer

SourcePartition

Answer

SourceType

Answer

SourceName

Question 5

An operations team runs a legacy application that cannot expose an HTTP endpoint but does listen on TCP port 5432. They define a TCP health check in the service registration. During an incident, the port remains open but the application process is hung and no longer accepts new connections. What will Consul report for this check?

Accepted Answer

passing, because the TCP port is open. A TCP health check validates only that a connection to the specified host and port can be established. It does not perform any application-level handshake or data exchange. Because the port remains open in this scenario, the check stays passing even though the application is unresponsive. This is a common limitation when using TCP checks for services that can hang while keeping their socket open.

Answer

warning, because the TCP handshake is slow

Answer

critical, because the application is hung

Answer

maintenance, because the process is not accepting connections

Question 6

Which TWO of the following are true regarding the Consul Service Catalog?

Accepted Answer

It provides a unified view of all services in the cluster.. The catalog is replicated via Raft and can be queried via API or DNS.

Answer

It is strictly read-only.

Answer

It is only accessible via the CLI.

Answer

It is stored in the local disk of every agent.

Question 7

Which THREE of the following are valid ways to register a service in Consul?

Accepted Answer

Kubernetes Custom Resource Definitions.. Option A is correct because Consul supports Kubernetes Custom Resource Definitions (CRDs) such as ServiceRegistration (and previously ServiceDefaults/ServiceResolver via CRDs) as a declarative way to register services when running Consul on Kubernetes with the official Helm chart and CRDs enabled. Option B is correct because services can be defined in agent configuration files (HCL or JSON) placed in the agent's config directory, using a service block or services array, and Consul loads them at agent startup or reload. Option C is correct because the Consul HTTP API exposes the endpoint PUT /v1/agent/service/register, which accepts a JSON service definition and registers the service with the local agent. Option D is not valid because Consul stores state in a Raft-replicated log and snapshot files, not in a directly editable database file; modifying internals would corrupt state and is unsupported. Option E is not valid because the Raft log is an internal replicated log managed by the Raft consensus protocol, and manually editing it would break consistency and is not a supported registration method.

Answer

Directly modifying the Consul database file.

Answer

Manual editing of the Raft log.

Question 8

Which THREE of the following fields are returned in a typical Consul KV API GET response?

Accepted Answer

ModifyIndex. A Consul KV API GET response (e.g., GET /v1/kv/<key>) returns a JSON array of entries containing the fields Key, Value, Flags, CreateIndex, ModifyIndex, LockIndex, and Session. Option A (ModifyIndex) is correct because it is the index at which the key was last modified and is included in every KV read response. Option B (Key) is correct because the full key path is returned so the client knows which key the entry corresponds to. Option C (Value) is correct because the base64-encoded value stored at the key is returned (null if the key has no value). Option D (SessionTTL) is not part of the KV response; TTL is a property of sessions (returned by the session API, e.g., /v1/session/info), not of KV entries. Option E (CreateTime) is not a Consul KV field; Consul uses CreateIndex (a Raft index) rather than a timestamp to record when the key was created.

Answer

SessionTTL

Answer

CreateTime

Question 9

When a service check transitions to 'critical', what does Consul do with the service's DNS entry?

Accepted Answer

It removes the instance from the DNS response.. When a service check transitions to 'critical', Consul's DNS interface automatically removes that service instance from DNS query results. This is because Consul's DNS server only returns instances that are considered healthy (passing checks). The DNS entry for the service as a whole may still exist if other instances are healthy, but the critical instance is excluded. This behavior ensures that clients using DNS for service discovery do not route traffic to unhealthy instances.

Answer

It marks the record as 'stale'.

Answer

It returns the IP but with a low TTL.

Answer

It returns a 503 status code.

Question 10

You are designing a configuration system where multiple instances of a service must coordinate to elect a single leader using Consul KV. Which two statements accurately describe how to implement leader election with sessions? (Choose two.)

Accepted Answer

Each instance should create a session with a unique name and then attempt to acquire the same KV key using PUT /v1/kv/service/leader?acquire=<session_id>.. Leader election with Consul KV relies on sessions and the acquire operation. Each candidate creates a unique session and attempts to acquire a shared key. The holder must renew its session to keep the lock; if renewal fails, the session expires and the lock is released. Deleting the key or sharing sessions does not provide correct coordination, and KV entries do not support TTLs.

Answer

To release leadership, the leader can simply delete the KV key, which automatically invalidates its session and allows another instance to acquire the lock.

Answer

All instances should use the same session ID to ensure they can all attempt to acquire the lock simultaneously, and the first one to call acquire becomes the leader.

Answer

The KV key used for leader election must have a TTL set via the ?ttl= query parameter, so that it expires automatically if the leader fails.