Consul 1.15 Practice Test 8 — 10 Questions

Question 1

You are designing a distributed leader election system using Consul. A service instance must hold a lock on the KV key 'service/leader' to become the leader. You need to ensure that if the instance crashes or loses network connectivity, the lock is automatically released so another instance can acquire it. Which Consul feature should you use to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Consul sessions with a TTL and the acquire parameter on a KV PUT request. Sessions are the correct mechanism for distributed locks in Consul. By creating a session with a TTL and using the acquire parameter when writing to a KV key, the key becomes locked to that session. If the session expires because the instance fails to renew it, Consul releases the lock, enabling another instance to acquire it. This pattern is fundamental for leader election.

Answer

Consul watches on the KV key with a script that releases the lock

Answer

Consul KV key with a long TTL and manual cleanup by an operator

Answer

Consul prepared queries with failover to another datacenter

Question 2

You are deploying a service that must store a critical configuration value in Consul KV. The value must only be visible to services with a token that has read access to that specific key. You also need to ensure that any write to the key can only be performed by a token with write access. Which Consul feature should you use?

Accepted Answer

Consul ACLs with a policy that restricts access to the KV path.. The requirement is to restrict read and write access to a specific KV key based on tokens. Consul ACLs with policies that define rules for the KV path are the correct mechanism. They allow you to specify exact permissions for tokens, ensuring that only authorized clients can read or write the key. Other options do not provide this level of access control.

Answer

Consul namespaces with a default policy that allows all operations.

Answer

Consul KV key-level encryption using the gossip encryption key.

Answer

Consul intentions that define which services can communicate with the KV store.

Question 3

When configuring ACL replication, where must the 'acl_replication_token' be defined?

Accepted Answer

In the secondary datacenter's server agents.. ACL replication flows from the primary datacenter to secondary datacenters, and the token that authorizes this replication must be configured on the server agents in the secondary datacenter. The secondary servers use this token to authenticate to the primary and pull ACL data. Client agents do not perform ACL replication, so the token is not needed there.

Answer

In the primary datacenter's client agents.

Answer

In the Consul Enterprise license file.

Answer

On all nodes in both datacenters.

Question 4

When using 'prepared_queries' for cross-datacenter failover, what does the 'failover' block allow you to specify?

Accepted Answer

A list of datacenters to attempt for service resolution.. The failover block in a prepared query specifies a list of datacenters to attempt for service resolution when the local datacenter has no healthy instances. This enables cross-datacenter failover by defining an ordered fallback list. It does not control timeouts, encryption, or retry counts.

Answer

The timeout for the WAN gossip.

Answer

The encryption algorithm for failover traffic.

Answer

The number of retries per node.

Question 5

What is the consequence of having a service with no health checks registered?

Accepted Answer

The service status is 'passing'. In Consul, a service registered without any health checks is treated as healthy by default, so its status is reported as 'passing'. Consul only marks a service as critical if an associated check fails; with no check defined, there is nothing to fail, so the service remains passing and is returned by DNS and service discovery queries.

Answer

The agent will error out

Answer

The service is ignored by DNS

Answer

The service is critical

Question 6

When using the Consul KV store, what is the maximum size allowed for a single value in a key?

Accepted Answer

512 KB. The Consul KV store enforces a maximum value size of 512 KB per key. This limit is a hard constraint imposed by the Raft consensus protocol, which replicates all writes across the cluster. Values larger than 512 KB are rejected by the server to prevent excessive memory usage and network overhead during replication. This is documented in the official Consul limits and is consistent across versions, including 1.15.

Answer

There is no limit.

Answer

128 KB

Answer

1 MB

Question 7

A team wants to store structured configuration for several microservices in Consul's KV store and retrieve an entire service's configuration with a single CLI call. They plan to keep all keys for `payments` under `services/payments/`. Which command retrieves every key under that prefix in one invocation?

Accepted Answer

consul kv get -recurse services/payments/. Listing all keys under a prefix requires the recursive read behavior. Passing `-recurse` to `consul kv get` returns every key beneath the specified path in a single call, which is precisely how a service loads its whole configuration subtree. A trailing slash alone does nothing, and the other commands either write data or produce a backup-oriented export format.

Answer

consul kv get services/payments/

Answer

consul kv put -recurse services/payments/

Answer

consul kv export services/payments/

Question 8

You are configuring Consul Connect for a service named 'payments'. You want to allow incoming connections only from services that present a valid client certificate from a specific CA and also enforce that the source service is 'checkout'. What combination of Consul features should you use?

Accepted Answer

Configure an intention with source 'checkout' and action 'allow', and enable mutual TLS in the mesh.. To restrict incoming connections to a specific source service, Consul intentions are the correct mechanism. They define which services are allowed to connect based on service identity. Enabling mTLS ensures that connections are authenticated with certificates issued by Consul's CA, providing encryption and identity verification. Together, they enforce that only 'checkout' can connect to 'payments' and that the connection is secure.

Answer

Enable ACLs with a token that has 'service:write' for 'payments' and distribute it only to 'checkout'.

Answer

Configure a service resolver with a subset that includes only 'checkout' and set the default subset to that.

Answer

Use a network segment to isolate 'payments' and a firewall rule to allow only 'checkout'.

Question 9

You are deploying a service that requires distributed locking with automatic release if the service instance fails. You have created a session named 'lock-session' and acquired a lock on the KV key 'locks/db'. After a few minutes, the lock is unexpectedly released even though the service instance is still running. Which action should you take to diagnose the most likely cause?

Accepted Answer

Verify that the service is sending session renewals within the TTL period.. Consul sessions have a TTL and must be periodically renewed by the client. If the service fails to renew within the TTL, the session is invalidated and any locks held by that session are released. In this scenario, the service is still running but likely not renewing the session, causing the lock to be released. Verifying renewal activity is the correct diagnostic step.

Answer

Inspect the KV key's metadata to see if it was modified externally.

Answer

Check the Consul server logs for errors related to the session.

Answer

Restart the Consul agent on the node where the service is running.

Question 10

You need to store a value in Consul KV that will be read by a service. The value should be retrievable by a simple HTTP GET request to the Consul API. Which HTTP endpoint should you use to read the value of a key named 'app/config/db_host'?

Accepted Answer

GET /v1/kv/app/config/db_host. The Consul KV API uses the /v1/kv/ prefix for all key operations. To read a key, you perform a GET request to /v1/kv/<key>. This returns a JSON response containing the value and metadata. Other paths like /v1/store or /v1/kv/read are not valid. The ?raw parameter is optional and returns the value directly, but the standard endpoint is without it.

Answer

GET /v1/kv/read/app/config/db_host

Answer

GET /v1/store/app/config/db_host

Answer

GET /v1/kv/app/config/db_host?raw