Consul 1.15 Practice Test 9 — 10 Questions

Question 1

You are using Consul KV to coordinate a distributed job scheduler. A worker acquires a lock on a key to ensure only one worker runs a job at a time. The lock is tied to a session. The worker crashes and the session expires after its TTL. What happens to the lock on the key?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The lock is automatically released and the key's LockIndex is incremented.. When a session expires, Consul automatically releases any locks held by that session. The lock release is indicated by clearing the Session field on the key and incrementing the LockIndex. The key and its value are not deleted. This allows other workers to acquire the lock and continue operation. Manual intervention is not required.

Answer

The key is deleted and the lock is released.

Answer

The lock is automatically released and the key's value is deleted.

Answer

The lock remains held until a Consul operator manually releases it.

Question 2

A platform team runs Consul 1.15 with Connect enabled in a single datacenter. They register a new service 'payments' with a sidecar proxy, but when the application team tries to reach 'payments' through its local proxy, the connection is refused. Running 'consul intention check web payments' returns 'Result: denied'. No intentions have been created yet. What should the team do to allow the traffic while following Consul's default security model?

Accepted Answer

Create an intention that allows 'web' to 'payments' and apply it to the datacenter with 'consul intention create web payments'.. Connect evaluates intentions for every proxied connection and, absent a match, defaults to deny. The 'consul intention check' output confirms denial. Creating an allow intention between the source service 'web' and destination 'payments' establishes the required authorization. Environment toggles, re-registration, and explicit deny intentions do not open the path under the default-deny posture.

Answer

Modify the 'payments' service definition to include 'connect: { sidecar_service: {} }' under the service stanza and reregister it.

Answer

Set the environment variable CONSUL_ALLOW_INSECURE_TRAFFIC=true on the 'payments' sidecar and restart it.

Answer

Run 'consul intention create -deny web payments' and then restart the 'web' sidecar proxy.

Question 3

A developer needs to remove an obsolete configuration key `app/legacy/timeout` from Consul's KV store so the application no longer reads it. Which command deletes this single key?

Accepted Answer

consul kv delete app/legacy/timeout. Removing a specific key is done with `consul kv delete` pointed at the exact path. That command eliminates the entry so the application stops seeing the obsolete timeout. Reading, overwriting with an empty value, or exporting the key all leave it in place, so none of them achieve the intended removal.

Answer

consul kv put app/legacy/timeout ""

Answer

consul kv get app/legacy/timeout

Answer

consul kv export app/legacy/timeout

Question 4

An operator runs `consul kv put config/app/timeout 30s` and then `consul kv get config/app/timeout`. The second command prints only `30s` with no metadata. The operator wants to see the key's `CreateIndex`, `ModifyIndex`, and `Flags` from the command line without writing code against the HTTP API. Which command should be used?

Accepted Answer

`consul kv get -detailed config/app/timeout`. The CLI exposes KV metadata through the `-detailed` flag on `consul kv get`, which prints `CreateIndex`, `ModifyIndex`, `LockIndex`, `Flags`, `Session`, and the value. Plain `get` and `-recurse` show only names and values, while `export` emits a JSON tree for backup. To see index and flag fields from the shell, `-detailed` is the correct choice.

Answer

`consul catalog nodes -service=config/app/timeout`

Answer

`consul kv export config/app/timeout`

Answer

`consul kv get -recurse config/app/timeout`

Question 5

How do you enable WAN federation between two Consul datacenters that do not share a network?

Accepted Answer

By deploying Mesh Gateways.. Mesh Gateways are the correct solution for enabling WAN federation between datacenters that do not share a network, such as when they are behind NAT or firewalls with no direct WAN gossip connectivity. Mesh gateways relay WAN gossip and service traffic over the LAN, allowing federation without direct server-to-server WAN links. This is the standard Consul pattern for isolated datacenters.

Answer

By disabling ACLs.

Answer

By increasing the gossip interval.

Answer

By using a load balancer in front of the servers.

Question 6

An operator is configuring a Connect sidecar proxy in a service definition so that outbound calls to a dependency are routed through the mesh. The dependency is registered as 'redis' in the same datacenter, listening on port 6379. The application expects to reach it at localhost:6379. Which upstream block in the sidecar_service definition achieves this?

Accepted Answer

upstreams = [{ destination_name = "redis", local_bind_port = 6379 }]. Upstreams in a sidecar_service definition require a destination_name and a local_bind_port. The local_bind_port is what the application dials on localhost, and the sidecar handles discovery, mTLS, and load balancing to the destination. Fields such as destination_port or service/port are not valid in this context, and a datacenter field is only needed for cross-datacenter upstreams.

Answer

upstreams = [{ destination_name = "redis", datacenter = "dc1", local_bind_port = 6379 }]

Answer

upstreams = [{ destination_name = "redis", destination_port = 6379 }]

Answer

upstreams = [{ service = "redis", port = 6379 }]

Question 7

A microservice uses a Consul session with a 30-second TTL and holds a lock on `locks/leader` via `acquire`. The service process is alive and healthy but its network link to the Consul servers is severed for several minutes. When connectivity is restored, the service finds it no longer owns the lock. Which behavior explains this outcome?

Accepted Answer

The session TTL expired because the service failed to renew it within the TTL window, so Consul invalidated the session and released its locks.. Session-based locks in Consul are leases: the client must renew the session before its TTL elapses, and failure to renew causes the session to expire, which deletes the session and releases all locks and keys it held. A network partition that blocks renewal therefore forfeits the lock, which is the intended safety behavior preventing a partitioned leader from retaining ownership indefinitely.

Answer

The lock was released because Consul applies a fixed maximum lock hold time of 15 seconds regardless of session TTL settings.

Answer

Consul invalidated the session because the node's health check for the service was marked critical during the outage.

Answer

The lock moved to another session immediately after the partition began because Consul rebalances locks among active sessions automatically.

Question 8

A platform team runs a Consul 1.15 datacenter with Connect enabled. They deploy a new service called 'payments' and register it with a sidecar proxy. Security policy requires that only the 'checkout' service may initiate connections to 'payments', and all other services must be denied, even if they present a valid service token. No intentions exist yet for this pair. Which action should the team take to enforce this requirement with the least operational overhead?

Accepted Answer

Create an allow intention from 'checkout' to 'payments' and rely on the default deny behavior for all other sources.. Intentions are the Connect authorization mechanism, and Consul denies any connection that does not match an allow intention. Creating a single allow intention from checkout to payments satisfies the requirement because all other sources are denied by default. Adding a wildcard deny is redundant and complicates the intention set, while ACLs and proxy upstream settings address different concerns.

Answer

Configure the 'payments' sidecar proxy with a restrictive upstream and set 'protocol' to 'tcp' in the service registration.

Answer

Create a deny intention from '*' to 'payments' and a separate allow intention from 'checkout' to 'payments'.

Answer

Enable ACLs in default-deny mode and grant the 'payments' service token only to 'checkout'.

Question 9

A service mesh operator is troubleshooting a connectivity issue between two services in a Consul 1.15 datacenter. The sidecar proxy for the 'frontend' service cannot reach the 'backend' upstream. The operator has confirmed that intentions allow the traffic. Which log should they inspect first to diagnose the issue on the sidecar proxy?

Accepted Answer

The Envoy proxy logs for the frontend sidecar.. The Envoy sidecar proxy logs are the most detailed source for diagnosing connectivity issues between services in a Connect mesh. They record upstream connection attempts, TLS errors, and response flags. While Consul agent and server logs can provide context, they lack the granularity needed to pinpoint why a specific proxy cannot reach its upstream. Checking the proxy logs first is the most efficient troubleshooting step.

Answer

The systemd journal for the 'backend' service.

Answer

The Consul agent logs on the node running the frontend service.

Answer

The Consul server logs on the leader.

Question 10

An operator manages a Consul 1.15 cluster where Connect is enabled and mTLS is active. They need to rotate the Connect CA root certificate for the datacenter. The new root must be distributed to all sidecar proxies without dropping existing connections, and the old root must remain trusted during the transition. Which sequence of actions accomplishes this?

Accepted Answer

Generate a new CA, cross-sign the new intermediate with the old root, update the CA configuration with the cross-signed bundle, then allow proxies to rotate leaf certificates via the existing CA provider.. The safe rotation path uses cross-signing: the new intermediate is signed by the old root so both roots are trusted during the transition. Updating the CA configuration with the cross-signed bundle lets Consul distribute the new root, and leaf certificates rotate automatically through the CA provider. This avoids downtime and preserves existing connections, unlike replacing the root outright or toggling mTLS.

Answer

Disable Connect, replace the CA, re-enable Connect, and re-register all services with new sidecar proxies.

Answer

Use 'consul connect ca set-config' to update the root certificate and private key, then restart all sidecar proxies to pick up the new root.

Answer

Set 'connect.enable_mtls' to false, update the CA, then set it back to true to force proxies to fetch new certificates.