Consul 1.15 Hard Questions — 25 Difficult Questions

Question 1

Where can you define health checks in Consul? (Select THREE)

Accepted Answer

Agent configuration files. Checks can be defined in configuration files, via the HTTP API, or within a service definition.

Answer

Consul UI

Answer

Consul KV store

Question 2

When using Consul KV for distributed locking, why is it recommended to use a session?

Accepted Answer

It allows for TTL-based automatic lock release.. Sessions provide a mechanism for TTL-based auto-release, which prevents deadlocks if an application crashes while holding a lock.

Answer

It encrypts the lock data.

Answer

It allows for multiple lock holders.

Answer

It speeds up read operations.

Question 3

When using the HTTP health check type, how can you verify that a specific header is included in the health check request?

Accepted Answer

By adding the 'header' object to the check definition. The 'header' field within the HTTP check configuration allows specifying custom HTTP headers for the check request.

Answer

By appending it to the URL string

Answer

It is not possible

Answer

By setting the environment variable

Question 4

Which of the following parameters are used in a service health check configuration? (Select THREE)

Accepted Answer

interval. Interval, timeout, and script/http are standard parameters in check definitions.

Answer

weight

Answer

service_id

Question 5

You need to ensure that a read operation from the KV store is strongly consistent. Which consistency mode should you specify?

Accepted Answer

consistent. The 'consistent' consistency mode forces the leader to verify its leadership with a quorum of peers, ensuring strong consistency.

Answer

default

Answer

quorum

Answer

stale

Question 6

When configuring a Service-specific health check, what is the impact of setting the 'expose' field to true?

Accepted Answer

The check status is exposed on the HTTP interface. Setting 'expose' to true allows the service to expose its health checks via the local agent's HTTP interface, enabling external access to the health check status.

Answer

The service is automatically registered with a Load Balancer

Answer

The check is bypassed

Answer

The agent automatically upgrades the check to HTTP

Question 7

Which THREE of the following represent potential bottlenecks for Consul KV performance?

Accepted Answer

Very large number of keys. High update frequency, massive key counts, and large value sizes all impact KV performance.

Answer

High read frequency

Answer

Using HTTP instead of RPC

Question 8

Which TWO of the following accurately describe Consul's WAN gossip protocol behavior?

Accepted Answer

It involves only the server nodes of each datacenter.. WAN gossip is designed for high latency links and involves only server nodes, not all cluster nodes.

Answer

It relies on a central hub-and-spoke architecture.

Answer

It includes all client nodes in the gossip pool.

Answer

It is mandatory for service discovery.

Question 9

What happens to a session if the associated node is marked as 'failed' by the Consul health check?

Accepted Answer

The session is invalidated when the TTL expires.. When a node fails, the sessions associated with that node are invalidated after the session TTL expires.

Answer

The session stays active.

Answer

The session is immediately deleted.

Answer

The session is transferred to another node.

Question 10

A service is intermittently failing to resolve via DNS because it has multiple health checks, some of which are 'warning'. How do you ensure it is only returned when all checks are 'passing'?

Accepted Answer

Use the 'passing' query parameter in the DNS request.. Consul DNS returns services if they are not in a 'critical' state by default; enforcing strict 'passing' requires query parameters.

Answer

Configure 'service_prefix' in DNS settings.

Answer

Use the 'stale' query parameter.

Answer

Set 'enable_tag_override' to true.

Question 11

Which THREE network considerations are vital for Consul WAN federation?

Accepted Answer

Sufficient bandwidth for gossip heartbeat messages.. WAN federation requires specific port accessibility, bandwidth for gossip, and routing between servers.

Answer

A shared NAT gateway for all datacenters.

Answer

Uniform MTU settings across all regions.

Question 12

Which of the following are true regarding TTL checks? (Select TWO)

Accepted Answer

They require the app to push updates. TTL checks do not have an interval and require manual updates.

Answer

They are automatically removed

Answer

They are faster than script checks

Answer

They are polled at a fixed interval

Question 13

When using 'prepared_queries' for cross-datacenter failover, what does the 'failover' block allow you to specify?

Accepted Answer

A list of datacenters to attempt for service resolution.. The 'failover' block in a prepared query allows you to define a list of datacenters to try if the local datacenter lookup returns no healthy instances.

Answer

The timeout for the WAN gossip.

Answer

The encryption algorithm for failover traffic.

Answer

The number of retries per node.

Question 14

You observe a 'warning' status for a service. What is the most common reason for this?

Accepted Answer

The service is operating but with performance issues. A 'warning' status typically occurs when the service is reachable but is reporting a non-critical issue, such as high latency or exceeding a custom defined threshold in a custom script.

Answer

The agent is restarting

Answer

The network is down

Answer

The service crashed

Question 15

If a KV operation returns a 403 Forbidden status, what is the most common cause?

Accepted Answer

The ACL token lacks sufficient permissions.. ACLs (Access Control Lists) are enabled, and the client token lacks the 'write' permission for that specific prefix.

Answer

The server is down.

Answer

The data is too large.

Answer

The key does not exist.

Question 16

You notice that the KV store is not consistent across datacenters. What is the cause?

Accepted Answer

KV store is datacenter-local by design.. Consul does not natively replicate the entire KV store across datacenters by default; it requires separate configuration or manual syncing for state consistency.

Answer

The Raft protocol is broken.

Answer

The ACL token lacks the 'write' permission.

Answer

The WAN gossip is disabled.

Question 17

If a Consul agent is configured with 'disable_remote_exec = true', how does this affect the KV store?

Accepted Answer

It has no effect on the KV store.. This setting does not impact the KV store; it only restricts the execution of remote commands via the Consul event system.

Answer

It forces all KV reads to be consistent.

Answer

It prevents all KV writes.

Answer

It disables KV watches.

Question 18

Which of these are required fields for a TCP health check definition? (Select THREE)

Accepted Answer

name. TCP checks require tcp, interval, and name fields.

Answer

timeout

Answer

http

Question 19

What is the function of the 'retry_join_wan' configuration?

Accepted Answer

To enable persistent WAN connections.. The 'retry_join_wan' configuration allows the agent to repeatedly attempt to join the WAN gossip pool at startup if the initial attempt fails, improving robustness.

Answer

To sync secondary data.

Answer

To force a specific leader.

Answer

To rotate the encryption key.

Question 20

Which TWO of the following are true regarding Consul KV watches?

Accepted Answer

Watches use blocking queries internally. Watches can be configured via agent configuration or the API, and they use blocking queries internally.

Answer

Watches can only monitor keys that exist

Answer

Watches automatically restart after a script failure

Answer

Watches are only available in the Enterprise edition