Consul 1.15 Health Checking — 15 Questions

Question 1

An operator observes that a service is failing its HTTP health check because the application takes 15 seconds to start up, exceeding the default timeout. Which parameter should be adjusted in the service definition to prevent premature failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Timeout. The HTTP health check Timeout parameter defines how long Consul waits for a response before marking the check as failed. If the application takes 15 seconds to start, the default timeout (often 10 seconds) is exceeded, causing premature failure. Increasing the Timeout value allows the check to wait longer for the application to respond.

Answer

InitialStatus

Answer

Interval

Answer

DeregisterCriticalServiceAfter

Question 2

Which agent configuration allows you to specify the local address that the Consul agent binds to for performing health checks?

Accepted Answer

bind_addr. The `bind_addr` parameter in the Consul agent configuration specifies the local address that the agent binds to for both internal cluster communication and for performing health checks. When Consul runs a health check (e.g., a script or HTTP check), it originates from this address. This is distinct from `client_addr`, which controls the address the agent listens on for client interfaces (HTTP, DNS, etc.), and `advertise_addr`, which is the address advertised to other Consul nodes. Therefore, `bind_addr` is the correct setting for the source address of health checks.

Answer

advertise_addr

Answer

client_addr

Answer

check_addr

Question 3

You have configured a Script health check that executes a shell command. For security reasons, you want to restrict which scripts the Consul agent can run. What configuration setting must be set to 'false' in the agent configuration to disable script checks entirely?

Accepted Answer

enable_script_checks. In Consul agent configuration, the 'enable_script_checks' setting controls whether script health checks are allowed. Setting it to false disables all script checks on that agent, which is the documented way to restrict script execution for security. This is a global toggle for the agent, not per-check.

Answer

allow_unprivileged_scripts

Answer

disable_remote_exec

Answer

enable_local_script_execution

Question 4

Which configuration file format is preferred by Consul for defining service health checks?

Accepted Answer

JSON. Consul's preferred configuration file format for defining service health checks is JSON. While Consul also supports HCL for some configurations, JSON is the native and most widely used format for service definitions, including health checks. The JSON structure allows for clear, hierarchical specification of check properties such as interval, timeout, and HTTP endpoint. This is documented in Consul's official service definition documentation.

Answer

XML

Answer

INI

Answer

YAML

Question 5

You are using Consul Template to observe health status. What happens to a service's health check status if the network segment between the agent and the server is partitioned and the server cannot contact the agent?

Accepted Answer

It enters a critical state. If a server cannot reach the agent performing the check, the health status becomes unknown or unreachable, often reflected as a critical status for the service until connectivity is restored.

Answer

It is automatically removed from the catalog

Answer

It remains passing

Answer

It stays in the last known state

Question 6

You want to run a shell command as a health check. Which field in the service definition specifies the command to execute?

Accepted Answer

script. In a Consul service definition, the 'script' field within a check block specifies the shell command to execute for a script health check. For example, a check block with 'script': '/usr/bin/check.sh' will run that script. The 'command' field is not used for health checks; it is used in other contexts like Consul's exec command.

Answer

check_exec

Answer

command

Answer

action

Question 7

What happens if you do not specify an 'interval' for a health check in the configuration?

Accepted Answer

The configuration will fail to load. In Consul, the 'interval' field is a required parameter for any health check that uses a script, HTTP, TCP, or gRPC check. If you omit it, the agent will reject the service or check definition during configuration loading, causing the configuration to fail. This is enforced by Consul's validation logic, which ensures that checks have a defined frequency to avoid undefined behavior. Therefore, the configuration will not load, making option B correct.

Answer

It inherits the agent's check interval

Answer

It defaults to 10 seconds

Answer

It runs once and stops

Question 8

Which of the following are valid types of health checks in Consul? (Select TWO)

Accepted Answer

TCP. Option B (TCP) is correct because Consul supports a TCP check type that attempts a TCP connection to the specified host and port, marking the service healthy if the connection succeeds. Option E (HTTP) is correct because Consul supports an HTTP check type that performs an HTTP GET request against a specified URL and evaluates the response status code (by default, any 2xx response is healthy). Consul's documented check types include script, HTTP, TCP, TTL, Docker, gRPC, H2 ping, alias, and UDP, but ICMP (A) is not among them, so it is not a valid Consul health check type. UDP (C) is not a supported Consul check type either, and SNMP (D) is a network monitoring protocol that Consul does not implement as a native health check.

Answer

ICMP

Answer

UDP

Answer

SNMP

Question 9

If you need to perform an HTTP check over HTTPS, what configuration option is required to handle self-signed certificates?

Accepted Answer

tls_skip_verify. In Consul HTTP checks, the tls_skip_verify option is used to disable TLS certificate verification, which is required when the target endpoint presents a self-signed certificate. Without it, the check fails because the certificate chain cannot be validated against trusted CAs. This option is set within the check definition's tls_skip_verify field.

Answer

tls_insecure

Answer

disable_tls

Answer

ignore_cert

Question 10

Which of the following parameters are used in a service health check configuration? (Select THREE)

Accepted Answer

interval. Interval, timeout, and script/http are standard parameters in check definitions.

Answer

weight

Answer

service_id

Question 11

Which actions can you perform on a TTL check? (Select TWO)

Accepted Answer

pass. You can tell Consul that the check passed or is in a warning state.

Answer

restart

Answer

suspend

Answer

fail

Question 12

Which states can a health check report? (Select THREE)

Accepted Answer

passing. Health checks in systems like AWS Route 53, Elastic Load Balancing, and similar monitoring frameworks report one of three discrete states: passing, warning, and critical. Option A (passing) is correct because it indicates the resource is healthy and responding successfully to the health check probe. Option C (warning) is correct because it represents a degraded but not yet failing state, often used when a threshold is partially breached. Option D (critical) is correct because it signals the resource has failed the health check and should be taken out of service or trigger an alarm. Option B (terminated) is not a health check state; it describes an instance lifecycle status, not a probe result. Option E (pending) is also not a health check state; it is typically an initial resource or deployment status before monitoring begins.

Answer

terminated

Answer

pending

Question 13

Which of these are required fields for a TCP health check definition? (Select THREE)

Accepted Answer

name. In a TCP health check definition, the name field (C) is required because every health check must be uniquely identified within the load balancer configuration. The tcp field (D) is required because it specifies the protocol type and the port to connect to, which is the core of a TCP health check. The interval field (E) is required because it defines how frequently the health check probe runs, which is mandatory for scheduling checks. The timeout field (A) is not required because it has a default value if omitted. The http field (B) is not required because it applies to HTTP health checks, not TCP health checks.

Answer

timeout

Answer

http

Question 14

An operations engineer registers an HTTP health check against `https://payments.internal:8443/health` on a Consul client agent. The endpoint uses a certificate signed by an internal CA that is not in the system trust store, and requests must carry an `Authorization: Bearer` token. The check currently reports critical. Which two configuration additions are required to make this check pass? (Choose two.)

Accepted Answer

Set `ca_file` to the path of the internal CA certificate in the check definition.. Two independent problems keep this HTTP check critical: the agent does not trust the certificate chain, and the probe request lacks the required bearer token. Trust is restored by pointing `ca_file` at the internal CA bundle rather than disabling verification, and authentication is satisfied by adding the Authorization header through the `header` map. Both are supported fields on HTTP check definitions in Consul 1.15.

Answer

Set `tls_server_name` to `payments.internal` in the check definition.

Answer

Set `method` to POST so the agent sends credentials in the request body.

Answer

Set `tls_skip_verify` to true in the check definition.

Question 15

A cloud engineer is configuring a Consul 1.15 health check for a service that runs on a host with multiple network interfaces. The service listens only on 10.0.1.5:8080, but the Consul agent's default check address resolves to a different interface. The engineer wants the TCP check to connect specifically to 10.0.1.5:8080. Which configuration field should be used within the check definition to achieve this?

Accepted Answer

tcp. For TCP health checks, the tcp field defines the exact host and port to connect to. It allows overriding the default service address, which is essential when the service binds to a specific interface. Other fields like address or service_id do not serve this purpose for a TCP check.

Answer

address

Answer

http

Answer

service_id