An operator observes that a service is failing its HTTP health check because the application takes 15 seconds to start up, exceeding the default timeout. Which parameter should be adjusted in the service definition to prevent premature failure?
You have configured a Script health check that executes a shell command. For security reasons, you want to restrict which scripts the Consul agent can run. What configuration setting must be set to 'false' in the agent configuration to disable script checks entirely?
You are using Consul Template to observe health status. What happens to a service's health check status if the network segment between the agent and the server is partitioned and the server cannot contact the agent?
An operations engineer registers an HTTP health check against `https://payments.internal:8443/health` on a Consul client agent. The endpoint uses a certificate signed by an internal CA that is not in the system trust store, and requests must carry an `Authorization: Bearer` token. The check currently reports critical. Which two configuration additions are required to make this check pass? (Choose two.)
A cloud engineer is configuring a Consul 1.15 health check for a service that runs on a host with multiple network interfaces. The service listens only on 10.0.1.5:8080, but the Consul agent's default check address resolves to a different interface. The engineer wants the TCP check to connect specifically to 10.0.1.5:8080. Which configuration field should be used within the check definition to achieve this?
A Consul cluster runs a service that uses a script health check. The operations team wants to ensure that the check is correctly configured to detect failures and avoid false positives. Which two fields are required in the script health check definition? (Choose two.)
A platform engineer is registering a web API on a Consul 1.15 agent. The API exposes a readiness endpoint at https://10.0.4.21:8443/ready that requires the header X-Health-Token: s3cr3t, and the check must accept the cluster's internal CA certificate. Which check definition accomplishes this?
A Consul agent is configured with a service that has a health check defined in a separate JSON file. The check is a TCP check against port 5432 on localhost. The agent starts, but the check immediately reports critical even though the database is listening on port 5432. Which configuration error is most likely responsible?
A site reliability engineer is troubleshooting why a service registered in Consul 1.15 is being marked as critical by its HTTP health check. The check is configured with http = "https://internal.service/health", interval = "10s", and timeout = "2s". The service's logs show that requests from Consul are reaching the application and returning HTTP 200, but Consul still reports critical. Which two configuration issues could cause this behavior? (Choose two.)
A platform team runs a legacy batch worker that has no HTTP listener but exposes a lightweight TCP socket on port 9100 for liveness only. They register it in Consul with a service definition that includes a check named "worker-liveness". The worker process occasionally blocks for up to 40 seconds during a nightly compaction routine, but the team still wants Consul to mark it unhealthy only if the socket is genuinely unreachable. Which check configuration best satisfies this requirement?
A service owner needs a health check that runs a local diagnostic binary every 30 seconds, tolerates a single transient failure, and marks the service critical only after three consecutive failures. The binary exits 0 on success, 1 on warning, and any other code on failure. Which check definition satisfies these requirements?
A team is onboarding a legacy Java application to Consul 1.15. The application already writes a JSON file to /var/run/app/health.json containing a boolean and a message, and the team does not want to add an HTTP endpoint or a new script. They want Consul to reflect that file's contents as the service health status. What is the most appropriate approach?
A developer registers a web service with a script check that runs every 15 seconds. After deploying an update, the script begins exiting with status code 1 because a required log directory is missing. What status will Consul report for this check, and what is the immediate consequence for service discovery consumers?
A Consul 1.15 operator maintains a service definition in JSON that includes an http check with method POST, a header block, and a body. After a config reload, the check reports critical and the agent log shows a malformed check definition error. Which two configuration mistakes would produce that outcome? (Choose two.)
A service is registered on a Consul 1.15 node that has been drained for maintenance using consul services register with a maintenance override. The node's services appear with a maintenance status in the UI. Which statement correctly describes how Consul handles health checks for services on a node in maintenance mode?
A team is standardizing service health checks across a Consul 1.15 cluster. They need to know which built-in check types can be defined directly in a service registration and evaluated by the local agent without writing custom external programs. Which two check types meet this requirement? (Choose two.)
A Consul 1.15 cluster runs across two datacenters with network latency between them. An operator configures a script health check on a service in the primary datacenter and notices that during a transient WAN disruption the service flips to critical in the catalog, even though the local agent keeps reporting passing. The disruption is brief and the agent never restarts. Which behavior best explains the catalog status change?
An engineer defines an HTTP check for a payments API with interval = "10s", timeout = "3s", and failures_before_critical = 3. During a brief network hiccup the API's health endpoint takes 4 seconds to respond for two consecutive probes, then returns to normal. What state does Consul record, and why?
You are monitoring service health using Consul and want to ensure that a service is automatically removed from the catalog if it remains in a 'critical' state for more than 24 hours. Which configuration key supports this?
A service has a TTL check configured with a 30-second TTL. If the application crashes and stops sending heartbeats, when will the service status change to 'critical'?
You are deploying a legacy application that does not support HTTP or TCP health checks. Which Consul health check type should you configure to allow the application to signal its own health via a heartbeat API call?
You are troubleshooting a health check that seems to be hanging. Which flag, if available, would provide more information about the check's execution within the agent logs?
A Consul cluster has a service registered with an HTTP health check pointing to https://10.0.0.5:8443/health. The check is failing with a TLS certificate verification error even though the service is healthy. The operator wants Consul to skip certificate verification for this specific check without disabling TLS globally. Which check configuration field should be set?
A platform team runs Consul agents in server mode on three dedicated hosts and client agents on each application node. They need a check that verifies the Consul servers themselves are reachable on the Serf LAN gossip port from the perspective of every client agent, so that a partitioned server is flagged even if it still answers HTTP requests on port 8500. Which check definition should they register on each client agent?
A Consul service is registered with a TTL health check. The application owner wants the service to be marked unhealthy automatically if the application stops sending heartbeats, without requiring a separate check script or endpoint. The application can send heartbeats every 10 seconds. Which TTL check configuration should be used to mark the service unhealthy after no heartbeat is received for 30 seconds?
A platform team runs a Consul 1.15 cluster where a critical payment service is registered with a TTL health check. The service owner wants Consul to mark the check as critical if the application fails to renew the TTL for more than one minute. Which configuration field should be set in the service definition to enforce this behavior?
An operator registers a web service with a TTL health check and forgets to send periodic updates. After the TTL expires, the service appears as critical in the Consul UI. Which behavior explains why the check transitioned to critical automatically?
A DevOps engineer runs a Consul 1.15 agent on a VM and registers a web service with a script health check that executes a local shell script. The script returns exit code 0 when the service is healthy and exit code 1 when unhealthy. After the script runs, Consul reports the check status as passing. Which statement best describes how Consul interprets the script's exit code for this check?
An operator registers a web service with an HTTP health check. The check is configured with http = "http://localhost:8080/health" and method = "GET". The service's health endpoint returns HTTP 500 when the application is running but has a database connection problem. What status will Consul report for this check?
A platform team runs a service on a VM and wants Consul to automatically remove the service instance from the catalog if its health check remains critical for more than 10 minutes. The service is registered via the agent's configuration directory. Which check definition field accomplishes this?
A Consul operator defines a service check with the following HCL block: check { id = "web-api" name = "Web API HTTP" http = "http://localhost:8080/health" interval = "10s" timeout = "1s" }. The endpoint consistently responds in 1.4 seconds but returns HTTP 200. What status will Consul report for this check?
A Consul operator is defining an HTTP health check for a service and wants to ensure the check request includes custom headers and that the check tolerates a slow endpoint. Which two check definition fields should be used to accomplish these goals? (Choose two.)
A Consul operator registers a web service on a node with a service-level health check that uses the HTTP type and points to http://127.0.0.1:8080/health. The check has been passing for weeks, but the team now wants to stop advertising the service in DNS and the service catalog when the /health endpoint returns HTTP 500. Which Consul check status will the service health be reported as when the endpoint returns 500?
An engineer needs a service check that simply confirms a TCP port on the same host is accepting connections, without sending any application payload. Which Consul check configuration accomplishes this?
A team configures a script health check on a client agent with `interval` set to 30s and `timeout` set to 5s. The script normally finishes in under a second, but during a nightly batch job it occasionally blocks on a lock for over a minute. The team wants Consul to mark the service unhealthy when the script exceeds the timeout instead of waiting indefinitely. What does Consul do when the script has not exited by the timeout value?
You are deploying a legacy Java application that cannot expose an HTTP endpoint, but it does listen on TCP port 8443. You need Consul to verify the port is accepting connections and mark the service unhealthy if it is not. Which health check definition should you use?
An operations team runs a legacy application that cannot expose an HTTP endpoint but does listen on TCP port 5432. They define a TCP health check in the service registration. During an incident, the port remains open but the application process is hung and no longer accepts new connections. What will Consul report for this check?
A platform team runs a gRPC service and wants Consul to use the standard gRPC health checking protocol rather than a custom script. The service listens on port 50051 and exposes the standard health service. Which check definition should they use?
A platform team runs a fleet of Consul 1.15 server agents behind a strict network policy that blocks all outbound DNS traffic from the server hosts. The team wants the servers to periodically verify that each registered catalog node's DNS name resolves, without installing any extra binaries. Which check definition should they use, and what must they configure so the check can run?
You are configuring a health check that should be considered passing as long as the HTTP response code is in the 2xx range. Which HTTP check configuration achieves this?
A platform engineer is defining a TTL health check for a batch worker that cannot be polled by the Consul agent. The check must be considered healthy only when the worker actively reports in, and must become unhealthy if the worker stops reporting. Which two configuration elements are required to make this TTL check functional? (Choose two.)
A Consul administrator is reviewing how check results propagate and wants to understand which factors determine whether a service instance is considered healthy in the catalog. Which two factors directly determine a service's aggregate health status in Consul? (Choose two.)
An operations engineer registers an external PostgreSQL service on a Consul 1.15 client agent. The database listens on 10.20.30.40:5432 and is not managed by Consul, but a co-located exporter on the same VM exposes readiness at http://127.0.0.1:9187/ready. The engineer wants Consul to gate the service on the exporter's readiness signal while still advertising the database's real address and port to consumers. Which registration best achieves this?
A service is registered with a check that has deregister_critical_service_after set to 30m. The service's check enters the critical state due to a transient network partition. The partition is resolved after 20 minutes, and the check returns to passing. What is the effect on the service registration?
A service team wants its check to be automatically deregistered along with the service when the service is deregistered, but they also want the check to survive a Consul agent restart without being manually recreated. Which configuration achieves both goals?
A service is registered with a health check that has the field deregister_critical_service_after set to "10m". The service's check has been in the critical state for 15 minutes. What will Consul do?
A Consul operator needs to register a health check that runs a custom binary located at /opt/checks/validate.sh every 15 seconds. The check should be considered passing only when the script exits with code 0. Which check definition correctly implements this?
A platform team runs a Consul 1.15 cluster where a legacy VM service registers its health check through the /v1/agent/check/register HTTP API rather than a service definition file. The check is a script check that takes about 40 seconds to finish on a busy host. Operators notice the check flaps to critical roughly every minute even though the script always exits 0 when run manually. The agent's check_update_interval is left at the default. Which change most directly resolves the flapping without altering the script itself?
A Consul service check is configured with `deregister_critical_service_after: "10m"`. The service enters a critical state due to a failed check. What happens after 10 minutes if the check remains critical?
An operator registers a service with a TTL check and forgets to send periodic updates. After the TTL expires, what status does Consul report for that check, and what is the immediate effect on service discovery?
An operations engineer wants a service registered in Consul to be deregistered automatically from the catalog when its health check has been critical for an extended period, without any external tooling. The service definition is written in HCL and loaded via the agent's config directory. Which combination of settings accomplishes this?
An engineer registers an external service for a third-party payment gateway that cannot run a Consul agent. The registration uses an alias health check that points at a Consul node named 'edge-proxy-01' and a service named 'payment-gateway'. The external service stays healthy in the catalog as long as the proxy node and service are passing. A second engineer later adds a separate script check directly to the same external service definition. After a deployment, the payment gateway disappears from DNS even though the edge proxy node and its payment-gateway service both report passing. What is the most likely cause?
A team is standardizing health check definitions across a fleet of Consul 1.15 agents. They want checks that can be expressed entirely in HCL and do not require an external script interpreter on the node. Which two check types meet these criteria? (Choose two.)
A Consul 1.15 operator is defining a TTL-based health check for a batch job that only reports in when it completes a run. The job must be marked critical if it has not checked in within 30 minutes. The operator wants the check to start in the passing state so a freshly registered job is not immediately flagged. Which configuration block accomplishes this?
A team is writing Consul 1.15 service definitions for a set of gRPC services that expose the standard gRPC health checking protocol on a dedicated port, and they want Consul to actively probe that protocol rather than a plain TCP connect. Which two settings must be present in each check block to make Consul perform a gRPC health check against the service? (Choose two.)
An operator configures a TCP health check for a database service on port 5432, specifying tcp = "localhost:5432" and interval = "10s". The database process is running and accepting connections, but the check is reported as critical. What is the most likely explanation?
A Consul 1.15 operator needs to register a service with a health check that verifies the service is accepting TCP connections on port 9200. The check must run every 10 seconds. Which check configuration should be used?
An operator registers a service with a script health check that runs a custom binary. The binary exits with status code 1. What status will Consul assign to the service's health check?
A Consul 1.15 operator configures an HTTP health check for a service with the following settings: http = "https://api.example.com/health", tls_skip_verify = false, and method = "GET". The check is failing with a certificate error. Which configuration change should the operator make to allow the check to succeed while maintaining security?
A Consul 1.15 operator registers a service with an alias health check that points to another service's check. The aliased check is currently in a warning state. What status will the alias check report?