Consul 1.15 Health Checking Practice Test 2 — 15 Questions

Question 1

A Consul cluster runs a service that uses a script health check. The operations team wants to ensure that the check is correctly configured to detect failures and avoid false positives. Which two fields are required in the script health check definition? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

interval. A script health check requires the args field to define the command and the interval field to schedule execution. Without args, Consul has nothing to run; without interval, the check never executes. Timeout, status, and notes are optional and do not affect whether the check can function.

Answer

status

Answer

notes

Answer

timeout

Question 2

A platform engineer is registering a web API on a Consul 1.15 agent. The API exposes a readiness endpoint at https://10.0.4.21:8443/ready that requires the header X-Health-Token: s3cr3t, and the check must accept the cluster's internal CA certificate. Which check definition accomplishes this?

Accepted Answer

An http check with http: "https://10.0.4.21:8443/ready", header: { X-Health-Token: ["s3cr3t"] }, and tls_skip_verify: false.. Consul's built-in HTTP check is the right tool because it natively supports custom request headers through the header map and controls certificate validation with tls_skip_verify. Leaving tls_skip_verify at false makes the agent validate the server against its CA bundle, which is exactly what the internal-CA scenario demands. Script-based or TCP alternatives either lose status fidelity or require extra dependencies.

Answer

A tcp check with tcp: "10.0.4.21:8443" and a header stanza specifying X-Health-Token.

Answer

A script check that runs curl -k -H "X-Health-Token: s3cr3t" https://10.0.4.21:8443/ready and interprets a zero exit code as passing.

Answer

An http check with http: "https://10.0.4.21:8443/ready" and method: "HEAD", relying on the agent's default header injection.

Question 3

A Consul agent is configured with a service that has a health check defined in a separate JSON file. The check is a TCP check against port 5432 on localhost. The agent starts, but the check immediately reports critical even though the database is listening on port 5432. Which configuration error is most likely responsible?

Accepted Answer

The check definition uses tcp = "localhost:5432" but the agent is running in a network namespace where localhost does not resolve to the host's loopback interface.. TCP checks connect to the specified address and port. If the agent runs in a container or namespace where localhost does not map to the host's loopback, the connection fails even if the database is listening on the host. Timeout, service port mismatch, and script check settings do not explain an immediate critical state for a TCP check.

Answer

The check definition uses tcp = "localhost:5432" but the interval is set to "10s" and the timeout is set to "1s".

Answer

The check definition uses tcp = "localhost:5432" but the service is registered with a different port in its service definition.

Answer

The check definition uses tcp = "localhost:5432" but the agent is configured with enable_script_checks = false.

Question 4

A site reliability engineer is troubleshooting why a service registered in Consul 1.15 is being marked as critical by its HTTP health check. The check is configured with http = "https://internal.service/health", interval = "10s", and timeout = "2s". The service's logs show that requests from Consul are reaching the application and returning HTTP 200, but Consul still reports critical. Which two configuration issues could cause this behavior? (Choose two.)

Accepted Answer

The HTTP check is configured with tls_skip_verify = false, and the service uses a self-signed certificate.. Two plausible causes for a critical HTTP check despite 200 responses are TLS certificate validation failure and response time exceeding the timeout. Both are common in internal services using self-signed certificates or having slow health endpoints. The other options either contradict the scenario or misunderstand Consul's check evaluation logic.

Answer

The check's interval is set to 10s, but the Consul agent's clock is skewed by 15 seconds relative to the service.

Answer

The check is defined with method = "POST" instead of GET, but the service only accepts GET.

Answer

The service's health endpoint returns a 200 status code but includes a response body that Consul cannot parse.

Question 5

A platform team runs a legacy batch worker that has no HTTP listener but exposes a lightweight TCP socket on port 9100 for liveness only. They register it in Consul with a service definition that includes a check named "worker-liveness". The worker process occasionally blocks for up to 40 seconds during a nightly compaction routine, but the team still wants Consul to mark it unhealthy only if the socket is genuinely unreachable. Which check configuration best satisfies this requirement?

Accepted Answer

A tcp check with interval = "30s", timeout = "45s", and a generous success_before_passing. The service only speaks raw TCP, so a tcp check is the only type that can probe it directly. The worker can stall for up to 40 seconds, meaning the probe timeout must exceed that window to avoid marking a reachable-but-busy process as critical. A 30-second interval keeps probes from overlapping, and success_before_passing absorbs a single transient failure so the check does not flap during the nightly compaction routine.

Answer

A tcp check with interval = "10s" and timeout = "45s"

Answer

An http check with method = "GET" and timeout = "5s"

Answer

An alias check that aliases the node-level Serf health check

Question 6

A service owner needs a health check that runs a local diagnostic binary every 30 seconds, tolerates a single transient failure, and marks the service critical only after three consecutive failures. The binary exits 0 on success, 1 on warning, and any other code on failure. Which check definition satisfies these requirements?

Accepted Answer

args: ["/usr/local/bin/diag", "--mode=quick"], interval: "30s", timeout: "15s", success_before_passing: 1, failures_before_critical: 3.. Consul 1.15 provides failures_before_critical and success_before_passing to reduce flapping. Configuring failures_before_critical to 3 directly implements the requirement that the service becomes critical only after three consecutive failures. The args form executes the binary without a shell, and the interval and timeout align with the 30-second diagnostic cadence requested by the service owner.

Answer

args: ["/usr/local/bin/diag", "--mode=quick"], interval: "30s", timeout: "15s", status: "passing", success_before_passing: 3, failures_before_warning: 1.

Answer

args: ["/usr/local/bin/diag", "--mode=quick"], interval: "30s", timeout: "15s", status: "warning".

Answer

args: ["/usr/local/bin/diag", "--mode=quick"], interval: "30s", timeout: "15s", deregister_critical_service_after: "90s".

Question 7

You are defining a TCP health check for a service that listens on port 6379. Which two fields are required in the check definition? (Choose two.)

Accepted Answer

`interval`. A TCP health check requires the `tcp` field to specify the target address and port, and the `interval` field to define how often the check runs. Other fields like `name`, `timeout`, and `status` are optional and have defaults or are used for identification and initial state. Without `tcp` and `interval`, the check cannot be properly defined or scheduled.

Answer

`name`

Answer

`status`

Answer

`timeout`

Question 8

A team is onboarding a legacy Java application to Consul 1.15. The application already writes a JSON file to /var/run/app/health.json containing a boolean and a message, and the team does not want to add an HTTP endpoint or a new script. They want Consul to reflect that file's contents as the service health status. What is the most appropriate approach?

Accepted Answer

Define a script check that reads the JSON file and exits 0 or 2 based on the boolean.. Script checks are the general-purpose bridge between Consul and any local signal, because the agent executes a command and derives status from its exit code. A thin parser that converts the JSON boolean into exit 0 or a non-zero value lets the legacy application participate in health checking without modification. The other check types either cannot access local files or require infrastructure the application does not have.

Answer

Define an http check pointed at a local file URL such as file:///var/run/app/health.json.

Answer

Define a tcp check against the port the application writes the file on.

Answer

Define an alias check that aliases the application process name.

Question 9

A developer registers a web service with a script check that runs every 15 seconds. After deploying an update, the script begins exiting with status code 1 because a required log directory is missing. What status will Consul report for this check, and what is the immediate consequence for service discovery consumers?

Accepted Answer

critical, and the service is excluded from healthy-only queries. Script checks are evaluated by exit code: zero means passing, 1 means warning, and any other non-zero value means critical. A script that exits 1 because a directory is missing therefore reports critical, not warning. Consul's DNS and health APIs exclude critical instances from healthy-only results, so consumers stop receiving this endpoint until the underlying problem is fixed.

Answer

warning, and the service remains fully healthy in DNS results

Answer

maintenance, and all traffic continues until an operator clears it

Answer

passing, because the script produced output before exiting

Question 10

A Consul 1.15 operator maintains a service definition in JSON that includes an http check with method POST, a header block, and a body. After a config reload, the check reports critical and the agent log shows a malformed check definition error. Which two configuration mistakes would produce that outcome? (Choose two.)

Accepted Answer

The header block uses an array of strings instead of a map of header names to arrays of values.. The agent validates a check definition before registering it, so structural mismatches fail fast. A header value shaped as a flat array instead of a map of names to value lists violates the schema, and a target URL using a scheme the http check does not implement, such as ftp, is rejected outright. Both mistakes surface as a malformed check definition rather than as a runtime check failure.

Answer

The interval is expressed as the string "10s" rather than as a duration value the parser accepts.

Answer

The body field is provided as a string while method is set to POST.

Answer

The check omits the timeout field, so the agent cannot determine when to abort the request.

Question 11

A service is registered on a Consul 1.15 node that has been drained for maintenance using consul services register with a maintenance override. The node's services appear with a maintenance status in the UI. Which statement correctly describes how Consul handles health checks for services on a node in maintenance mode?

Accepted Answer

Checks continue to run, but Consul forces their status to critical for the duration of maintenance mode.. Maintenance mode in Consul does not stop check execution or remove definitions. Instead, the agent overrides the reported status of all checks on the affected node or service to critical, which causes DNS and health API queries to exclude the instance. This provides a clean drain mechanism that is fully reversible when maintenance ends.

Answer

Checks are skipped entirely and the service is reported as passing but with a maintenance annotation in the catalog.

Answer

Checks are deleted from the agent and recreated when maintenance mode ends, causing a brief window with no checks.

Answer

All checks on the node are paused, and their last known status is preserved until maintenance mode ends.

Question 12

A team is standardizing service health checks across a Consul 1.15 cluster. They need to know which built-in check types can be defined directly in a service registration and evaluated by the local agent without writing custom external programs. Which two check types meet this requirement? (Choose two.)

Accepted Answer

http. The http and tcp check types are built into the Consul agent and evaluated natively from the node running the agent, with no external program required. http probes a URL and interprets status codes, while tcp confirms a socket handshake. snmp, grpc, and udp are not native registration check types the agent evaluates directly, so they would force a script-based workaround.

Answer

snmp

Answer

udp

Answer

grpc

Question 13

A Consul 1.15 cluster runs across two datacenters with network latency between them. An operator configures a script health check on a service in the primary datacenter and notices that during a transient WAN disruption the service flips to critical in the catalog, even though the local agent keeps reporting passing. The disruption is brief and the agent never restarts. Which behavior best explains the catalog status change?

Accepted Answer

Consul servers mark a node's checks critical when the node's anti-entropy sync with the servers lapses beyond the configured interval.. Servers decide node liveness using the node's periodic anti-entropy sync plus Serf heartbeats. When a WAN disruption prevents that communication from arriving within the allowed window, the servers treat the node as failed and mark its checks critical in the catalog, even though the agent on the node continues to evaluate and report passing locally. Once connectivity returns and the sync resumes, the catalog reflects the agent's real results again.

Answer

The agent's local check results are authoritative, so the servers must have received a critical update from the agent before the disruption began.

Answer

The check's success_before_passing threshold was reset by the disruption, forcing an immediate critical result until the script passes again.

Answer

The script check exceeded its timeout on the servers, which execute script checks centrally for all datacenters.

Question 14

An engineer defines an HTTP check for a payments API with interval = "10s", timeout = "3s", and failures_before_critical = 3. During a brief network hiccup the API's health endpoint takes 4 seconds to respond for two consecutive probes, then returns to normal. What state does Consul record, and why?

Accepted Answer

passing, because the failures did not reach the failures_before_critical threshold. failures_before_critical sets how many consecutive failed probes must occur before the check transitions to critical. Two timeouts fall short of the threshold of three, so the check does not change state and remains passing. Once the endpoint responds normally again, the consecutive failure counter resets, and no critical status is ever recorded.

Answer

critical, because two probes exceeded the timeout and the threshold counts every failure

Answer

maintenance, because repeated timeouts trigger automatic maintenance mode

Answer

warning, because timeouts are always downgraded from critical to warning

Question 15

You are monitoring service health using Consul and want to ensure that a service is automatically removed from the catalog if it remains in a 'critical' state for more than 24 hours. Which configuration key supports this?

Accepted Answer

deregister_critical_service_after. The deregister_critical_service_after setting in a Consul service definition tells Consul to automatically deregister a service instance if its health check remains in the critical state for longer than the specified duration (e.g., '24h'). This is exactly the built-in mechanism for automatic removal of persistently unhealthy services.

Answer

cleanup_interval

Answer

critical_timeout

Answer

remove_service_after