Consul 1.15 Health Checking Practice Test 5 — 15 Questions

Question 1

An operator registers a web service with a TTL health check and forgets to send periodic updates. After the TTL expires, the service appears as critical in the Consul UI. Which behavior explains why the check transitioned to critical automatically?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

TTL checks automatically transition to critical when their TTL elapses without an update.. TTL checks are passive: the service or an external process must periodically report health. When the TTL elapses without a report, Consul automatically marks the check critical. This design detects services that have stopped reporting, which is exactly what happened when the operator forgot to send updates.

Answer

The service was deregistered because the TTL expired, and the missing service is shown as critical.

Answer

The Consul agent restarted and reset all check states to critical.

Answer

Consul requires TTL checks to be updated by an external monitoring system, and the absence of that system caused the critical state.

Question 2

A DevOps engineer runs a Consul 1.15 agent on a VM and registers a web service with a script health check that executes a local shell script. The script returns exit code 0 when the service is healthy and exit code 1 when unhealthy. After the script runs, Consul reports the check status as passing. Which statement best describes how Consul interprets the script's exit code for this check?

Accepted Answer

Exit code 0 indicates passing, and any non-zero exit code indicates critical.. Consul script checks map exit code 0 to passing and any non-zero exit code to critical. There is no intermediate warning state based on exit codes for script checks. The engineer's script returning 1 will correctly cause the check to be marked critical, which can then trigger alerts or service deregistration if configured.

Answer

Exit code 0 indicates passing, exit code 1 indicates critical, and exit code 2 indicates warning.

Answer

Exit code 0 indicates passing, and exit code 1 indicates maintenance mode.

Answer

Exit code 0 indicates passing, exit code 1 indicates warning, and any other code indicates critical.

Question 3

An operator registers a web service with a TTL health check and forgets to send periodic updates. After the TTL expires, the service appears as critical in the Consul UI. Which behavior explains why the check transitioned to critical automatically?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

critical. Consul's HTTP health check considers only HTTP 2xx responses as passing. Any other response code, including 500, results in a critical status. The endpoint is reachable, but the server error indicates an unhealthy application state. Warning and maintenance are not automatically applied based on HTTP status codes.

Answer

passing

Answer

warning

Answer

maintenance

Question 4

A platform team runs a service on a VM and wants Consul to automatically remove the service instance from the catalog if its health check remains critical for more than 10 minutes. The service is registered via the agent's configuration directory. Which check definition field accomplishes this?

Accepted Answer

deregister_critical_service_after. Consul provides deregister_critical_service_after specifically to remove a service from the catalog after it has been critical for a configured duration. This prevents stale service instances from remaining discoverable. The other options are either invalid field names or serve unrelated purposes such as TTL check timing.

Answer

ttl

Answer

critical_timeout

Answer

deregister_after

Question 5

A Consul operator defines a service check with the following HCL block: check { id = "web-api" name = "Web API HTTP" http = "http://localhost:8080/health" interval = "10s" timeout = "1s" }. The endpoint consistently responds in 1.4 seconds but returns HTTP 200. What status will Consul report for this check?

Accepted Answer

critical, because the check exceeded its configured one-second timeout. The HTTP check fails when the request cannot complete within the configured timeout, even if the endpoint eventually returns a success code. Because the probe takes 1.4 seconds against a one-second timeout, Consul abandons the request and marks the check critical. The interval governs probe frequency, not latency evaluation, and HTTP 200 alone cannot keep the check passing when the timeout is breached.

Answer

maintenance, because the check is temporarily unavailable

Answer

warning, because the response was slower than the check interval

Answer

passing, because the endpoint returned HTTP 200

Question 6

A Consul operator is defining an HTTP health check for a service and wants to ensure the check request includes custom headers and that the check tolerates a slow endpoint. Which two check definition fields should be used to accomplish these goals? (Choose two.)

Accepted Answer

timeout. To add custom headers, the header field is used within the HTTP check definition. To tolerate a slow endpoint, the timeout field must be increased to allow more time for the response. Together these two fields satisfy the stated requirements, while method, interval, and tls_skip_verify address different aspects of check behavior.

Answer

tls_skip_verify

Answer

interval

Answer

method

Question 7

A Consul operator registers a web service on a node with a service-level health check that uses the HTTP type and points to http://127.0.0.1:8080/health. The check has been passing for weeks, but the team now wants to stop advertising the service in DNS and the service catalog when the /health endpoint returns HTTP 500. Which Consul check status will the service health be reported as when the endpoint returns 500?

Accepted Answer

critical. HTTP health checks in Consul treat only HTTP 200 as passing. Any other response, including 500, connection refused, or timeout, is reported as critical. This is why the service will be removed from healthy DNS and catalog queries when the endpoint fails. The warning state requires explicit configuration or a script exit code, and maintenance mode is operator-initiated.

Answer

warning

Answer

passing

Answer

maintenance

Question 8

An engineer needs a service check that simply confirms a TCP port on the same host is accepting connections, without sending any application payload. Which Consul check configuration accomplishes this?

Accepted Answer

check { name = "db-port" tcp = "localhost:5432" interval = "10s" }. The tcp check type is designed for exactly this purpose: Consul dials the given host and port and marks the check passing when the connection succeeds. It requires no payload exchange and no helper binaries. HTTP checks expect an HTTP conversation, TTL checks rely on the service to push status, and script checks add an external process dependency that the native TCP probe avoids.

Answer

check { name = "db-port" script = "nc -z localhost 5432" interval = "10s" }

Answer

check { name = "db-port" ttl = "10s" }

Answer

check { name = "db-port" http = "localhost:5432" interval = "10s" }

Question 9

A team configures a script health check on a client agent with `interval` set to 30s and `timeout` set to 5s. The script normally finishes in under a second, but during a nightly batch job it occasionally blocks on a lock for over a minute. The team wants Consul to mark the service unhealthy when the script exceeds the timeout instead of waiting indefinitely. What does Consul do when the script has not exited by the timeout value?

Accepted Answer

The agent marks the check critical and retries the script at the next configured interval.. A script check that outlives its configured `timeout` is failed: the agent records the check as critical without blocking the check loop, and the script runs again at the next interval. This is the mechanism that turns a hung batch job into a visible unhealthy status. The agent does not kill the stray process, so overlapping executions are possible if scripts routinely exceed the timeout.

Answer

The agent pauses the check and marks it as maintenance until the script returns.

Answer

The agent waits for the script to exit, then records the result with a warning status.

Answer

The agent marks the check critical immediately and attempts to terminate the running process.

Question 10

You are deploying a legacy Java application that cannot expose an HTTP endpoint, but it does listen on TCP port 8443. You need Consul to verify the port is accepting connections and mark the service unhealthy if it is not. Which health check definition should you use?

Accepted Answer

A TCP check with `tcp: "127.0.0.1:8443"` and an appropriate interval.. The TCP check type is the correct choice because it directly tests whether a TCP port is open and accepting connections without requiring the application to expose HTTP or run external scripts. It uses only the address and port, making it ideal for legacy services that cannot be instrumented. Other check types either demand capabilities the application lacks or add unnecessary dependencies.

Answer

A TTL check that the application updates via the `/v1/agent/check/pass/<check_id>` endpoint.

Answer

An HTTP check with `http: "https://127.0.0.1:8443/health"` and TLS skip verify.

Answer

A script check that runs `nc -z 127.0.0.1 8443` every 10 seconds.

Question 11

An operations team runs a legacy application that cannot expose an HTTP endpoint but does listen on TCP port 5432. They define a TCP health check in the service registration. During an incident, the port remains open but the application process is hung and no longer accepts new connections. What will Consul report for this check?

Accepted Answer

passing, because the TCP port is open. A TCP health check validates only that a connection to the specified host and port can be established. It does not perform any application-level handshake or data exchange. Because the port remains open in this scenario, the check stays passing even though the application is unresponsive. This is a common limitation when using TCP checks for services that can hang while keeping their socket open.

Answer

warning, because the TCP handshake is slow

Answer

critical, because the application is hung

Answer

maintenance, because the process is not accepting connections

Question 12

A platform team runs a gRPC service and wants Consul to use the standard gRPC health checking protocol rather than a custom script. The service listens on port 50051 and exposes the standard health service. Which check definition should they use?

Accepted Answer

check { name = "grpc-api" grpc = "127.0.0.1:50051" interval = "10s" }. Consul's grpc check type natively implements the standard gRPC health checking protocol, calling the health service and interpreting SERVING as passing. The http check cannot speak the gRPC wire format, h2ping only validates HTTP/2 connectivity without consulting the health service, and tcp merely opens a socket. Only the grpc check actually queries the service's reported health status.

Answer

check { name = "grpc-api" tcp = "127.0.0.1:50051" interval = "10s" }

Answer

check { name = "grpc-api" http = "127.0.0.1:50051" interval = "10s" }

Answer

check { name = "grpc-api" h2ping = "127.0.0.1:50051" interval = "10s" }

Question 13

A platform team runs a fleet of Consul 1.15 server agents behind a strict network policy that blocks all outbound DNS traffic from the server hosts. The team wants the servers to periodically verify that each registered catalog node's DNS name resolves, without installing any extra binaries. Which check definition should they use, and what must they configure so the check can run?

Accepted Answer

A dns check with a name or address field, pointed at a resolver the hosts are still permitted to reach.. The dns check type runs inside the Consul agent and resolves a hostname through the system resolver or an address supplied in the check definition, which satisfies the no-extra-binaries requirement. The network policy still matters: the check needs a resolver it can actually reach, so the team must point the check at a permitted DNS server or lift the block for that destination.

Answer

A script check that invokes getent hosts, because Consul has no built-in DNS resolution check type.

Answer

An alias check that aliases the node's own Consul DNS name, because alias checks resolve names locally.

Answer

An http check targeting https://127.0.0.1:8500/v1/catalog/nodes, because the HTTP API exposes node health.

Question 14

You are configuring a health check that should be considered passing as long as the HTTP response code is in the 2xx range. Which HTTP check configuration achieves this?

Accepted Answer

Use the default HTTP check without specifying any `status` codes.. Consul's HTTP check by default treats any 2xx response code as passing. No additional configuration is needed to achieve this behavior; specifying a URL and interval is sufficient. Other options either set initial status, control request formatting, or manage TLS verification, none of which alter the default status code evaluation. The correct choice is to rely on the default behavior.

Answer

Set `status: "passing"` in the check definition.

Answer

Set `method: "GET"` and `header: { "Accept": ["application/json"] }`.

Answer

Add `tls_skip_verify: true` to the check.

Question 15

A platform engineer is defining a TTL health check for a batch worker that cannot be polled by the Consul agent. The check must be considered healthy only when the worker actively reports in, and must become unhealthy if the worker stops reporting. Which two configuration elements are required to make this TTL check functional? (Choose two.)

Accepted Answer

A TTL value that defines the maximum interval between reports. A TTL check requires two things: a ttl value, which sets the expiry window, and periodic updates from the monitored process to the Consul HTTP API. The ttl tells Consul when to mark the check critical, and the API calls tell Consul the service is alive. Optional fields like deregister_critical_service_after and status mapping are not required for the check to function.

Answer

A status field that maps HTTP response codes to states

Answer

A script or HTTP endpoint that the agent polls

Answer

A deregister_critical_service_after value