Consul 1.15 Health Checking — Timed 25 Questions

Question 1

An operator observes that a service is failing its HTTP health check because the application takes 15 seconds to start up, exceeding the default timeout. Which parameter should be adjusted in the service definition to prevent premature failure?

25 minute time limit — choose an answer to begin.

Accepted Answer

Timeout. The HTTP health check Timeout parameter defines how long Consul waits for a response before marking the check as failed. If the application takes 15 seconds to start, the default timeout (often 10 seconds) is exceeded, causing premature failure. Increasing the Timeout value allows the check to wait longer for the application to respond.

Answer

InitialStatus

Answer

Interval

Answer

DeregisterCriticalServiceAfter

Question 2

Which agent configuration allows you to specify the local address that the Consul agent binds to for performing health checks?

Accepted Answer

bind_addr. The `bind_addr` parameter in the Consul agent configuration specifies the local address that the agent binds to for both internal cluster communication and for performing health checks. When Consul runs a health check (e.g., a script or HTTP check), it originates from this address. This is distinct from `client_addr`, which controls the address the agent listens on for client interfaces (HTTP, DNS, etc.), and `advertise_addr`, which is the address advertised to other Consul nodes. Therefore, `bind_addr` is the correct setting for the source address of health checks.

Answer

advertise_addr

Answer

client_addr

Answer

check_addr

Question 3

You have configured a Script health check that executes a shell command. For security reasons, you want to restrict which scripts the Consul agent can run. What configuration setting must be set to 'false' in the agent configuration to disable script checks entirely?

Accepted Answer

enable_script_checks. In Consul agent configuration, the 'enable_script_checks' setting controls whether script health checks are allowed. Setting it to false disables all script checks on that agent, which is the documented way to restrict script execution for security. This is a global toggle for the agent, not per-check.

Answer

allow_unprivileged_scripts

Answer

disable_remote_exec

Answer

enable_local_script_execution

Question 4

Which configuration file format is preferred by Consul for defining service health checks?

Accepted Answer

JSON. Consul's preferred configuration file format for defining service health checks is JSON. While Consul also supports HCL for some configurations, JSON is the native and most widely used format for service definitions, including health checks. The JSON structure allows for clear, hierarchical specification of check properties such as interval, timeout, and HTTP endpoint. This is documented in Consul's official service definition documentation.

Answer

XML

Answer

INI

Answer

YAML

Question 5

You are using Consul Template to observe health status. What happens to a service's health check status if the network segment between the agent and the server is partitioned and the server cannot contact the agent?

Accepted Answer

It enters a critical state. If a server cannot reach the agent performing the check, the health status becomes unknown or unreachable, often reflected as a critical status for the service until connectivity is restored.

Answer

It is automatically removed from the catalog

Answer

It remains passing

Answer

It stays in the last known state

Question 6

You want to run a shell command as a health check. Which field in the service definition specifies the command to execute?

Accepted Answer

script. In a Consul service definition, the 'script' field within a check block specifies the shell command to execute for a script health check. For example, a check block with 'script': '/usr/bin/check.sh' will run that script. The 'command' field is not used for health checks; it is used in other contexts like Consul's exec command.

Answer

check_exec

Answer

command

Answer

action

Question 7

What happens if you do not specify an 'interval' for a health check in the configuration?

Accepted Answer

The configuration will fail to load. In Consul, the 'interval' field is a required parameter for any health check that uses a script, HTTP, TCP, or gRPC check. If you omit it, the agent will reject the service or check definition during configuration loading, causing the configuration to fail. This is enforced by Consul's validation logic, which ensures that checks have a defined frequency to avoid undefined behavior. Therefore, the configuration will not load, making option B correct.

Answer

It inherits the agent's check interval

Answer

It defaults to 10 seconds

Answer

It runs once and stops

Question 8

Which of the following are valid types of health checks in Consul? (Select TWO)

Accepted Answer

TCP. Option B (TCP) is correct because Consul supports a TCP check type that attempts a TCP connection to the specified host and port, marking the service healthy if the connection succeeds. Option E (HTTP) is correct because Consul supports an HTTP check type that performs an HTTP GET request against a specified URL and evaluates the response status code (by default, any 2xx response is healthy). Consul's documented check types include script, HTTP, TCP, TTL, Docker, gRPC, H2 ping, alias, and UDP, but ICMP (A) is not among them, so it is not a valid Consul health check type. UDP (C) is not a supported Consul check type either, and SNMP (D) is a network monitoring protocol that Consul does not implement as a native health check.

Answer

ICMP

Answer

UDP

Answer

SNMP

Question 9

If you need to perform an HTTP check over HTTPS, what configuration option is required to handle self-signed certificates?

Accepted Answer

tls_skip_verify. In Consul HTTP checks, the tls_skip_verify option is used to disable TLS certificate verification, which is required when the target endpoint presents a self-signed certificate. Without it, the check fails because the certificate chain cannot be validated against trusted CAs. This option is set within the check definition's tls_skip_verify field.

Answer

tls_insecure

Answer

disable_tls

Answer

ignore_cert

Question 10

Which of the following parameters are used in a service health check configuration? (Select THREE)

Accepted Answer

interval. Interval, timeout, and script/http are standard parameters in check definitions.

Answer

weight

Answer

service_id

Question 11

Which actions can you perform on a TTL check? (Select TWO)

Accepted Answer

pass. You can tell Consul that the check passed or is in a warning state.

Answer

restart

Answer

suspend

Answer

fail

Question 12

Which states can a health check report? (Select THREE)

Accepted Answer

passing. Health checks in systems like AWS Route 53, Elastic Load Balancing, and similar monitoring frameworks report one of three discrete states: passing, warning, and critical. Option A (passing) is correct because it indicates the resource is healthy and responding successfully to the health check probe. Option C (warning) is correct because it represents a degraded but not yet failing state, often used when a threshold is partially breached. Option D (critical) is correct because it signals the resource has failed the health check and should be taken out of service or trigger an alarm. Option B (terminated) is not a health check state; it describes an instance lifecycle status, not a probe result. Option E (pending) is also not a health check state; it is typically an initial resource or deployment status before monitoring begins.

Answer

terminated

Answer

pending

Question 13

Which of these are required fields for a TCP health check definition? (Select THREE)

Accepted Answer

name. In a TCP health check definition, the name field (C) is required because every health check must be uniquely identified within the load balancer configuration. The tcp field (D) is required because it specifies the protocol type and the port to connect to, which is the core of a TCP health check. The interval field (E) is required because it defines how frequently the health check probe runs, which is mandatory for scheduling checks. The timeout field (A) is not required because it has a default value if omitted. The http field (B) is not required because it applies to HTTP health checks, not TCP health checks.

Answer

timeout

Answer

http

Question 14

An operations engineer registers an HTTP health check against `https://payments.internal:8443/health` on a Consul client agent. The endpoint uses a certificate signed by an internal CA that is not in the system trust store, and requests must carry an `Authorization: Bearer` token. The check currently reports critical. Which two configuration additions are required to make this check pass? (Choose two.)

Accepted Answer

Set `ca_file` to the path of the internal CA certificate in the check definition.. Two independent problems keep this HTTP check critical: the agent does not trust the certificate chain, and the probe request lacks the required bearer token. Trust is restored by pointing `ca_file` at the internal CA bundle rather than disabling verification, and authentication is satisfied by adding the Authorization header through the `header` map. Both are supported fields on HTTP check definitions in Consul 1.15.

Answer

Set `tls_server_name` to `payments.internal` in the check definition.

Answer

Set `method` to POST so the agent sends credentials in the request body.

Answer

Set `tls_skip_verify` to true in the check definition.

Question 15

A cloud engineer is configuring a Consul 1.15 health check for a service that runs on a host with multiple network interfaces. The service listens only on 10.0.1.5:8080, but the Consul agent's default check address resolves to a different interface. The engineer wants the TCP check to connect specifically to 10.0.1.5:8080. Which configuration field should be used within the check definition to achieve this?

Accepted Answer

tcp. For TCP health checks, the tcp field defines the exact host and port to connect to. It allows overriding the default service address, which is essential when the service binds to a specific interface. Other fields like address or service_id do not serve this purpose for a TCP check.

Answer

address

Answer

http

Answer

service_id

Question 16

A Consul cluster runs a service that uses a script health check. The operations team wants to ensure that the check is correctly configured to detect failures and avoid false positives. Which two fields are required in the script health check definition? (Choose two.)

Accepted Answer

interval. A script health check requires the args field to define the command and the interval field to schedule execution. Without args, Consul has nothing to run; without interval, the check never executes. Timeout, status, and notes are optional and do not affect whether the check can function.

Answer

status

Answer

notes

Answer

timeout

Question 17

A platform engineer is registering a web API on a Consul 1.15 agent. The API exposes a readiness endpoint at https://10.0.4.21:8443/ready that requires the header X-Health-Token: s3cr3t, and the check must accept the cluster's internal CA certificate. Which check definition accomplishes this?

Accepted Answer

An http check with http: "https://10.0.4.21:8443/ready", header: { X-Health-Token: ["s3cr3t"] }, and tls_skip_verify: false.. Consul's built-in HTTP check is the right tool because it natively supports custom request headers through the header map and controls certificate validation with tls_skip_verify. Leaving tls_skip_verify at false makes the agent validate the server against its CA bundle, which is exactly what the internal-CA scenario demands. Script-based or TCP alternatives either lose status fidelity or require extra dependencies.

Answer

A tcp check with tcp: "10.0.4.21:8443" and a header stanza specifying X-Health-Token.

Answer

A script check that runs curl -k -H "X-Health-Token: s3cr3t" https://10.0.4.21:8443/ready and interprets a zero exit code as passing.

Answer

An http check with http: "https://10.0.4.21:8443/ready" and method: "HEAD", relying on the agent's default header injection.

Question 18

A Consul agent is configured with a service that has a health check defined in a separate JSON file. The check is a TCP check against port 5432 on localhost. The agent starts, but the check immediately reports critical even though the database is listening on port 5432. Which configuration error is most likely responsible?

Accepted Answer

The check definition uses tcp = "localhost:5432" but the agent is running in a network namespace where localhost does not resolve to the host's loopback interface.. TCP checks connect to the specified address and port. If the agent runs in a container or namespace where localhost does not map to the host's loopback, the connection fails even if the database is listening on the host. Timeout, service port mismatch, and script check settings do not explain an immediate critical state for a TCP check.

Answer

The check definition uses tcp = "localhost:5432" but the interval is set to "10s" and the timeout is set to "1s".

Answer

The check definition uses tcp = "localhost:5432" but the service is registered with a different port in its service definition.

Answer

The check definition uses tcp = "localhost:5432" but the agent is configured with enable_script_checks = false.

Question 19

A site reliability engineer is troubleshooting why a service registered in Consul 1.15 is being marked as critical by its HTTP health check. The check is configured with http = "https://internal.service/health", interval = "10s", and timeout = "2s". The service's logs show that requests from Consul are reaching the application and returning HTTP 200, but Consul still reports critical. Which two configuration issues could cause this behavior? (Choose two.)

Accepted Answer

The HTTP check is configured with tls_skip_verify = false, and the service uses a self-signed certificate.. Two plausible causes for a critical HTTP check despite 200 responses are TLS certificate validation failure and response time exceeding the timeout. Both are common in internal services using self-signed certificates or having slow health endpoints. The other options either contradict the scenario or misunderstand Consul's check evaluation logic.

Answer

The check's interval is set to 10s, but the Consul agent's clock is skewed by 15 seconds relative to the service.

Answer

The check is defined with method = "POST" instead of GET, but the service only accepts GET.

Answer

The service's health endpoint returns a 200 status code but includes a response body that Consul cannot parse.

Question 20

A platform team runs a legacy batch worker that has no HTTP listener but exposes a lightweight TCP socket on port 9100 for liveness only. They register it in Consul with a service definition that includes a check named "worker-liveness". The worker process occasionally blocks for up to 40 seconds during a nightly compaction routine, but the team still wants Consul to mark it unhealthy only if the socket is genuinely unreachable. Which check configuration best satisfies this requirement?

Accepted Answer

A tcp check with interval = "30s", timeout = "45s", and a generous success_before_passing. The service only speaks raw TCP, so a tcp check is the only type that can probe it directly. The worker can stall for up to 40 seconds, meaning the probe timeout must exceed that window to avoid marking a reachable-but-busy process as critical. A 30-second interval keeps probes from overlapping, and success_before_passing absorbs a single transient failure so the check does not flap during the nightly compaction routine.

Answer

A tcp check with interval = "10s" and timeout = "45s"

Answer

An http check with method = "GET" and timeout = "5s"

Answer

An alias check that aliases the node-level Serf health check