Consul 1.15 Multiple Select — 20 Questions

Question 1

Where can you define health checks in Consul? (Select THREE)

Accepted Answer

Agent configuration files. Health checks in Consul can be defined in agent configuration files (A), where you place `check` blocks or `checks` arrays in HCL/JSON to register node-level or service-level checks that the agent loads at startup. They can also be defined via the HTTP API (B), using endpoints such as `PUT /v1/agent/check/register` to register a check at runtime, or within a service registration payload sent to `/v1/agent/service/register`. Service definition files (E) are also valid, since a service registration JSON/HCL file can include a `checks` array (or a single `check`) that defines checks tied to that service, commonly loaded via the agent's `services` configuration directory. The Consul UI (C) is only for viewing and managing existing checks, not for authoring their definitions, and the Consul KV store (D) holds arbitrary key/value data and has no role in defining health checks.

Answer

Consul UI

Answer

Consul KV store

Question 2

A Consul 1.15 operator is configuring a service mesh with Connect and needs to ensure that the sidecar proxy for 'frontend' can establish mTLS connections to the 'backend' service. The operator has already registered both services with Connect sidecars. Which two actions are required to allow this communication? (Choose two.)

Accepted Answer

Configure the 'frontend' service registration with an upstream stanza pointing to 'backend'.. To allow 'frontend' to communicate with 'backend' through Connect, two things are needed: an intention that authorizes the traffic, and an upstream configuration in the 'frontend' service registration so its sidecar knows where to forward requests. Intentions enforce authorization, while the upstream stanza provides the necessary listener and routing information for the sidecar to initiate the mTLS connection.

Answer

Set the 'connect.enabled' parameter to true in the service definition for both services.

Answer

Enable TLS on the Consul agents in both datacenters.

Answer

Manually generate and distribute leaf certificates to both services.

Question 3

A team is using the Consul KV store to store application configuration. They want to implement a watch that runs a script whenever the value of the key `config/app` changes. Which two of the following statements are true regarding Consul KV watches? (Choose two.)

Accepted Answer

A watch of type `key` blocks until the value of the specified key changes, then invokes the handler.. Watches in Consul allow monitoring of KV changes. The `key` type watches a single key and blocks until it changes. The `keyprefix` type watches a prefix and triggers on any change within it. These are both standard watch types. Watches can be configured via CLI, API, or agent configuration, and they do not create keys. They are available in all Consul versions.

Answer

Watches are only available in Consul Enterprise and not in the open-source version.

Answer

Watches can only be configured via the Consul HTTP API and not through the CLI or configuration files.

Answer

A watch of type `key` will automatically create the key if it does not exist.

Question 4

Which TWO of the following actions occur when a node fails in a Consul cluster?

Accepted Answer

All services on the node are marked critical.. Option A is correct because when a Consul node fails, its health checks stop passing and Consul marks all services registered on that node as critical, reflecting their unhealthy state in the catalog. Option D is correct because Consul's DNS interface only returns healthy service instances by default, so services on the failed node are removed from DNS results until the node recovers. Option B is incorrect because a failed node is not immediately deleted; it remains in the catalog and is only removed after being marked as failed or explicitly deregistered. Option C is incorrect because Consul does not reboot nodes; it only detects and reports failures. Option E is incorrect because Consul is a distributed, fault-tolerant system and a single node failure does not shut down the entire cluster.

Answer

The node is immediately deleted from the cluster.

Answer

The node is automatically rebooted.

Answer

The entire cluster shuts down.

Question 5

Which THREE of the following are benefits of using the Consul DNS interface?

Accepted Answer

No application code changes required.. Ease of use, platform-agnostic, and no application changes are benefits.

Answer

Provides advanced traffic shifting.

Answer

Encrypts all traffic between services.

Question 6

What components can affect the outcome of a health check? (Select THREE)

Accepted Answer

Network connectivity. Network connectivity (A) is correct because a health check must be able to reach the target service or node over the network; if the path is blocked, the check fails regardless of the service's actual state. Application responsiveness (C) is correct because the check's result depends on whether the application actually answers within the configured timeout and returns the expected status. Agent configuration (D) is correct because settings such as check interval, timeout, and the check definition itself determine when and how the check runs and what result is reported. The client browser (B) is not involved, since health checks are performed by agents or servers, not by end-user browsers. Consul server uptime (E) is not a direct component of an individual health check outcome, as checks are executed by the local agent and only aggregated by the servers.

Answer

Client browser

Answer

Consul server uptime

Question 7

A developer registers a service named 'orders' on a Consul node and wants DNS queries for orders.service.consul to return the service's SRV records so clients can discover both the address and the port. The developer is verifying that the registration contains everything needed for SRV resolution. Which two registration elements must be present for SRV queries to return usable records? (Choose two.)

Accepted Answer

A port value in the service definition. SRV answers combine a target host and a port, so Consul needs both a port from the service definition and a resolvable address, taken from the service address or inherited from the node. Health checks, tags, and naming conventions affect filtering or presentation but are not prerequisites for generating SRV records. The two required elements are therefore the port and the address.

Answer

An explicit tag on the service

Answer

A health check attached to the service

Answer

A DNS-friendly service name with no underscores

Question 8

Which THREE of the following are valid check types in Consul?

Accepted Answer

TCP. Consul supports HTTP, TCP, and Script (external) health checks.

Answer

SSH

Answer

FTP

Question 9

Which THREE of the following are key components of a service definition?

Accepted Answer

Check/Health Check. In a service definition (as used by service discovery/registry tools such as Consul), the Service Name (E) is the fundamental identifier that registers the service and lets other services and DNS/API lookups discover it, so it is a required key component. The Port (D) is also essential because it tells clients and the registry on which TCP/UDP port the service is listening, enabling correct routing and connection. A Check/Health Check (C) is likewise a core part of the definition, since it defines how the registry verifies the instance is healthy (e.g., an HTTP, TCP, or script check with an interval and timeout) and removes unhealthy instances from discovery. By contrast, a Secret Key (A) is a credential/security artifact, not a structural element of a service definition, and a Node BIOS version (B) is hardware/firmware inventory data that has no role in describing or discovering a service.

Answer

Secret Key

Answer

Node BIOS version

Question 10

Which TWO of the following statements are true about the 'passing' parameter in DNS queries?

Accepted Answer

It returns only services with passing health checks.. Option B is correct because the 'passing' parameter filters DNS query results so that only service instances whose health checks are currently passing are returned, which is essential for service discovery in tools like Consul. Option E is correct because 'passing' is appended as a query string parameter in the DNS query URL, for example when querying a service name with ?passing to restrict results to healthy instances. Option A is incorrect because the 'passing' parameter does not require manual service registration; services are registered through the service registry or API, not through this query parameter. Option C is incorrect because 'passing' is a query-time filter and has no effect on restarting the DNS server. Option D is incorrect because 'passing' is a per-query parameter, not a permanent configuration setting.

Answer

It requires manual service registration.

Answer

It forces the DNS server to restart.

Answer

It is a permanent configuration setting.

Question 11

Which TWO of the following are benefits of using Consul Connect?

Accepted Answer

Centralized authorization policies.. Consul Connect is HashiCorp's service mesh feature, and one of its core benefits is centralized authorization policies (Option A): intentions define which services may communicate with which others, and these policies are managed centrally in Consul and enforced by sidecar proxies, giving consistent, identity-based access control across the mesh. Option B is also correct because Consul Connect automatically manages mTLS: it provides built-in certificate authority functionality that issues, rotates, and distributes certificates to sidecar proxies, so service-to-service traffic is encrypted and mutually authenticated without application changes. Option C is wrong because Connect's sidecar proxies add only minimal overhead and are not intended to increase latency as a benefit. Option D is wrong because firewalls are still required for network segmentation and host-level security; Connect complements rather than eliminates them. Option E is wrong because Consul Connect is a service mesh for secure service communication, not a database replication tool.

Answer

Increased application latency.

Answer

Elimination of firewalls.

Answer

Automatic database replication.

Question 12

An engineer is designing a service that must coordinate access to a shared resource using Consul KV sessions and needs to understand the guarantees the lock provides. Which TWO statements accurately describe how Consul's KV locking with sessions behaves? (Choose two.)

Accepted Answer

A lock is acquired by writing a key with the `acquire` parameter and the session ID, and succeeds only if no other valid session currently holds it.. Consul locks are acquired with the `acquire` operation carrying a session ID, and they are released automatically when that session expires or is invalidated. Mutual exclusion is guaranteed because only one valid session can hold a given key. Release is performed through the same key-write path with the `release` operation, and session renewal happens at the session endpoint, not the KV endpoint.

Answer

Session TTL renewal must be performed through the `/v1/kv` endpoint rather than the session endpoint.

Answer

A lock key can be held simultaneously by multiple sessions as long as each session renews within its TTL.

Answer

Releasing a lock requires calling a dedicated `consul kv unlock` subcommand that is separate from the put operation.

Question 13

Which TWO of the following are true regarding the Consul Service Catalog?

Accepted Answer

It provides a unified view of all services in the cluster.. The catalog is replicated via Raft and can be queried via API or DNS.

Answer

It is strictly read-only.

Answer

It is only accessible via the CLI.

Answer

It is stored in the local disk of every agent.

Question 14

Which THREE of the following are valid ways to register a service in Consul?

Accepted Answer

Kubernetes Custom Resource Definitions.. Option A is correct because Consul supports Kubernetes Custom Resource Definitions (CRDs) such as ServiceRegistration (and previously ServiceDefaults/ServiceResolver via CRDs) as a declarative way to register services when running Consul on Kubernetes with the official Helm chart and CRDs enabled. Option B is correct because services can be defined in agent configuration files (HCL or JSON) placed in the agent's config directory, using a service block or services array, and Consul loads them at agent startup or reload. Option C is correct because the Consul HTTP API exposes the endpoint PUT /v1/agent/service/register, which accepts a JSON service definition and registers the service with the local agent. Option D is not valid because Consul stores state in a Raft-replicated log and snapshot files, not in a directly editable database file; modifying internals would corrupt state and is unsupported. Option E is not valid because the Raft log is an internal replicated log managed by the Raft consensus protocol, and manually editing it would break consistency and is not a supported registration method.

Answer

Directly modifying the Consul database file.

Answer

Manual editing of the Raft log.

Question 15

Which THREE of the following fields are returned in a typical Consul KV API GET response?

Accepted Answer

ModifyIndex. A Consul KV API GET response (e.g., GET /v1/kv/<key>) returns a JSON array of entries containing the fields Key, Value, Flags, CreateIndex, ModifyIndex, LockIndex, and Session. Option A (ModifyIndex) is correct because it is the index at which the key was last modified and is included in every KV read response. Option B (Key) is correct because the full key path is returned so the client knows which key the entry corresponds to. Option C (Value) is correct because the base64-encoded value stored at the key is returned (null if the key has no value). Option D (SessionTTL) is not part of the KV response; TTL is a property of sessions (returned by the session API, e.g., /v1/session/info), not of KV entries. Option E (CreateTime) is not a Consul KV field; Consul uses CreateIndex (a Raft index) rather than a timestamp to record when the key was created.

Answer

SessionTTL

Answer

CreateTime

Question 16

You are designing a configuration system where multiple instances of a service must coordinate to elect a single leader using Consul KV. Which two statements accurately describe how to implement leader election with sessions? (Choose two.)

Accepted Answer

Each instance should create a session with a unique name and then attempt to acquire the same KV key using PUT /v1/kv/service/leader?acquire=<session_id>.. Leader election with Consul KV relies on sessions and the acquire operation. Each candidate creates a unique session and attempts to acquire a shared key. The holder must renew its session to keep the lock; if renewal fails, the session expires and the lock is released. Deleting the key or sharing sessions does not provide correct coordination, and KV entries do not support TTLs.

Answer

To release leadership, the leader can simply delete the KV key, which automatically invalidates its session and allows another instance to acquire the lock.

Answer

All instances should use the same session ID to ensure they can all attempt to acquire the lock simultaneously, and the first one to call acquire becomes the leader.

Answer

The KV key used for leader election must have a TTL set via the ?ttl= query parameter, so that it expires automatically if the leader fails.

Question 17

Which TWO of the following are features of Consul Connect native integration?

Accepted Answer

The app handles its own mTLS handshake.. Consul Connect native integration means the application itself participates directly in the service mesh rather than relying on a sidecar proxy, so option A is correct: the app performs its own mTLS handshake to establish mutually authenticated, encrypted connections with other services. Option B is also correct because a natively integrated app uses the Consul agent's local HTTP API (e.g., the /v1/agent/connect/ca/leaf/ endpoint) to obtain its leaf certificate and CA roots for that mTLS handshake. Option C is wrong because native integration is language-agnostic — Consul provides client libraries for multiple languages and the API can be called from any runtime, not just Go. Option D is wrong because the whole point of native integration is that no sidecar proxy is required for routing or encryption. Option E is wrong because native integration specifically enables secure mTLS traffic, not merely non-secure traffic.

Answer

The app must be written in Go.

Answer

The sidecar proxy is still required for routing.

Answer

It supports only non-secure traffic.

Question 18

A Consul operator is defining an HTTP health check for a service and wants to ensure the check request includes custom headers and that the check tolerates a slow endpoint. Which two check definition fields should be used to accomplish these goals? (Choose two.)

Accepted Answer

timeout. To add custom headers, the header field is used within the HTTP check definition. To tolerate a slow endpoint, the timeout field must be increased to allow more time for the response. Together these two fields satisfy the stated requirements, while method, interval, and tls_skip_verify address different aspects of check behavior.

Answer

tls_skip_verify

Answer

interval

Answer

method

Question 19

What is true about Consul health checks? (Select TWO)

Accepted Answer

They run on the local agent. They run locally on the agent and can be associated with specific services.

Answer

They only support GET requests

Answer

They always run on the server

Answer

They cannot be disabled

Question 20

A Consul administrator is reviewing how check results propagate and wants to understand which factors determine whether a service instance is considered healthy in the catalog. Which two factors directly determine a service's aggregate health status in Consul? (Choose two.)

Accepted Answer

The status of the node-level checks associated with the agent hosting the service. Consul determines a service instance's health from two sources: the checks attached to that service and the checks attached to the node hosting it. A critical node check, such as a failed serfHealth, makes every service on that node unhealthy, while a critical service check makes only that instance unhealthy. Other attributes such as sibling service count, datacenter, or server version do not participate in the health computation.

Answer

The number of other services registered on the same agent

Answer

The Consul version running on the server that handles the catalog write

Answer

The datacenter in which the service is registered