Consul 1.15 Quick Quiz — 10 Questions

Question 1

An operator registers a service with a TTL health check. The service is responsible for updating the check status via the HTTP API. The service fails to send updates for 90 seconds. The check is configured with 'DeregisterCriticalServiceAfter' set to 10 minutes. What is the current health status of the service, and what will happen after 10 minutes?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The service is critical; it will be deregistered after 10 minutes.. TTL health checks require periodic updates from the service. If no update is received within the TTL period, the check becomes critical. The 'DeregisterCriticalServiceAfter' field, when set, schedules deregistration of the service instance after the check has been critical for the specified duration. In this case, after 90 seconds the check is critical, and after 10 minutes of being critical, the service is deregistered.

Answer

The service is passing; it will be deregistered after 10 minutes.

Answer

The service is warning; it will be deregistered after 10 minutes.

Answer

The service is critical; it will be deregistered immediately.

Question 2

Where can you define health checks in Consul? (Select THREE)

Accepted Answer

Agent configuration files. Health checks in Consul can be defined in agent configuration files (A), where you place `check` blocks or `checks` arrays in HCL/JSON to register node-level or service-level checks that the agent loads at startup. They can also be defined via the HTTP API (B), using endpoints such as `PUT /v1/agent/check/register` to register a check at runtime, or within a service registration payload sent to `/v1/agent/service/register`. Service definition files (E) are also valid, since a service registration JSON/HCL file can include a `checks` array (or a single `check`) that defines checks tied to that service, commonly loaded via the agent's `services` configuration directory. The Consul UI (C) is only for viewing and managing existing checks, not for authoring their definitions, and the Consul KV store (D) holds arbitrary key/value data and has no role in defining health checks.

Answer

Consul UI

Answer

Consul KV store

Question 3

A Consul 1.15 operator is configuring a service mesh with Connect and needs to ensure that the sidecar proxy for 'frontend' can establish mTLS connections to the 'backend' service. The operator has already registered both services with Connect sidecars. Which two actions are required to allow this communication? (Choose two.)

Accepted Answer

Configure the 'frontend' service registration with an upstream stanza pointing to 'backend'.. To allow 'frontend' to communicate with 'backend' through Connect, two things are needed: an intention that authorizes the traffic, and an upstream configuration in the 'frontend' service registration so its sidecar knows where to forward requests. Intentions enforce authorization, while the upstream stanza provides the necessary listener and routing information for the sidecar to initiate the mTLS connection.

Answer

Set the 'connect.enabled' parameter to true in the service definition for both services.

Answer

Enable TLS on the Consul agents in both datacenters.

Answer

Manually generate and distribute leaf certificates to both services.

Question 4

A platform team operates two Consul datacenters, dc1 (primary) and dc2 (secondary), with ACLs enabled. They have configured token replication using a replication token in dc2. After rotating the replication token in dc1, they update the configuration in dc2 and restart the Consul agents. However, ACL replication stops working and dc2 logs show 'Permission denied'. What is the most likely cause?

Accepted Answer

The new replication token must be created in the primary datacenter and have read permissions on ACLs, then configured in dc2.. ACL token replication in Consul allows secondary datacenters to mirror ACL data from the primary. The replication token must be created in the primary datacenter with read permissions on ACL resources. After rotating the token, the old token becomes invalid, leading to permission errors in the secondary. Updating the secondary's configuration with a valid token from the primary restores replication.

Answer

The replication token must be configured in both dc1 and dc2 under acl.tokens.replication.

Answer

The replication token must be a management token with acl:write permissions in the primary datacenter.

Answer

The replication token in dc2 must match the token used in dc1's acl.tokens.replication configuration.

Question 5

A team is using the Consul KV store to store application configuration. They want to implement a watch that runs a script whenever the value of the key `config/app` changes. Which two of the following statements are true regarding Consul KV watches? (Choose two.)

Accepted Answer

A watch of type `key` blocks until the value of the specified key changes, then invokes the handler.. Watches in Consul allow monitoring of KV changes. The `key` type watches a single key and blocks until it changes. The `keyprefix` type watches a prefix and triggers on any change within it. These are both standard watch types. Watches can be configured via CLI, API, or agent configuration, and they do not create keys. They are available in all Consul versions.

Answer

Watches are only available in Consul Enterprise and not in the open-source version.

Answer

Watches can only be configured via the Consul HTTP API and not through the CLI or configuration files.

Answer

A watch of type `key` will automatically create the key if it does not exist.

Question 6

If a KV operation returns a 403 Forbidden status, what is the most common cause?

Accepted Answer

The ACL token lacks sufficient permissions.. A 403 Forbidden response from Consul's HTTP API indicates the request was authenticated but the associated ACL token does not have the required policy permissions for the target resource. Consul returns 403 specifically when an ACL is enforced and the token lacks the necessary 'read', 'write', or 'list' capability on the KV prefix being accessed. This is distinct from 401 (missing/invalid token) and 404 (key not found).

Answer

The server is down.

Answer

The data is too large.

Answer

The key does not exist.

Question 7

You have a Consul 1.15 cluster with two datacenters, dc1 and dc2, federated via WAN gossip. You want to use a prepared query to automatically failover to a service in dc2 if the service in dc1 becomes unhealthy. Which configuration in the prepared query is required to achieve this?

Accepted Answer

A `Failover` block with `Datacenters` set to `["dc2"]`.. Prepared queries support a `Failover` block that can list datacenters to try when local instances are unhealthy. By setting `Datacenters` to `["dc2"]`, the query will automatically attempt to find healthy instances in dc2 if none are available in the local datacenter. This is the standard method for cross-datacenter failover in Consul. Other options either misuse fields or do not provide the required failover behavior.

Answer

A `Service` block with `Datacenter` set to `dc2`.

Answer

A `Failover` block with `NearestN` set to 3.

Answer

A `Failover` block with `NearestN` set to 2 and `Datacenters` listing dc2.

Question 8

Which TWO of the following actions occur when a node fails in a Consul cluster?

Accepted Answer

All services on the node are marked critical.. Option A is correct because when a Consul node fails, its health checks stop passing and Consul marks all services registered on that node as critical, reflecting their unhealthy state in the catalog. Option D is correct because Consul's DNS interface only returns healthy service instances by default, so services on the failed node are removed from DNS results until the node recovers. Option B is incorrect because a failed node is not immediately deleted; it remains in the catalog and is only removed after being marked as failed or explicitly deregistered. Option C is incorrect because Consul does not reboot nodes; it only detects and reports failures. Option E is incorrect because Consul is a distributed, fault-tolerant system and a single node failure does not shut down the entire cluster.

Answer

The node is immediately deleted from the cluster.

Answer

The node is automatically rebooted.

Answer

The entire cluster shuts down.

Question 9

You are using Consul 1.15 with Connect enabled. A service 'web' needs to communicate with an upstream service 'api' in a different datacenter. You have configured a mesh gateway in each datacenter. The 'web' service's sidecar proxy is configured with an upstream for 'api'. However, traffic is failing. You check the sidecar proxy logs and see 'no healthy upstream'. What is the most likely cause?

Accepted Answer

The upstream service 'api' is not registered in the remote datacenter or has no healthy instances.. The error 'no healthy upstream' means the sidecar proxy cannot find any healthy instances of the upstream service. In a cross-datacenter setup with mesh gateways, this typically occurs when the upstream service is not registered or has no healthy instances in the remote datacenter. Other issues like missing gateway registration or deny intentions would produce different errors.

Answer

The 'web' service's sidecar proxy is not configured with the correct CA certificate.

Answer

The intention between 'web' and 'api' is set to 'deny'.

Answer

The mesh gateway is not registered as a service in Consul.

Question 10

A service has a TTL check configured with a 30-second TTL. If the application crashes and stops sending heartbeats, when will the service status change to 'critical'?

Accepted Answer

After 30 seconds. A TTL check in Consul marks the service as critical when the TTL interval elapses without a heartbeat update. Since the TTL is set to 30 seconds, the check will transition to critical exactly 30 seconds after the last successful heartbeat. The application crashing means no further heartbeats are sent, so the timer expires and Consul updates the service status to critical.

Answer

After 60 seconds

Answer

Once the agent restarts

Answer

Immediately