Consul 1.15 Service Discovery Practice Test 2 — 15 Questions

Question 1

Which THREE of the following are valid Consul health check statuses?

Accepted Answer

warning. Consul health checks report one of exactly three statuses: passing, warning, and critical. Option C (passing) is correct because it indicates the check succeeded and the service is healthy. Option B (warning) is correct because it signals the check is in a degraded but non-failing state. Option E (critical) is correct because it means the check failed and the service should be considered unhealthy. Option A (maintenance) is not a health check status; it is a service-level mode enabled via the /agent/service/maintenance API or `consul maint` command that forces checks into critical. Option D (unknown) is not a valid Consul health check status, though it appears in some other monitoring systems.

Answer

maintenance

Answer

unknown

Question 2

A platform team runs a Consul cluster in production. They want to prevent a specific service, `redis-cache`, from being returned by DNS queries and catalog lookups unless it has passed its health check. They have already configured a TTL health check for the service. What must they do to ensure the service is only discoverable when healthy?

Accepted Answer

Register the service with a health check and query DNS with the `passing` parameter.. Consul's DNS interface returns only healthy service instances when a health check is associated. To explicitly enforce this, the `passing` parameter in DNS queries filters results to only those instances with passing health checks. The service already has a TTL check, so using `passing` ensures that failing instances are excluded from DNS responses, achieving the goal of preventing discovery of unhealthy instances.

Answer

Configure the service with `"weights"` to prioritize healthy instances.

Answer

Enable the `enable_tag_override` option in the service definition.

Answer

Ensure the service's health check is registered and the DNS query uses the default behavior.

Question 3

A Consul operator needs to register an external service (a third-party API) into the Consul catalog so that internal applications can discover it alongside other services. The external service does not run a Consul agent. Which Consul feature should the operator use?

Accepted Answer

Consul's external service registration using the `external-services` configuration in the agent config. External services in Consul are registered using the `external-services` configuration in the agent configuration file. This allows services that do not have a Consul agent to be added to the catalog, complete with health checks, so they can be discovered via DNS or HTTP API. The other options either require a local agent or do not provide the necessary integration for external services.

Answer

Consul's external service registration via the `/catalog/register` HTTP API with a node definition

Answer

Consul's `consul services register` command with a service definition file

Answer

Consul's `consul connect` feature with an Envoy sidecar proxy

Question 4

A developer registers a web service `api-gateway` on a Consul node using the HTTP API. The service definition includes a `meta` block with `version` and `environment` keys. Later, the developer queries the service catalog and notices that the `meta` fields are not returned in the response. What is the most likely reason for the missing metadata?

Accepted Answer

The service was registered without the `meta` block due to a formatting error in the JSON payload.. Service metadata in Consul is stored as part of the service definition when registered via the HTTP API. If the `meta` block is malformed or omitted in the JSON payload, the metadata will not be present in the catalog. The most likely reason for missing metadata is a formatting error during registration, such as incorrect nesting or syntax. Ensuring the `meta` block is correctly placed within the service object resolves the issue.

Answer

The query used does not include the `?meta` parameter to return metadata.

Answer

The `meta` block is only supported for services registered via the CLI, not the HTTP API.

Answer

The Consul agent must be restarted after registering a service with metadata.

Question 5

A developer registers a new service instance with the local Consul agent using the HTTP API. The registration includes a TCP health check on port 8080. The service process is running and listening on port 8080, but the check status remains 'critical'. The developer confirms the port is open using netcat from the same host. What is the most likely cause?

Accepted Answer

The check definition specifies an incorrect port or address that differs from the one the service is using.. The TCP check will report critical if it cannot establish a connection to the configured address and port. Since the service is listening on port 8080 but the check is failing, the most likely cause is a mismatch between the check's target and the actual service endpoint. This could be an incorrect port, IP address, or hostname in the check definition.

Answer

The check is configured to run on a remote node instead of the local agent.

Answer

The service is listening on localhost only, and the Consul agent cannot reach it.

Answer

The check definition is missing the 'interval' field, so Consul never runs the check.

Question 6

A Consul operator is configuring a service registration in a JSON file to be loaded by a Consul agent. The operator wants to ensure that the service is discoverable via DNS and that clients can filter instances by environment tag. The service should also have a health check that verifies the service is responding on port 8080. Which TWO of the following configuration fields are required to achieve this? (Choose two.)

Accepted Answer

`port`. To register a service that is discoverable via DNS and has a health check, the minimum required fields are `name` and `port`. The `name` identifies the service, and the `port` is necessary for clients to connect and for the health check to target the correct port. Tags and checks are optional but can be added for filtering and health monitoring, while `address` defaults to the node address if omitted.

Answer

`check`

Answer

`address`

Answer

`tags`

Question 7

A developer is using the Consul DNS interface to discover instances of the `web` service. They want to retrieve only the instances that are healthy and have the tag `v1`. Which DNS query format should they use?

Accepted Answer

`v1.web.service.consul`. Consul DNS supports tag-based filtering by prefixing the tag to the service name, such as `v1.web.service.consul`. By default, only healthy instances are returned unless the `?passing` parameter is used to include all instances. The other formats are invalid or do not filter by tag correctly.

Answer

`web.service.consul?tag=v1`

Answer

`web.v1.service.consul`

Answer

`web.service.consul`

Question 8

A platform team is designing a service discovery solution using Consul. They need to ensure that when a service instance becomes unhealthy, it is automatically removed from DNS query results and that clients can still discover other healthy instances. Which two configurations or behaviors achieve this? (Choose two.)

Accepted Answer

Consul's DNS interface includes only instances that have a passing health check when using the default query.. Consul's DNS interface automatically filters service instances based on health check status. By default, only instances with passing health checks are returned in DNS queries. This ensures that clients using DNS for discovery only receive IP addresses of healthy instances. No additional parameters or manual actions are required to achieve this behavior.

Answer

Health checks must be manually triggered via the API before DNS results are updated.

Answer

The 'onlyhealthy' parameter can be added to the DNS query to exclude unhealthy instances.

Answer

The 'passing' parameter in a DNS query filters results to only healthy instances.

Question 9

A developer registers a web service with the Consul catalog using the HTTP API. The service definition includes a TCP check on port 8080. The service process is running and listening on port 8080, but the service appears as critical in the Consul UI. Which command will provide the most immediate insight into why the health check is failing?

Accepted Answer

consul health checks -service=<service-name>. The 'consul health checks' command with the '-service' flag queries the health endpoint for a specific service and returns detailed information about each check, including status and output. This allows you to see the exact error message from the failing TCP check, such as connection refused or timeout. Other commands either list services without health details or are not valid Consul commands.

Answer

consul catalog services

Answer

consul services status

Answer

consul health checks <service-name>

Question 10

A Consul operator needs to deregister a service instance `web-01` from the catalog immediately after the service process stops. The service is registered with a TTL health check. Which configuration should the operator use to ensure the service is removed promptly when the process terminates?

Accepted Answer

Set the `DeregisterCriticalServiceAfter` field in the health check definition.. To ensure a service is removed from the catalog after its process stops, the `DeregisterCriticalServiceAfter` field should be set in the health check definition. When the TTL check fails and becomes critical, Consul waits for the specified duration and then automatically deregisters the service. This is the correct mechanism for prompt cleanup of terminated services.

Answer

Use the `?passing` parameter in DNS queries for the service.

Answer

Enable the `enable_tag_override` option in the service definition.

Answer

Configure the service with a `"status": "critical"` field.

Question 11

A Consul operator needs to register a service that is only accessible via a Unix domain socket on the same host. The service does not listen on any TCP port. Which Consul service definition field should be used to specify the socket path for health checking?

Accepted Answer

socket. Consul supports Unix domain socket health checks via the 'socket' block in a check definition. This block includes the 'path' field to specify the socket file. It is designed for services that communicate over Unix sockets rather than TCP. The other options are either invalid fields or represent different concepts, such as network address or non-existent configuration keys.

Answer

socket_path

Answer

address

Answer

unix_socket

Question 12

A developer needs to retrieve the IP address and port of all healthy instances of the 'web' service using Consul's DNS interface. The Consul DNS server is listening on the default port. Which of the following DNS queries will return only the healthy instances?

Accepted Answer

dig @127.0.0.1 -p 8600 web.service.consul SRV. Consul's DNS interface supports SRV records for services, which include both the hostname (or IP) and the port. By default, only healthy instances are returned. A records provide only IP addresses, and ANY and CNAME queries are not supported or do not return the needed information. The SRV query is the correct method to get both IP and port for healthy instances.

Answer

dig @127.0.0.1 -p 8600 web.service.consul ANY

Answer

dig @127.0.0.1 -p 8600 web.service.consul CNAME

Answer

dig @127.0.0.1 -p 8600 web.service.consul A

Question 13

A platform team runs a Consul cluster with two datacenters, dc1 and dc2, joined via WAN gossip. A service named 'payments' is registered only in dc2. An operator in dc1 queries the DNS interface with 'dig payments.service.consul' and receives NXDOMAIN. The operator wants the same query to return the healthy instances from dc2 without changing the service name. Which query should the operator use?

Accepted Answer

dig payments.service.dc2.consul. Consul's DNS interface encodes the target datacenter as a label immediately before the consul zone, so resolving a service that exists only in dc2 from a dc1 agent requires the fully qualified name payments.service.dc2.consul. Because the datacenters share WAN gossip, the local agent can forward the query and return healthy dc2 instances, satisfying the operator's goal without renaming the service.

Answer

dig payments.service.consul?dc=dc2

Answer

dig payments.service.consul -t SRV dc2

Answer

dig payments.service.consul.dc2

Question 14

A service is registered in Consul with an HTTP health check that returns a 500 status code. The service itself is functioning correctly, but the check is failing. Which Consul CLI command will show the output of the health check, including the HTTP status code?

Accepted Answer

consul health checks -service=web. The 'consul health checks' command with the '-service' flag queries the health endpoint for a specific service and returns detailed information about each check, including status and output. For an HTTP check, the output field often contains the HTTP status code and any error message. This is the most direct way to diagnose why the check is failing.

Answer

consul monitor -service=web

Answer

consul services list

Answer

consul catalog nodes -service=web

Question 15

A Consul administrator is configuring a new service registration using the HTTP API. The service must be discoverable via DNS and must include metadata about its environment and version. Which TWO of the following fields should be included in the service definition to meet these requirements? (Choose two.)

Accepted Answer

Name. To register a service with metadata about environment and version, the service definition must include the 'Name' field for discoverability and the 'Meta' field for key-value metadata. The 'Name' is mandatory for any service, while 'Meta' allows storing arbitrary information. Other fields like 'Tags' or 'Port' serve different purposes and do not fulfill the metadata requirement.

Answer

Check

Answer