Consul 1.15 Service Discovery Practice Test 3 — 15 Questions

Question 1

A developer has two versions of the payments service registered in Consul: payments-v1 and payments-v2, both with the tag 'production'. They need to query only the v2 instances using the DNS interface. Which DNS query format should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

payments-v2.service.consul. Consul DNS resolves service names directly. Because the two versions are registered as distinct services (payments-v1 and payments-v2), querying the specific service name 'payments-v2.service.consul' returns only the v2 instances. Using tags would require the tag to be present, and the scenario does not indicate a 'v2' tag exists. The other formats are not valid Consul DNS query patterns.

Answer

payments.service.consul.production

Answer

payments.service.consul?tag=v2

Answer

v2.payments.service.consul

Question 2

A service named 'inventory' is registered on three nodes in dc1 with tags 'v1' and 'primary'. An operator wants DNS queries for inventory.service.consul to return only instances that carry both tags, not instances with just one. Which query accomplishes this?

Accepted Answer

dig v1.primary.inventory.service.consul. Consul encodes tag filters as dot-separated labels preceding the service name, and multiple labels are combined with AND semantics. Querying v1.primary.inventory.service.consul returns only instances that carry both tags, which is exactly what the operator needs. Parameters and dig flags cannot express this filter because the DNS interface only interprets the query name.

Answer

dig inventory.service.consul -t SRV --tags v1,primary

Answer

dig v1.inventory.service.consul

Answer

dig inventory.service.consul?tag=v1&tag=primary

Question 3

A service is registered with Consul using the HTTP API. The service definition includes a health check with an HTTP endpoint. After registration, the service does not appear in DNS queries for healthy instances. Which command should you use to immediately see the health check status and understand why the service is not being returned?

Accepted Answer

consul health service <service-name>. The 'consul health service' command provides detailed health information for a specific service, including each instance's health check status and output. This allows you to see the exact reason for failure, such as an HTTP status code or connection error. Other commands like 'consul catalog services' or 'consul members' do not offer this level of detail. 'consul services list' gives a summary but not the check output. Therefore, 'consul health service' is the most immediate and informative tool.

Answer

consul catalog services

Answer

consul services list

Answer

consul members

Question 4

A platform team runs Consul 1.15 with a single datacenter. They register a new service 'payment-api' using the HTTP API and specify a health check with HTTP endpoint 'http://10.0.1.5:8080/health' and interval '10s'. The service is registered, but the Consul UI shows the service as 'critical'. The check script returns HTTP 200 with a JSON body '{"status":"ok"}'. What is the most likely cause of the critical status?

Accepted Answer

The HTTP check expects a response body of 'OK' or a 2xx status code; the JSON body is ignored.. Consul's HTTP health check marks the service as passing if the HTTP response code is 2xx. The body is irrelevant. In this scenario, the endpoint returns 200, so the check should pass. The critical status indicates a failure to connect or a non-2xx response. The most likely cause is that the Consul agent cannot reach the IP address or port, perhaps due to network segmentation or the service not listening on that interface. The other options are incorrect because they either misstate Consul's behavior or introduce non-existent constraints.

Answer

The check interval is too short; Consul requires a minimum interval of 30s for HTTP checks.

Answer

The Consul agent cannot reach the IP address 10.0.1.5 on port 8080 from its network location.

Answer

The service is not registered with a unique service ID, so Consul cannot associate the check.

Question 5

A DevOps engineer is configuring a Consul service registration for a legacy application that cannot expose an HTTP endpoint. The engineer needs to ensure that the service is automatically deregistered if the node fails. Which two of the following approaches will achieve this? (Choose two.)

Accepted Answer

Use a TTL health check and have the application periodically update the check via the HTTP API.. To automatically deregister a service when the node fails, the engineer can use a TTL health check and set 'DeregisterCriticalServiceAfter' on that check. The TTL check requires periodic updates; if they stop, the check becomes critical, and after the specified duration, Consul deregisters the service. Alternatively, any check type combined with 'DeregisterCriticalServiceAfter' will work, but the TTL check is suitable for legacy apps that can send heartbeats. The other options do not provide automatic deregistration.

Answer

Configure the service with 'enable_tag_override' set to true.

Answer

Use a TCP health check on a port that the application listens on.

Answer

Use a script health check that runs a command to test the application's process.

Question 6

A Consul cluster is experiencing intermittent service discovery failures. An operator notices that some service instances are intermittently missing from DNS query results, but they appear as healthy in the Consul UI. Which configuration parameter should be adjusted to ensure consistent DNS results?

Accepted Answer

DNS TTL. Intermittent missing service instances in DNS results, despite healthy status in the UI, are often caused by DNS caching. The DNS TTL parameter determines how long clients cache DNS responses. If set too high, clients may hold onto stale data, missing updates. Lowering the TTL ensures clients re-query more frequently, improving consistency. Other parameters like service weights or health check intervals do not address caching issues.

Answer

Health check interval

Answer

Service weights

Answer

ACL token

Question 7

A service 'database' is registered with Consul and has a health check that is currently in the 'warning' state. A client queries the DNS interface for 'database.service.consul'. What will be the result?

Accepted Answer

The DNS query returns no results because the health check is not 'passing'.. By default, Consul's DNS interface only returns service instances that are in the 'passing' health state. A health check in 'warning' state is not considered passing, so the instance is excluded from DNS query results. This ensures that clients only discover fully healthy services. To include warning instances, the query must explicitly request them by setting the 'passing' parameter to false.

Answer

The DNS query returns the instance but with a different port number to indicate the warning state.

Answer

The DNS query returns the instance but with a TTL of 0 to indicate the warning state.

Answer

The DNS query returns the service instance because 'warning' is considered healthy.

Question 8

A service named 'auth' is registered with a health check that is currently critical. A developer queries auth.service.consul via DNS and receives no healthy endpoints. Which Consul behavior explains why the unhealthy instance is excluded from DNS results?

Accepted Answer

Consul DNS returns only instances that pass all associated health checks by default.. The Consul DNS interface is health-aware. For a standard service query, it returns only instances whose checks are passing. A critical service check marks the instance unhealthy, so it is omitted from auth.service.consul responses. This prevents clients from discovering and connecting to failing endpoints, which is a core benefit of Consul service discovery.

Answer

Consul DNS excludes instances only when the check is warning, not critical.

Answer

Consul DNS returns all registered instances regardless of health status.

Answer

Consul DNS excludes instances when the node's serfHealth check is critical, but not service checks.

Question 9

A developer needs to discover the 'catalog' service using the Consul DNS interface. The service is registered with the tag 'v2'. Which two DNS query formats correctly return only instances tagged 'v2'? (Choose two.)

Accepted Answer

v2.catalog.service.consul SRV. Consul DNS encodes tag filtering in the name itself. The tag becomes the leftmost label, followed by the service name and the service.consul domain. Both an A-style query and an SRV-style query using v2.catalog.service.consul correctly restrict results to instances tagged v2. Query parameters and alternative label orders are not supported and will not return the desired subset.

Answer

catalog.v2.service.consul

Answer

catalog.service.consul?tag=v2

Answer

tag.v2.catalog.service.consul

Question 10

An operator wants to see all services currently registered on the local Consul agent. Which command provides this information directly from the agent?

Accepted Answer

consul agent services. The consul agent services command inspects the local agent and returns every service registered on it, including IDs, names, tags, and check status. This differs from catalog queries, which span the datacenter. For quickly verifying what a specific agent is running, the agent-scoped command is the most direct and accurate choice.

Answer

consul catalog services

Answer

consul services list

Answer

consul members -services

Question 11

You have a service that requires specific routing logic based on the environment. How can you distinguish between 'production' and 'staging' instances of the same service name using metadata?

Accepted Answer

Apply 'production' or 'staging' tags to the service definition.. Consul tags are arbitrary key-value-like labels attached to a service registration and are the standard mechanism for distinguishing instances of the same service across environments. By registering production instances with the tag 'production' and staging instances with 'staging', you can use service discovery queries (e.g., via DNS SRV or the HTTP API with tag filters) to route traffic to the correct environment. This preserves a single service name while enabling environment-aware routing.

Answer

Use different service names for every environment.

Answer

Modify the service's port number.

Answer

Assign different Consul datacenters.

Question 12

An administrator needs to query service information. Which DNS record type is commonly used by Consul to return service addresses?

Accepted Answer

SRV. Consul's DNS interface primarily uses SRV records to return service addresses because SRV records include both the hostname and the port number of the service instances. This allows clients to discover not just the IP address but also the port on which the service is listening, which is essential for dynamic service discovery. While A records can return IP addresses, they lack port information, making SRV the preferred record type for querying service information in Consul.

Answer

TXT

Answer

MX

Answer

CNAME

Question 13

A service is intermittently failing to resolve via DNS because it has multiple health checks, some of which are 'warning'. How do you ensure it is only returned when all checks are 'passing'?

Accepted Answer

Use the 'passing' query parameter in the DNS request.. Consul DNS supports a 'passing' query parameter that filters results to only those service instances whose health checks are all passing — warning and critical instances are excluded. Appending ?passing to the DNS query (e.g., 'dig @127.0.0.1 web.service.consul SRV?passing') ensures the service is returned only when every check is green. This is the standard mechanism for strict health-based DNS filtering.

Answer

Configure 'service_prefix' in DNS settings.

Answer

Use the 'stale' query parameter.

Answer

Set 'enable_tag_override' to true.

Question 14

What is the purpose of the 'service-tag' in a Consul service definition?

Accepted Answer

To provide additional categorization or versioning for services.. Service tags in Consul are arbitrary string labels attached to a service registration that enable additional categorization, versioning, and filtering. They are commonly used with DNS queries (e.g., tag.service.consul) and in prepared queries or Connect intentions to select subsets of service instances. Tags do not affect the service's network location, DNS priority, or encryption.

Answer

To define the physical location of the server.

Answer

To set the priority of the service in DNS.

Answer

To encrypt communication between services.

Question 15

When using Consul DNS for a service, what happens if no instances are healthy?

Accepted Answer

It returns an empty response (NXDOMAIN or empty set).. Consul DNS returns only healthy service instances. If no instances are healthy, the query returns an empty response — typically NXDOMAIN for the service name or an empty answer set — rather than an error or unhealthy instances. This signals to clients that no healthy backend is available.

Answer

It returns a 500 error.

Answer

It redirects to a standby service.

Answer

It returns all instances regardless of health.