Consul 1.15 Service Discovery Practice Test 5 — 15 Questions

Question 1

Which TWO of the following actions occur when a node fails in a Consul cluster?

Accepted Answer

All services on the node are marked critical.. Option A is correct because when a Consul node fails, its health checks stop passing and Consul marks all services registered on that node as critical, reflecting their unhealthy state in the catalog. Option D is correct because Consul's DNS interface only returns healthy service instances by default, so services on the failed node are removed from DNS results until the node recovers. Option B is incorrect because a failed node is not immediately deleted; it remains in the catalog and is only removed after being marked as failed or explicitly deregistered. Option C is incorrect because Consul does not reboot nodes; it only detects and reports failures. Option E is incorrect because Consul is a distributed, fault-tolerant system and a single node failure does not shut down the entire cluster.

Answer

The node is immediately deleted from the cluster.

Answer

The node is automatically rebooted.

Answer

The entire cluster shuts down.

Question 2

Which THREE of the following are valid ways to categorize services in Consul?

Accepted Answer

Metadata (meta). Consul supports categorizing services by metadata (meta), which are arbitrary key/value pairs attached to a service registration and can be used to filter services via the catalog API (e.g., ?filter=ServiceMeta.Key==value). Namespaces are a Consul Enterprise feature that logically partitions services and other resources within a single datacenter, so services are effectively categorized by namespace. Tags are string labels attached to a service (and optionally to individual checks) that can be used to filter and query services, such as with the /v1/catalog/service/:name?tag=... endpoint. IP subnets (A) are not a Consul service categorization mechanism; Consul does not group services by subnet. Port ranges (E) are likewise not a categorization feature, since a service's port is just a registration attribute and Consul provides no grouping or filtering by port range.

Answer

IP subnets

Answer

Port ranges

Question 3

Which TWO of the following statements are true about the 'passing' parameter in DNS queries?

Accepted Answer

It returns only services with passing health checks.. Option B is correct because the 'passing' parameter filters DNS query results so that only service instances whose health checks are currently passing are returned, which is essential for service discovery in tools like Consul. Option E is correct because 'passing' is appended as a query string parameter in the DNS query URL, for example when querying a service name with ?passing to restrict results to healthy instances. Option A is incorrect because the 'passing' parameter does not require manual service registration; services are registered through the service registry or API, not through this query parameter. Option C is incorrect because 'passing' is a query-time filter and has no effect on restarting the DNS server. Option D is incorrect because 'passing' is a per-query parameter, not a permanent configuration setting.

Answer

It requires manual service registration.

Answer

It forces the DNS server to restart.

Answer

It is a permanent configuration setting.

Question 4

Which THREE of the following are benefits of using the Consul DNS interface?

Accepted Answer

No application code changes required.. Ease of use, platform-agnostic, and no application changes are benefits.

Answer

Provides advanced traffic shifting.

Answer

Encrypts all traffic between services.

Question 5

A DevOps engineer is configuring a Consul service `payment-processor` that must be discoverable only when its health check is passing. The service is registered with a script health check that runs every 10 seconds. The engineer wants to ensure that DNS queries for `payment-processor` return only healthy instances. Which two actions should the engineer take? (Choose two.)

Accepted Answer

Include the `passing` parameter in the DNS query.. To ensure DNS queries return only healthy instances of `payment-processor`, the service must have an associated health check, and the DNS query must include the `passing` parameter. The health check association allows Consul to track the service's health, while the `passing` parameter filters results to only passing instances. Together, these actions guarantee that only healthy instances are discoverable via DNS.

Answer

Use the `?near` parameter in the DNS query to prioritize local instances.

Answer

Set the `"status": "passing"` field in the service registration.

Answer

Configure the service with `"enable_tag_override": true`.

Question 6

A service is registered with Consul using the HTTP API, but it is not appearing in DNS queries. The service definition includes a health check that is currently critical. What is the most likely reason for the DNS query failure?

Accepted Answer

The service's health check is critical, so Consul excludes it from DNS results.. Consul DNS returns only healthy service instances. When a service's health check is critical, the service is considered unhealthy and is excluded from DNS responses. Even though the service is registered and visible in the catalog, it will not resolve via DNS until the health check passes. This behavior ensures that clients only receive addresses of healthy instances, which is a core principle of service discovery in Consul.

Answer

The service is registered in a different datacenter than the DNS query.

Answer

The service name contains uppercase letters, which are not allowed in DNS queries.

Answer

The DNS interface is disabled by default and must be enabled in the agent configuration.

Question 7

A Consul cluster spans multiple datacenters. A service `user-auth` is registered in both `dc1` and `dc2`. A client in `dc1` queries the DNS interface for `user-auth.service.consul`. By default, which instances will be returned?

Accepted Answer

Only instances from `dc1`.. By default, Consul DNS queries are limited to the local datacenter of the agent that receives the query. A client in `dc1` querying `user-auth.service.consul` will only get instances from `dc1`. To discover instances in other datacenters, the query must explicitly include the datacenter, such as `user-auth.service.dc2.consul`. This design promotes locality and avoids unintended cross-datacenter traffic.

Answer

Only instances from `dc2` if `dc1` has no healthy instances.

Answer

Instances from both `dc1` and `dc2`, load-balanced.

Answer

Instances from all datacenters, sorted by latency.

Question 8

A Consul operator is using the HTTP API to register a web service with an external health check script. The operator wants to ensure that if the service process fails but the node remains up, the service is marked unhealthy and removed from DNS query results. Which of the following API endpoints should the operator use to register the service and its check together?

Accepted Answer

PUT /v1/agent/service/register. The agent service register endpoint accepts a JSON payload that can include both the service definition and an associated check. This allows the agent to manage the check and update the service's health status. When the external script fails, the check becomes critical, and the service is excluded from DNS results. Other endpoints either register checks separately or bypass the agent's health monitoring.

Answer

PUT /v1/agent/service/deregister

Answer

PUT /v1/catalog/register

Answer

PUT /v1/agent/check/register

Question 9

A Consul operator is troubleshooting a service that intermittently disappears from the catalog. The service is registered with a TTL health check that is updated every 30 seconds by a script. The operator notices that the service is marked as critical and then deregistered. Which configuration change should the operator make to prevent the service from being deregistered?

Accepted Answer

Increase the `deregister_critical_service_after` value in the agent configuration. The `deregister_critical_service_after` setting defines the duration a service can remain critical before automatic deregistration. Increasing this value allows more time for the service to recover from transient failures. The other options either mask the problem or remove health monitoring, which is not advisable.

Answer

Set the `status` field of the service to `passing` in the service definition

Answer

Disable the health check by removing the `check` block from the service definition

Answer

Change the health check to a script check that runs every 30 seconds

Question 10

A DevOps engineer needs to register an external service that runs outside the Consul datacenter, such as a third-party API. The service has a static IP address and a known port. Which Consul feature should be used to make this service discoverable within Consul?

Accepted Answer

Consul's external service registration with a static address. To register an external service in Consul, you can use the service registration API or configuration files to define a service with a static address and port. Consul treats it as a regular service in the catalog, and it can be discovered via DNS or HTTP API. This is the correct approach for integrating external endpoints into Consul's service discovery.

Answer

Consul's intention-based access control

Answer

Consul's prepared queries with failover

Answer

Service mesh with sidecar proxies

Question 11

A Consul operator observes that a web service registered on two nodes is only reachable through the DNS interface on one node. The service definition on both nodes is identical, including the same service name and port. What is the most likely cause?

Accepted Answer

The service on the unreachable node is failing its health check, so it is excluded from DNS results.. Consul's DNS interface only returns service instances that are passing their health checks. When two identical service definitions exist but only one appears in DNS results, the most probable cause is that the other instance is failing its health check. The operator should inspect the health check status for that service instance using the Consul UI or the /health/service API endpoint.

Answer

The node that is not returning results has not been configured with the correct datacenter.

Answer

The service definition is missing the 'tags' field, causing the DNS query to return only one instance.

Answer

The DNS interface requires the 'passing' parameter to be set to true to return all instances.

Question 12

An operator wants to query the Consul catalog for all nodes that provide a service named `api` in the `us-east` datacenter. They need to retrieve the node names and addresses. Which Consul HTTP API endpoint should they use?

Accepted Answer

`GET /v1/catalog/service/api?dc=us-east`. The `/v1/catalog/service/:service` endpoint is designed to return all nodes and service instances for a specific service, optionally filtered by datacenter using the `dc` parameter. The health endpoint is more focused on health status, while the nodes endpoint lists all nodes. The agent services endpoint is local only.

Answer

`GET /v1/agent/services`

Answer

`GET /v1/catalog/nodes?dc=us-east`

Answer

`GET /v1/health/service/api?dc=us-east`

Question 13

A developer needs to register a service named 'api' with Consul and ensure that it is only discoverable by consumers that explicitly request the 'v2' tag. Which Consul feature should be used?

Accepted Answer

Service tags. Service tags are the correct mechanism to allow consumers to filter service instances by a specific label such as 'v2'. By registering the service with the tag 'v2', the developer enables discovery queries that include that tag to return only the desired instances. This is a common pattern for versioned services or canary deployments.

Answer

ACLs

Answer

Health checks

Answer

Service meta

Question 14

A developer runs `dig @127.0.0.1 -p 8600 web.service.consul SRV` and receives no records, even though `consul catalog services` lists `web` and `consul members` shows the node as alive. A health check for the `web` service is registered and currently shows a critical status. What is the most likely cause of the empty SRV response?

Accepted Answer

The Consul DNS interface only returns records for services that have at least one passing health check.. Consul's DNS interface only returns records for service instances that have at least one passing health check. When the `web` service check is critical, Consul considers the instance unhealthy and omits it from DNS responses. This behavior ensures that clients only discover healthy endpoints, which is a core feature of Consul's service discovery.

Answer

The DNS query must use the `ANY` type to return SRV records for services with critical checks.

Answer

The SRV record requires a `tcp` prefix in the query, such as `_tcp.web.service.consul`.

Answer

The `web` service is registered in a different datacenter, so the local DNS server cannot resolve it.

Question 15

An operator registers a service with a TTL health check. The service is responsible for updating the check status via the HTTP API. The service fails to send updates for 90 seconds. The check is configured with 'DeregisterCriticalServiceAfter' set to 10 minutes. What is the current health status of the service, and what will happen after 10 minutes?

Accepted Answer

The service is critical; it will be deregistered after 10 minutes.. TTL health checks require periodic updates from the service. If no update is received within the TTL period, the check becomes critical. The 'DeregisterCriticalServiceAfter' field, when set, schedules deregistration of the service instance after the check has been critical for the specified duration. In this case, after 90 seconds the check is critical, and after 10 minutes of being critical, the service is deregistered.

Answer

The service is passing; it will be deregistered after 10 minutes.

Answer

The service is warning; it will be deregistered after 10 minutes.

Answer

The service is critical; it will be deregistered immediately.