Consul 1.15 Service Mesh With Consul Connect — 25 Questions

Question 1

A service 'api' is configured with mTLS. You want to rotate the CA root certificate without interrupting existing connections. What is the recommended strategy?

Accepted Answer

Update the CA configuration to include the new root in the 'additional_roots' field.. Consul supports a 'prepared_ca' rotation where the new CA is added to the trust bundle before the old one is removed.

Answer

Disable mTLS globally, update, and re-enable.

Answer

Delete the existing CA and restart all agents.

Answer

Use the 'consul tls ca create' command with the --rotate flag.

Question 2

You are troubleshooting a connection error where the sidecar proxy cannot reach the upstream service. Which log file provides the most detail regarding Envoy's connectivity issues?

Accepted Answer

Envoy access log. The Envoy access log is the correct answer because it records detailed information about each request and connection handled by the sidecar proxy, including upstream connection failures, response codes, and timing. When a sidecar proxy cannot reach an upstream service, the Envoy access log captures the specific error (e.g., 'upstream connect error or disconnect/reset before headers') and the upstream cluster name, making it the most detailed source for diagnosing Envoy connectivity issues.

Answer

System syslog

Answer

Consul server audit log

Answer

Consul agent log

Question 3

You are configuring a sidecar proxy for a service named 'web'. Which configuration stanza in the service definition correctly defines the proxy's inbound port for Connect traffic?

Accepted Answer

proxy { local_bind_port = 8080 }. In a Consul service definition, the proxy stanza configures the sidecar's behavior, and 'local_bind_port' sets the port on which the sidecar listens for inbound Connect traffic destined for the local service. This is the correct field for defining the proxy's inbound listener port.

Answer

sidecar { port = 8080 }

Answer

config { inbound_port = 8080 }

Answer

service { connect { port = 8080 } }

Question 4

When using Consul intentions, what is the default behavior if no intention is found for a service pair?

Accepted Answer

Explicit Allow.. By default, Consul operates on a 'deny all' or 'allow all' basis depending on configuration, but in a standard Connect deployment, the default is 'allow' unless intention enforcement is enabled.

Answer

Explicit Deny.

Answer

The request is buffered.

Answer

The connection is rejected by the agent.

Question 5

Which protocol is used for the control plane communication between the Consul agent and the sidecar proxy?

Accepted Answer

gRPC. Consul Connect uses gRPC for control plane communication between the Consul agent and the sidecar proxy (Envoy). The agent configures the proxy via gRPC using the Envoy xDS API, which is the standard protocol for dynamic proxy configuration. This allows Consul to push updates about service discovery, intentions, and certificates to the proxy in real-time.

Answer

Consul RPC

Answer

REST

Answer

HTTP/1.1

Question 6

Which service definition field is used to link a sidecar proxy to its parent service?

Accepted Answer

destination_service_name. In Consul service definitions, the sidecar proxy is registered as a separate service that must reference its parent application service. The `destination_service_name` field inside the proxy's `connect` block (or the `proxy.destination_service_name` in the service registration) tells Consul which upstream service this sidecar is fronting, allowing the proxy to be associated with the correct service identity and intentions.

Answer

parent_service

Answer

service_id

Answer

linked_service

Question 7

What happens if a service proxy loses its connection to the local Consul agent?

Accepted Answer

The proxy enters a 'stale' state and uses the last known config.. When a service proxy loses its connection to the local Consul agent, it enters a 'stale' state and continues using the last known configuration. This design ensures that the proxy can still route traffic and enforce intentions based on cached data, maintaining service availability even if the agent becomes temporarily unreachable. The proxy does not shut down or switch to a local health-check mode; it simply operates on stale data until the connection is restored.

Answer

The proxy shuts down automatically.

Answer

The proxy automatically switches to a local health-check mode.

Answer

The proxy attempts to connect to a random Consul server.

Question 8

Which CLI command would you use to check the status of a Connect-enabled service?

Accepted Answer

consul health service <name>. The 'consul catalog services' or 'consul health service' command shows the status, including Connect capabilities.

Answer

consul status

Answer

consul connect status

Answer

consul proxy check

Question 9

How do you enable mTLS globally in a Consul datacenter?

Accepted Answer

Set 'connect { enabled = true }' in the agent configuration.. To enable mTLS globally in a Consul datacenter, you set 'connect { enabled = true }' in the agent configuration on all agents (servers and clients). This enables Consul Connect, which automatically provisions and rotates certificates for service-to-service mTLS. There is no single global command; it is a configuration setting applied per agent.

Answer

Run 'consul tls enable'.

Answer

consul config write -enable-mtls

Answer

There is no global enable setting.

Question 10

Which TWO of the following are true regarding intentions?

Accepted Answer

They determine allowed service-to-service communication.. Option C is correct because intentions in Cisco ACI define the policy that governs which endpoints (for example, EPGs or services) are permitted to communicate with each other, effectively determining allowed service-to-service communication. Option E is correct because intentions can be created, read, updated, and deleted through the CLI (as well as the GUI and API), making them manageable from the command line. Option A is incorrect because intentions are not automatically synchronized to all datacenters; they are scoped to the fabric or cluster where they are defined. Option B is incorrect because intentions operate at the application/policy layer rather than the transport layer. Option D is incorrect because intentions do not require a separate database; they are stored within the existing controller or fabric data store.

Answer

They are automatically synced to all datacenters.

Answer

They operate at the transport layer.

Answer

They require a separate database.

Question 11

Which THREE of the following are supported as sidecar proxy types in Consul?

Accepted Answer

HAProxy. Consul's Connect service mesh supports three built-in sidecar proxy integrations: Envoy (B), HAProxy (A), and NGINX (D). Envoy (B) is the default and most fully featured proxy, offering L7 features like intentions, observability, and mTLS termination. HAProxy (A) is supported as a sidecar proxy for Connect, providing L4 proxying with mTLS for service-to-service communication. NGINX (D) is also supported as a Connect sidecar proxy, enabling mTLS and integration with Consul's service mesh. Caddy (C) and Traefik (E) are popular reverse proxies but are not supported as Consul Connect sidecar proxy types, so they do not belong in this list.

Answer

Caddy

Answer

Traefik

Question 12

Which THREE tasks are performed by the Consul agent for Connect?

Accepted Answer

Managing sidecar proxy processes.. The agent manages proxy lifecycle, certificate retrieval, and service discovery for the mesh.

Answer

Writing configuration to the disk.

Answer

Issuing certificates.

Question 13

Which THREE items are required to configure an upstream service?

Accepted Answer

Destination service name.. To configure an upstream service, you must specify the destination service name (A), which identifies the backend service that traffic will be routed to, and the local bind port (B), which defines the port on the local proxy that listens for incoming connections. You must also specify the protocol type (D), such as HTTP or TCP, so the proxy knows how to handle and forward the traffic correctly. A hardcoded IP address (C) is not required because upstream services are typically resolved via service discovery or DNS rather than fixed IPs. A service description (E) is optional metadata and is not needed for the functional configuration of an upstream service.

Answer

Hardcoded IP address.

Answer

Service description.

Question 14

Which THREE settings are part of the 'proxy' configuration block?

Accepted Answer

upstreams. In the Vault Agent / Consul Template style 'proxy' configuration block, the correct settings include A 'upstreams', which defines the list of upstream services the proxy should expose and manage for local connections; C 'local_bind_port', which specifies the port on which the proxy listens locally for incoming connections; and D 'config', which supplies the nested proxy-specific configuration (for example, the protocol or listener settings) used by the proxy. These three are all valid keys within the proxy block and control how the local proxy behaves. By contrast, B 'acl_token' is an authentication credential typically configured at the top level or in an auth/token context, not as a proxy block setting, and E 'service_name' is not a recognized proxy block field for identifying the proxy in this configuration schema.

Answer

acl_token

Answer

service_name

Question 15

You are running Consul 1.15 with Connect enabled. A developer wants to allow the 'web' service to reach the 'api' service over the mesh, but only when 'web' presents a client certificate signed by a specific intermediate CA. Which Consul intention configuration achieves this?

Accepted Answer

Create an intention from 'web' to 'api' with action 'allow' and configure a JWT or mTLS requirement with a source of the intermediate CA.. Consul intentions can match traffic based on the client certificate's identity when using mTLS. Specifying the intermediate CA as the source in an intention restricts access to only those services whose certificates are issued by that CA. This provides fine-grained, certificate-aware authorization for service-to-service communication within the mesh.

Answer

Create an intention from 'web' to 'api' with action 'allow' and set a source namespace of 'default'.

Answer

Create an intention from 'web' to 'api' with action 'allow' and specify a source partition.

Answer

Create an intention from 'web' to 'api' with action 'allow' and set the 'SourceType' to 'consul' with a 'SourceName' of the intermediate CA.

Question 16

You have a Consul datacenter with Connect enabled. A service 'frontend' needs to communicate with 'backend' over the mesh. You notice that traffic is not being encrypted even though mTLS is enabled globally. Which of the following is the most likely cause?

Accepted Answer

The 'frontend' service is not configured to use a sidecar proxy, so it connects directly without mTLS.. mTLS in Consul Connect is enforced by the sidecar proxies. For traffic to be encrypted, both the source and destination services must route through their proxies. If a service is not using a proxy, its traffic does not traverse the mesh and remains unencrypted. Therefore, the most likely cause is that 'frontend' is not configured with a sidecar proxy, so its connections to 'backend' are direct and not secured by mTLS.

Answer

The 'backend' service is not registered with a Connect-enabled service definition.

Answer

The CA root certificate has expired, causing mTLS to fall back to plaintext.

Answer

The intention between 'frontend' and 'backend' is set to 'allow', which disables encryption.

Question 17

A platform team is running Consul 1.15 with Connect enabled across two datacenters. They need to allow a service named 'payments' in datacenter 'dc1' to communicate with a service named 'ledger' in datacenter 'dc2' over the mesh, while denying all other cross-datacenter traffic to 'ledger'. Which two configuration elements are required to achieve this? (Choose two.)

Accepted Answer

Enable Connect on both datacenters and ensure that the Consul servers in dc1 and dc2 are federated.. To allow cross-datacenter traffic, you must enable Connect and federate the datacenters, then create an intention in the source datacenter that permits the specific service pair. The intention is evaluated where the source service is registered, so it must be in dc1 with source 'payments' and destination 'ledger'. Mesh gateways are also needed for the data plane, but the question asks for configuration elements; federation and the intention are the essential control plane requirements.

Answer

Configure a mesh gateway in each datacenter and set the 'connect' block for both services to use the mesh gateway mode 'local'.

Answer

Define an intention in dc2 with source 'payments' and destination 'ledger', and set the action to allow.

Answer

Create a service-resolver configuration that maps 'ledger' to a specific subset in dc2 and set the default subset to 'v1'.

Question 18

You are deploying a new service 'payments' in a Consul 1.15 datacenter. Security policy requires that all service-to-service communication be encrypted with mTLS and authenticated via intentions. You have already registered the service and its sidecar proxy. What must you do next to enforce mTLS for this service's inbound connections?

Accepted Answer

Enable Connect in the service definition with 'connect { sidecar_service {} }' and ensure intentions allow the traffic.. To enforce mTLS for a service's inbound connections, the service must be registered with Connect and have a sidecar proxy. This is done by including a 'connect' block with 'sidecar_service {}' in the service definition. Consul then automatically provisions mTLS certificates and enforces intentions. Other options either affect agent-level TLS or routing, not service mesh mTLS.

Answer

Configure the service's upstreams to use 'mesh_gateway' mode to force mTLS.

Answer

Create a service intention that explicitly allows traffic from all sources, which automatically enables mTLS.

Answer

Set 'verify_incoming = true' in the Consul agent configuration on the node where the service runs.

Question 19

A security engineer needs to permit traffic from any service in the 'frontend' namespace to 'backend' services in the 'default' namespace, while denying all other cross-namespace traffic. Consul 1.15 Enterprise is in use with admin partitions and namespaces enabled. Which intention configuration accomplishes this with the least administrative overhead?

Accepted Answer

Create an intention with source '*' in the 'frontend' namespace and destination 'backend' in the 'default' namespace, action allow.. In Consul Enterprise, intentions are namespace-aware. A single allow intention whose source is the wildcard service in the 'frontend' namespace and whose destination is 'backend' in the 'default' namespace permits all frontend services to reach backend. Other namespaces have no matching intention and therefore remain denied under the default-deny model, minimizing administrative effort.

Answer

Create a service-resolver configuration that maps 'frontend' to 'backend' and set the default subset to allow.

Answer

Create an intention with source 'frontend/*' and destination 'default/backend', action allow.

Answer

Enable the built-in 'allow-namespace' ACL policy on the default namespace and attach it to the frontend token.

Question 20

A platform team runs Consul 1.15 with Connect enabled. They want every service in the datacenter to enforce mutual TLS automatically, without adding 'connect' blocks to each service definition. Which configuration should they apply?

Accepted Answer

Set 'enable_central_service_config = true' in the agent configuration, then run 'consul config write' with a service-defaults entry containing 'Mesh: true'.. Centralized service configuration lets operators define default Connect behavior once and have it applied to all services in the datacenter. Enabling the agent option and writing a service-defaults entry with Mesh set to true causes agents to inject sidecars and enforce mTLS without per-service connect blocks. Intention changes and auto-encrypt affect authorization or agent RPC security, not mesh enrollment.

Answer

Enable 'auto_encrypt' on all client agents and set 'verify_outgoing = true'.

Answer

Create a global intention with action 'allow' for every service pair.

Answer

Set 'connect.enabled = true' in the agent configuration on every client agent.