Consul 1.15 Service Mesh With Consul Connect — All Questions With Answers

Question 1hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

A service 'api' is configured with mTLS. You want to rotate the CA root certificate without interrupting existing connections. What is the recommended strategy?

Question 2hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

You are troubleshooting a connection error where the sidecar proxy cannot reach the upstream service. Which log file provides the most detail regarding Envoy's connectivity issues?

Question 3mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

You are configuring a sidecar proxy for a service named 'web'. Which configuration stanza in the service definition correctly defines the proxy's inbound port for Connect traffic?

Question 4hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

When using Consul intentions, what is the default behavior if no intention is found for a service pair?

Question 5mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

Which protocol is used for the control plane communication between the Consul agent and the sidecar proxy?

Question 6easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

Which service definition field is used to link a sidecar proxy to its parent service?

Question 7mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

What happens if a service proxy loses its connection to the local Consul agent?

Question 8easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

Which CLI command would you use to check the status of a Connect-enabled service?

Question 9mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

How do you enable mTLS globally in a Consul datacenter?

Question 10mediummulti select

Read the full Service Mesh With Consul Connect explanation →

Which TWO of the following are true regarding intentions?

Question 11mediummulti select

Read the full Service Mesh With Consul Connect explanation →

Which THREE of the following are supported as sidecar proxy types in Consul?

Question 12mediummulti select

Read the full Service Mesh With Consul Connect explanation →

Which THREE tasks are performed by the Consul agent for Connect?

Question 13mediummulti select

Read the full Service Mesh With Consul Connect explanation →

Which THREE items are required to configure an upstream service?

Question 14mediummulti select

Read the full Service Mesh With Consul Connect explanation →

Which THREE settings are part of the 'proxy' configuration block?

Question 15mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

You are running Consul 1.15 with Connect enabled. A developer wants to allow the 'web' service to reach the 'api' service over the mesh, but only when 'web' presents a client certificate signed by a specific intermediate CA. Which Consul intention configuration achieves this?

Question 16hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

You have a Consul datacenter with Connect enabled. A service 'frontend' needs to communicate with 'backend' over the mesh. You notice that traffic is not being encrypted even though mTLS is enabled globally. Which of the following is the most likely cause?

Question 17hardmulti select

Read the full Service Mesh With Consul Connect explanation →

A platform team is running Consul 1.15 with Connect enabled across two datacenters. They need to allow a service named 'payments' in datacenter 'dc1' to communicate with a service named 'ledger' in datacenter 'dc2' over the mesh, while denying all other cross-datacenter traffic to 'ledger'. Which two configuration elements are required to achieve this? (Choose two.)

Question 18mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

You are deploying a new service 'payments' in a Consul 1.15 datacenter. Security policy requires that all service-to-service communication be encrypted with mTLS and authenticated via intentions. You have already registered the service and its sidecar proxy. What must you do next to enforce mTLS for this service's inbound connections?

Question 19mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

A security engineer needs to permit traffic from any service in the 'frontend' namespace to 'backend' services in the 'default' namespace, while denying all other cross-namespace traffic. Consul 1.15 Enterprise is in use with admin partitions and namespaces enabled. Which intention configuration accomplishes this with the least administrative overhead?

Question 20mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

A platform team runs Consul 1.15 with Connect enabled. They want every service in the datacenter to enforce mutual TLS automatically, without adding 'connect' blocks to each service definition. Which configuration should they apply?

Question 21mediummulti select

Read the full Service Mesh With Consul Connect explanation →

You are troubleshooting a Consul Connect mesh where a service 'orders' cannot connect to its upstream 'inventory'. Which TWO of the following commands would help you diagnose the issue? (Choose two.)

Question 22hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

A Consul 1.15 cluster uses an external CA with Vault as the Connect CA provider. An operator notices that leaf certificates for sidecar proxies are not being rotated before expiration. The operator confirms that Vault is reachable and the root certificate is valid. Which configuration setting should the operator verify to ensure automatic rotation occurs?

Question 23mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

You are configuring a Consul Connect sidecar proxy for a service 'frontend'. The service needs to connect to a database service 'db' that is running outside the Consul service mesh. You want to enable secure communication to this external service. What should you configure in the sidecar proxy's upstream configuration?

Question 24mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

A Consul operator needs to enable mTLS globally for all Connect-enabled services in a datacenter. They want to ensure that all service-to-service communication is encrypted and authenticated. Which configuration change is required?

Question 25mediummulti select

Read the full Service Mesh With Consul Connect explanation →

A platform engineer is diagnosing intermittent failures where applications cannot reach upstream services through their Connect sidecar proxies in a Consul 1.15 datacenter. They want to gather evidence about proxy behavior and intention enforcement. Which TWO actions provide the most relevant diagnostic information? (Choose two.)

Question 26mediummulti select

Read the full Service Mesh With Consul Connect explanation →

A service named 'web' is registered with Consul Connect and uses an Envoy sidecar proxy. You need to allow 'web' to communicate with two upstream services: 'api' and 'db'. Which two configuration steps are required to enable this communication? (Choose two.)

Question 27mediummulti select

Read the full Service Mesh With Consul Connect explanation →

A Consul 1.15 operator is troubleshooting a Connect-enabled service whose sidecar proxy reports connection failures to an upstream. The operator wants to gather diagnostic data that reveals the proxy's view of the mesh, including its listeners, clusters, and endpoints. (Choose two.)

Question 28mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

A platform team runs a Consul 1.15 datacenter where every service in the 'payments' namespace is registered with Connect sidecar proxies. Security requires that the 'ledger' service accept inbound connections only from 'checkout', regardless of which datacenter or partition the caller originates from. Which intention definition should the operator create?

Question 29hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

A Consul 1.15 datacenter spans two federated datacenters, 'dc1' and 'dc2'. A service 'frontend' in dc1 must call 'backend' in dc2 through the mesh. Mesh gateways are deployed in both datacenters. The operator configures an upstream for 'frontend' with the destination 'backend' and sets the datacenter to 'dc2'. However, connections fail and the sidecar logs show that no healthy endpoints are found. Which configuration issue is the most likely cause?

Question 30hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

A retail company runs Consul 1.15 in two datacenters connected by a mesh gateway. The 'orders' service in dc1 must call 'inventory' in dc2 over the mesh. An operator has created an intention allowing orders to reach inventory and configured the upstream. Calls still fail at the remote proxy with a certificate validation error. Which configuration step was most likely missed?

Question 31mediummulti select

Read the full Service Mesh With Consul Connect explanation →

An SRE is tuning a Consul 1.15 service mesh for a latency-sensitive application. They want to reduce connection overhead between two services that communicate constantly, and they also want outbound calls from the client proxy to reach an internal upstream that is not registered as a Consul service. Which two configuration changes should they make? (Choose two.)

Question 32mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

A Consul operator is configuring an explicit intention to allow traffic from a frontend service to a backend service. The intention is created with the command `consul intention create -allow frontend backend`. Shortly after, the operator notices that traffic from frontend to backend is still being denied. The operator verifies that the sidecar proxies are running and connected. What is the most likely reason for the continued denial?

Question 33hardmulti select

Read the full Service Mesh With Consul Connect explanation →

A platform team is deploying Consul Connect in a multi-datacenter environment. They need to ensure that services in different datacenters can communicate securely through mesh gateways. Which TWO of the following are required to enable cross-datacenter service-to-service communication with mesh gateways? (Choose two.)

Question 34easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

A developer is deploying a new service named 'payments' with a sidecar proxy in a Consul Connect mesh. The service must be able to accept connections from the 'checkout' service. The developer has created an intention allowing traffic from 'checkout' to 'payments'. However, when testing, the 'checkout' service cannot connect to 'payments'. The developer checks the sidecar proxy logs and sees no errors. What is the most likely missing configuration?

Question 35hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

An operator manages a Consul 1.15 datacenter with Connect enabled and a default deny intention. A new service 'ledger' is registered with a sidecar proxy. The operator creates an intention allowing 'billing' to reach 'ledger', but traffic from 'billing' is still denied. The billing service's sidecar proxy is healthy and registered. Which condition most likely explains the continued denial?

Question 36hardmulti select

Read the full Service Mesh With Consul Connect explanation →

A security engineer is reviewing a Consul 1.15 Connect deployment and wants to understand which statements accurately describe how sidecar proxies enforce and secure mesh communication. (Choose two.)

Question 37easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

What does the 'kind' field in a service definition specify for a Consul Connect service?

Question 38easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

Which component acts as the default sidecar proxy for Consul Connect?

Question 39mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

When using 'Consul Connect native' integration, how does the application handle mTLS?

Question 40mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

You have a service that needs to talk to a service in a different datacenter. What configuration is required?

Question 41mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

You need to deny all traffic between 'service-a' and 'service-b' using intentions. What is the most efficient way to achieve this?

Question 42mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

Which command displays all active intentions in the Consul mesh?

Question 43easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

What is the primary role of the Consul Connect 'upstream' configuration?

Question 44mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

What is the function of the 'consul connect envoy' command?

Question 45mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

How are intentions applied to services in different partitions or namespaces?

Question 46hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

If you are using SPIRE for certificate management, how does this interact with Consul Connect?

Question 47hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

What is the primary benefit of using a Mesh Gateway in a Consul Connect architecture?

Question 48mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

What is the purpose of the 'upstreams' block in a service definition?

Question 49easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

Which of the following is a key feature of Consul Connect's intentions?

Question 50mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

What is the correct way to specify a local bind port for an upstream service?

Question 51hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

When configuring mTLS in Consul Connect, how are certificates distributed to the sidecar proxies?

Question 52hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

You need to perform a canary deployment for a service. What Consul feature should you use?

Question 53mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

What is the 'Consul Connect proxy' kind used for?

Question 54easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

What is the function of the 'consul intention check' command?

Question 55hardmulti select

Read the full Service Mesh With Consul Connect explanation →

Which THREE factors influence the mTLS handshake in a Consul Connect mesh?

Question 56hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

When troubleshooting a service that fails to start its Envoy proxy, which service definition field should you check for incorrect configuration?

Question 57easymulti select

Read the full Service Mesh With Consul Connect explanation →

Which TWO of the following are valid ways to configure Consul Connect?

Question 58mediummulti select

Read the full Service Mesh With Consul Connect explanation →

Which THREE of the following are components of a Consul Connect service definition?

Question 59easymulti select

Read the full Service Mesh With Consul Connect explanation →

Which TWO of the following are benefits of using Consul Connect?

Question 60hardmulti select

Read the full Service Mesh With Consul Connect explanation →

Which TWO of the following are valid ways to monitor Consul Connect performance?

Question 61hardmulti select

Read the full Service Mesh With Consul Connect explanation →

Which TWO of the following are features of Consul Connect native integration?

Question 62easymulti select

Read the full Service Mesh With Consul Connect explanation →

Which TWO are common use cases for Consul Connect?

Question 63mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

You are configuring Consul Connect for a service named 'payments'. You want to allow incoming connections only from services that present a valid client certificate from a specific CA and also enforce that the source service is 'checkout'. What combination of Consul features should you use?

Question 64mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

A platform team runs Consul 1.15 with Connect enabled in a single datacenter. They register a new service 'payments' with a sidecar proxy, but when the application team tries to reach 'payments' through its local proxy, the connection is refused. Running 'consul intention check web payments' returns 'Result: denied'. No intentions have been created yet. What should the team do to allow the traffic while following Consul's default security model?

Question 65easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

A platform team is deploying a new service 'payments' on a Consul 1.15 cluster with Connect enabled. They want to ensure that only the 'checkout' service can initiate connections to 'payments', and all other services are denied by default. Which intention should they create?

Question 66hardmultiple choice

Review the full routing breakdown →

An operator is configuring a Connect sidecar proxy in a service definition so that outbound calls to a dependency are routed through the mesh. The dependency is registered as 'redis' in the same datacenter, listening on port 6379. The application expects to reach it at localhost:6379. Which upstream block in the sidecar_service definition achieves this?

Question 67mediummultiple choice

Review the full routing breakdown →

You are using Consul 1.15 with Connect and want to enable Layer 7 traffic management for a service 'api' to perform HTTP path-based routing. Which configuration is required in the service definition?

Question 68mediummulti select

Read the full Service Mesh With Consul Connect explanation →

A Consul 1.15 operator is configuring a service mesh with Connect and needs to ensure that the sidecar proxy for 'frontend' can establish mTLS connections to the 'backend' service. The operator has already registered both services with Connect sidecars. Which two actions are required to allow this communication? (Choose two.)

Question 69mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

You are deploying a new service 'api' in a Consul Connect mesh. You want to ensure that all incoming connections to 'api' are logged for auditing purposes. Which Consul feature should you configure?

Question 70mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

You are deploying a Consul Connect service mesh in a single datacenter. A developer asks how service-to-service authorization is enforced when two services communicate through their sidecar proxies. What is the primary mechanism that controls whether the connection is allowed?

Question 71mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

A security engineer is configuring intentions for a service mesh. They want to allow traffic from 'frontend' to 'backend' only when the connection is encrypted with mTLS and originates from a specific namespace in Consul Enterprise. Which intention attribute should they use to enforce the namespace constraint?

Question 72easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

A service 'inventory' is registered in Consul 1.15 with Connect enabled. You need to verify that the sidecar proxy for 'inventory' is running and healthy. Which command should you use?

Question 73hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

You are using Consul 1.15 with Connect enabled. A service 'web' needs to communicate with an upstream service 'api' in a different datacenter. You have configured a mesh gateway in each datacenter. The 'web' service's sidecar proxy is configured with an upstream for 'api'. However, traffic is failing. You check the sidecar proxy logs and see 'no healthy upstream'. What is the most likely cause?

Question 74mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

A platform team runs a Consul 1.15 datacenter with Connect enabled. They deploy a new service called 'payments' and register it with a sidecar proxy. Security policy requires that only the 'checkout' service may initiate connections to 'payments', and all other services must be denied, even if they present a valid service token. No intentions exist yet for this pair. Which action should the team take to enforce this requirement with the least operational overhead?

Question 75hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

A platform team is running Consul Connect with Envoy sidecar proxies. They need to ensure that a service named 'payments' can only be accessed by services in the 'frontend' namespace, and all other access must be denied. They have Consul Enterprise with namespaces enabled. Which intention configuration achieves this requirement with the least administrative overhead?

Question 76easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

A developer is deploying a new service called 'inventory' with a Connect sidecar proxy. They want to verify that the sidecar is running and registered correctly. Which command should they use to check the status of the Connect-enabled service?

Question 77hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

An operator manages a Consul 1.15 cluster where Connect is enabled and mTLS is active. They need to rotate the Connect CA root certificate for the datacenter. The new root must be distributed to all sidecar proxies without dropping existing connections, and the old root must remain trusted during the transition. Which sequence of actions accomplishes this?

Question 78hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

A team is running Consul 1.15 with Connect and wants to expose a TCP service through an ingress gateway so external clients can reach it over mTLS. They define the gateway and a listener on port 8443. External clients report TLS handshake failures. The gateway logs show no matching certificate. Which configuration element must be present for the listener to serve TLS?

Question 79easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

A developer needs to see which intentions currently govern traffic between services in a Consul 1.15 datacenter. Which command lists all intentions stored in the catalog?

Question 80hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

A service mesh operator is troubleshooting a connectivity issue between two services in a Consul 1.15 datacenter. The sidecar proxy for the 'frontend' service cannot reach the 'backend' upstream. The operator has confirmed that intentions allow the traffic. Which log should they inspect first to diagnose the issue on the sidecar proxy?

Question 81mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

You are configuring a Consul Connect service mesh and need to enable mTLS for all services in the datacenter. Which configuration setting must be enabled in the Consul server agent configuration to turn on Connect and enforce mTLS globally?

Question 82easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

A developer registers a service called 'web' with a sidecar proxy in a Consul 1.15 datacenter. The service needs to call a backend service named 'api' through the mesh. The developer adds an upstream block to the 'web' service definition pointing to 'api' on port 8080. What does this upstream configuration accomplish for the 'web' sidecar proxy?

Question 83mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

A service 'orders' must call an upstream database service through its sidecar proxy. The upstream is registered in the same Consul datacenter and the operator wants the sidecar to discover it dynamically rather than hard-code an address. Which upstream configuration entry in the sidecar_service stanza accomplishes this?

Question 84easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

You are deploying a Consul Connect service mesh in a Consul 1.15 datacenter. You want to ensure that all service-to-service traffic is encrypted and authenticated. What is the default behavior for intentions when no intention is defined between two services?

Question 85hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

A security team requires that a service 'reporting' only accept connections from services presenting a valid mesh certificate issued by the Connect CA, and that all other traffic be rejected. They have registered reporting with a sidecar proxy. Which combination ensures this behavior?

Question 86easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

You are troubleshooting a Consul Connect service mesh and need to verify which intentions are currently configured. Which Consul CLI command lists all intentions?

Question 87hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

A financial services firm requires that all service-to-service traffic inside its Consul 1.15 datacenter be encrypted and that services accept connections only when an explicit intention permits them. An operator enables Connect on all agents but services still accept plaintext traffic from non-mesh clients. Which additional step is required to enforce encryption and deny-by-default for the whole datacenter?

Question 88mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

You are operating a Consul 1.15 cluster with Connect enabled. A service named 'api' is registered with a sidecar proxy. You need to ensure that only the 'web' service can initiate connections to 'api'. You have created an intention that allows 'web' to connect to 'api', but you have not created any other intentions. What is the default behavior for other services trying to connect to 'api'?

Question 89mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

A platform team runs Consul 1.15 with Connect enabled. Their service 'api' is registered with a sidecar proxy, and its upstream 'database' is also mesh-enabled. The team wants 'api' to resolve 'database' through the mesh without hard-coding an IP address in the application. Which configuration in the service registration enables the sidecar to expose a stable local listener for the upstream?

Question 90easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

A team runs Consul 1.15 with Connect. They want to observe which services are allowed to communicate with a specific service named 'inventory' and confirm whether a particular source is permitted, without sending real traffic. Which command should they use to query the effective intention decision for a source and destination?

Question 91mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

A developer notices that the application process in a Connect-enabled pod connects to 127.0.0.1:8080 to reach an upstream, but the sidecar proxy's actual listener was assigned a different port. The application is failing to reach the upstream. Which action should the developer take to provide a predictable local address for the upstream?

Question 1hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

A service 'api' is configured with mTLS. You want to rotate the CA root certificate without interrupting existing connections. What is the recommended strategy?

Question 2hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

You are troubleshooting a connection error where the sidecar proxy cannot reach the upstream service. Which log file provides the most detail regarding Envoy's connectivity issues?

Question 3mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

You are configuring a sidecar proxy for a service named 'web'. Which configuration stanza in the service definition correctly defines the proxy's inbound port for Connect traffic?

Question 4hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

When using Consul intentions, what is the default behavior if no intention is found for a service pair?

Question 5mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

Which protocol is used for the control plane communication between the Consul agent and the sidecar proxy?

Question 6easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

Which service definition field is used to link a sidecar proxy to its parent service?

Question 7mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

What happens if a service proxy loses its connection to the local Consul agent?

Question 8easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

Which CLI command would you use to check the status of a Connect-enabled service?

Question 9mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

How do you enable mTLS globally in a Consul datacenter?

Question 10mediummulti select

Read the full Service Mesh With Consul Connect explanation →

Which TWO of the following are true regarding intentions?

Question 11mediummulti select

Read the full Service Mesh With Consul Connect explanation →

Which THREE of the following are supported as sidecar proxy types in Consul?

Question 12mediummulti select

Read the full Service Mesh With Consul Connect explanation →

Which THREE tasks are performed by the Consul agent for Connect?

Question 13mediummulti select

Read the full Service Mesh With Consul Connect explanation →

Which THREE items are required to configure an upstream service?

Question 14mediummulti select

Read the full Service Mesh With Consul Connect explanation →

Which THREE settings are part of the 'proxy' configuration block?

Question 15mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

You are running Consul 1.15 with Connect enabled. A developer wants to allow the 'web' service to reach the 'api' service over the mesh, but only when 'web' presents a client certificate signed by a specific intermediate CA. Which Consul intention configuration achieves this?

Question 16hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

You have a Consul datacenter with Connect enabled. A service 'frontend' needs to communicate with 'backend' over the mesh. You notice that traffic is not being encrypted even though mTLS is enabled globally. Which of the following is the most likely cause?

Question 17hardmulti select

Read the full Service Mesh With Consul Connect explanation →

A platform team is running Consul 1.15 with Connect enabled across two datacenters. They need to allow a service named 'payments' in datacenter 'dc1' to communicate with a service named 'ledger' in datacenter 'dc2' over the mesh, while denying all other cross-datacenter traffic to 'ledger'. Which two configuration elements are required to achieve this? (Choose two.)

Question 18mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

You are deploying a new service 'payments' in a Consul 1.15 datacenter. Security policy requires that all service-to-service communication be encrypted with mTLS and authenticated via intentions. You have already registered the service and its sidecar proxy. What must you do next to enforce mTLS for this service's inbound connections?

Question 19mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

A security engineer needs to permit traffic from any service in the 'frontend' namespace to 'backend' services in the 'default' namespace, while denying all other cross-namespace traffic. Consul 1.15 Enterprise is in use with admin partitions and namespaces enabled. Which intention configuration accomplishes this with the least administrative overhead?

Question 20mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

A platform team runs Consul 1.15 with Connect enabled. They want every service in the datacenter to enforce mutual TLS automatically, without adding 'connect' blocks to each service definition. Which configuration should they apply?

Question 21mediummulti select

Read the full Service Mesh With Consul Connect explanation →

You are troubleshooting a Consul Connect mesh where a service 'orders' cannot connect to its upstream 'inventory'. Which TWO of the following commands would help you diagnose the issue? (Choose two.)

Question 22hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

A Consul 1.15 cluster uses an external CA with Vault as the Connect CA provider. An operator notices that leaf certificates for sidecar proxies are not being rotated before expiration. The operator confirms that Vault is reachable and the root certificate is valid. Which configuration setting should the operator verify to ensure automatic rotation occurs?

Question 23mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

You are configuring a Consul Connect sidecar proxy for a service 'frontend'. The service needs to connect to a database service 'db' that is running outside the Consul service mesh. You want to enable secure communication to this external service. What should you configure in the sidecar proxy's upstream configuration?

Question 24mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

A Consul operator needs to enable mTLS globally for all Connect-enabled services in a datacenter. They want to ensure that all service-to-service communication is encrypted and authenticated. Which configuration change is required?

Question 25mediummulti select

Read the full Service Mesh With Consul Connect explanation →

A platform engineer is diagnosing intermittent failures where applications cannot reach upstream services through their Connect sidecar proxies in a Consul 1.15 datacenter. They want to gather evidence about proxy behavior and intention enforcement. Which TWO actions provide the most relevant diagnostic information? (Choose two.)

Question 26mediummulti select

Read the full Service Mesh With Consul Connect explanation →

A service named 'web' is registered with Consul Connect and uses an Envoy sidecar proxy. You need to allow 'web' to communicate with two upstream services: 'api' and 'db'. Which two configuration steps are required to enable this communication? (Choose two.)

Question 27mediummulti select

Read the full Service Mesh With Consul Connect explanation →

A Consul 1.15 operator is troubleshooting a Connect-enabled service whose sidecar proxy reports connection failures to an upstream. The operator wants to gather diagnostic data that reveals the proxy's view of the mesh, including its listeners, clusters, and endpoints. (Choose two.)

Question 28mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

A platform team runs a Consul 1.15 datacenter where every service in the 'payments' namespace is registered with Connect sidecar proxies. Security requires that the 'ledger' service accept inbound connections only from 'checkout', regardless of which datacenter or partition the caller originates from. Which intention definition should the operator create?

Question 29hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

A Consul 1.15 datacenter spans two federated datacenters, 'dc1' and 'dc2'. A service 'frontend' in dc1 must call 'backend' in dc2 through the mesh. Mesh gateways are deployed in both datacenters. The operator configures an upstream for 'frontend' with the destination 'backend' and sets the datacenter to 'dc2'. However, connections fail and the sidecar logs show that no healthy endpoints are found. Which configuration issue is the most likely cause?

Question 30hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

A retail company runs Consul 1.15 in two datacenters connected by a mesh gateway. The 'orders' service in dc1 must call 'inventory' in dc2 over the mesh. An operator has created an intention allowing orders to reach inventory and configured the upstream. Calls still fail at the remote proxy with a certificate validation error. Which configuration step was most likely missed?

Question 31mediummulti select

Read the full Service Mesh With Consul Connect explanation →

An SRE is tuning a Consul 1.15 service mesh for a latency-sensitive application. They want to reduce connection overhead between two services that communicate constantly, and they also want outbound calls from the client proxy to reach an internal upstream that is not registered as a Consul service. Which two configuration changes should they make? (Choose two.)

Question 32mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

A Consul operator is configuring an explicit intention to allow traffic from a frontend service to a backend service. The intention is created with the command `consul intention create -allow frontend backend`. Shortly after, the operator notices that traffic from frontend to backend is still being denied. The operator verifies that the sidecar proxies are running and connected. What is the most likely reason for the continued denial?

Question 33hardmulti select

Read the full Service Mesh With Consul Connect explanation →

A platform team is deploying Consul Connect in a multi-datacenter environment. They need to ensure that services in different datacenters can communicate securely through mesh gateways. Which TWO of the following are required to enable cross-datacenter service-to-service communication with mesh gateways? (Choose two.)

Question 34easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

A developer is deploying a new service named 'payments' with a sidecar proxy in a Consul Connect mesh. The service must be able to accept connections from the 'checkout' service. The developer has created an intention allowing traffic from 'checkout' to 'payments'. However, when testing, the 'checkout' service cannot connect to 'payments'. The developer checks the sidecar proxy logs and sees no errors. What is the most likely missing configuration?

Question 35hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

An operator manages a Consul 1.15 datacenter with Connect enabled and a default deny intention. A new service 'ledger' is registered with a sidecar proxy. The operator creates an intention allowing 'billing' to reach 'ledger', but traffic from 'billing' is still denied. The billing service's sidecar proxy is healthy and registered. Which condition most likely explains the continued denial?

Question 36hardmulti select

Read the full Service Mesh With Consul Connect explanation →

A security engineer is reviewing a Consul 1.15 Connect deployment and wants to understand which statements accurately describe how sidecar proxies enforce and secure mesh communication. (Choose two.)

Question 37easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

What does the 'kind' field in a service definition specify for a Consul Connect service?

Question 38easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

Which component acts as the default sidecar proxy for Consul Connect?

Question 39mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

When using 'Consul Connect native' integration, how does the application handle mTLS?

Question 40mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

You have a service that needs to talk to a service in a different datacenter. What configuration is required?

Question 41mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

You need to deny all traffic between 'service-a' and 'service-b' using intentions. What is the most efficient way to achieve this?

Question 42mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

Which command displays all active intentions in the Consul mesh?

Question 43easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

What is the primary role of the Consul Connect 'upstream' configuration?

Question 44mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

What is the function of the 'consul connect envoy' command?

Question 45mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

How are intentions applied to services in different partitions or namespaces?

Question 46hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

If you are using SPIRE for certificate management, how does this interact with Consul Connect?

Question 47hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

What is the primary benefit of using a Mesh Gateway in a Consul Connect architecture?

Question 48mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

What is the purpose of the 'upstreams' block in a service definition?

Question 49easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

Which of the following is a key feature of Consul Connect's intentions?

Question 50mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

What is the correct way to specify a local bind port for an upstream service?

Question 51hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

When configuring mTLS in Consul Connect, how are certificates distributed to the sidecar proxies?

Question 52hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

You need to perform a canary deployment for a service. What Consul feature should you use?

Question 53mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

What is the 'Consul Connect proxy' kind used for?

Question 54easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

What is the function of the 'consul intention check' command?

Question 55hardmulti select

Read the full Service Mesh With Consul Connect explanation →

Which THREE factors influence the mTLS handshake in a Consul Connect mesh?

Question 56hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

When troubleshooting a service that fails to start its Envoy proxy, which service definition field should you check for incorrect configuration?

Question 57easymulti select

Read the full Service Mesh With Consul Connect explanation →

Which TWO of the following are valid ways to configure Consul Connect?

Question 58mediummulti select

Read the full Service Mesh With Consul Connect explanation →

Which THREE of the following are components of a Consul Connect service definition?

Question 59easymulti select

Read the full Service Mesh With Consul Connect explanation →

Which TWO of the following are benefits of using Consul Connect?

Question 60hardmulti select

Read the full Service Mesh With Consul Connect explanation →

Which TWO of the following are valid ways to monitor Consul Connect performance?

Question 61hardmulti select

Read the full Service Mesh With Consul Connect explanation →

Which TWO of the following are features of Consul Connect native integration?

Question 62easymulti select

Read the full Service Mesh With Consul Connect explanation →

Which TWO are common use cases for Consul Connect?

Question 63mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

You are configuring Consul Connect for a service named 'payments'. You want to allow incoming connections only from services that present a valid client certificate from a specific CA and also enforce that the source service is 'checkout'. What combination of Consul features should you use?

Question 64mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

A platform team runs Consul 1.15 with Connect enabled in a single datacenter. They register a new service 'payments' with a sidecar proxy, but when the application team tries to reach 'payments' through its local proxy, the connection is refused. Running 'consul intention check web payments' returns 'Result: denied'. No intentions have been created yet. What should the team do to allow the traffic while following Consul's default security model?

Question 65easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

A platform team is deploying a new service 'payments' on a Consul 1.15 cluster with Connect enabled. They want to ensure that only the 'checkout' service can initiate connections to 'payments', and all other services are denied by default. Which intention should they create?

Question 66hardmultiple choice

Review the full routing breakdown →

An operator is configuring a Connect sidecar proxy in a service definition so that outbound calls to a dependency are routed through the mesh. The dependency is registered as 'redis' in the same datacenter, listening on port 6379. The application expects to reach it at localhost:6379. Which upstream block in the sidecar_service definition achieves this?

Question 67mediummultiple choice

Review the full routing breakdown →

You are using Consul 1.15 with Connect and want to enable Layer 7 traffic management for a service 'api' to perform HTTP path-based routing. Which configuration is required in the service definition?

Question 68mediummulti select

Read the full Service Mesh With Consul Connect explanation →

A Consul 1.15 operator is configuring a service mesh with Connect and needs to ensure that the sidecar proxy for 'frontend' can establish mTLS connections to the 'backend' service. The operator has already registered both services with Connect sidecars. Which two actions are required to allow this communication? (Choose two.)

Question 69mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

You are deploying a new service 'api' in a Consul Connect mesh. You want to ensure that all incoming connections to 'api' are logged for auditing purposes. Which Consul feature should you configure?

Question 70mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

You are deploying a Consul Connect service mesh in a single datacenter. A developer asks how service-to-service authorization is enforced when two services communicate through their sidecar proxies. What is the primary mechanism that controls whether the connection is allowed?

Question 71mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

A security engineer is configuring intentions for a service mesh. They want to allow traffic from 'frontend' to 'backend' only when the connection is encrypted with mTLS and originates from a specific namespace in Consul Enterprise. Which intention attribute should they use to enforce the namespace constraint?

Question 72easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

A service 'inventory' is registered in Consul 1.15 with Connect enabled. You need to verify that the sidecar proxy for 'inventory' is running and healthy. Which command should you use?

Question 73hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

You are using Consul 1.15 with Connect enabled. A service 'web' needs to communicate with an upstream service 'api' in a different datacenter. You have configured a mesh gateway in each datacenter. The 'web' service's sidecar proxy is configured with an upstream for 'api'. However, traffic is failing. You check the sidecar proxy logs and see 'no healthy upstream'. What is the most likely cause?

Question 74mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

A platform team runs a Consul 1.15 datacenter with Connect enabled. They deploy a new service called 'payments' and register it with a sidecar proxy. Security policy requires that only the 'checkout' service may initiate connections to 'payments', and all other services must be denied, even if they present a valid service token. No intentions exist yet for this pair. Which action should the team take to enforce this requirement with the least operational overhead?

Question 75hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

A platform team is running Consul Connect with Envoy sidecar proxies. They need to ensure that a service named 'payments' can only be accessed by services in the 'frontend' namespace, and all other access must be denied. They have Consul Enterprise with namespaces enabled. Which intention configuration achieves this requirement with the least administrative overhead?

Question 76easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

A developer is deploying a new service called 'inventory' with a Connect sidecar proxy. They want to verify that the sidecar is running and registered correctly. Which command should they use to check the status of the Connect-enabled service?

Question 77hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

An operator manages a Consul 1.15 cluster where Connect is enabled and mTLS is active. They need to rotate the Connect CA root certificate for the datacenter. The new root must be distributed to all sidecar proxies without dropping existing connections, and the old root must remain trusted during the transition. Which sequence of actions accomplishes this?

Question 78hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

A team is running Consul 1.15 with Connect and wants to expose a TCP service through an ingress gateway so external clients can reach it over mTLS. They define the gateway and a listener on port 8443. External clients report TLS handshake failures. The gateway logs show no matching certificate. Which configuration element must be present for the listener to serve TLS?

Question 79easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

A developer needs to see which intentions currently govern traffic between services in a Consul 1.15 datacenter. Which command lists all intentions stored in the catalog?

Question 80hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

A service mesh operator is troubleshooting a connectivity issue between two services in a Consul 1.15 datacenter. The sidecar proxy for the 'frontend' service cannot reach the 'backend' upstream. The operator has confirmed that intentions allow the traffic. Which log should they inspect first to diagnose the issue on the sidecar proxy?

Question 81mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

You are configuring a Consul Connect service mesh and need to enable mTLS for all services in the datacenter. Which configuration setting must be enabled in the Consul server agent configuration to turn on Connect and enforce mTLS globally?

Question 82easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

A developer registers a service called 'web' with a sidecar proxy in a Consul 1.15 datacenter. The service needs to call a backend service named 'api' through the mesh. The developer adds an upstream block to the 'web' service definition pointing to 'api' on port 8080. What does this upstream configuration accomplish for the 'web' sidecar proxy?

Question 83mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

A service 'orders' must call an upstream database service through its sidecar proxy. The upstream is registered in the same Consul datacenter and the operator wants the sidecar to discover it dynamically rather than hard-code an address. Which upstream configuration entry in the sidecar_service stanza accomplishes this?

Question 84easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

You are deploying a Consul Connect service mesh in a Consul 1.15 datacenter. You want to ensure that all service-to-service traffic is encrypted and authenticated. What is the default behavior for intentions when no intention is defined between two services?

Question 85hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

A security team requires that a service 'reporting' only accept connections from services presenting a valid mesh certificate issued by the Connect CA, and that all other traffic be rejected. They have registered reporting with a sidecar proxy. Which combination ensures this behavior?

Question 86easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

You are troubleshooting a Consul Connect service mesh and need to verify which intentions are currently configured. Which Consul CLI command lists all intentions?

Question 87hardmultiple choice

Read the full Service Mesh With Consul Connect explanation →

A financial services firm requires that all service-to-service traffic inside its Consul 1.15 datacenter be encrypted and that services accept connections only when an explicit intention permits them. An operator enables Connect on all agents but services still accept plaintext traffic from non-mesh clients. Which additional step is required to enforce encryption and deny-by-default for the whole datacenter?

Question 88mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

You are operating a Consul 1.15 cluster with Connect enabled. A service named 'api' is registered with a sidecar proxy. You need to ensure that only the 'web' service can initiate connections to 'api'. You have created an intention that allows 'web' to connect to 'api', but you have not created any other intentions. What is the default behavior for other services trying to connect to 'api'?

Question 89mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

A platform team runs Consul 1.15 with Connect enabled. Their service 'api' is registered with a sidecar proxy, and its upstream 'database' is also mesh-enabled. The team wants 'api' to resolve 'database' through the mesh without hard-coding an IP address in the application. Which configuration in the service registration enables the sidecar to expose a stable local listener for the upstream?

Question 90easymultiple choice

Read the full Service Mesh With Consul Connect explanation →

A team runs Consul 1.15 with Connect. They want to observe which services are allowed to communicate with a specific service named 'inventory' and confirm whether a particular source is permitted, without sending real traffic. Which command should they use to query the effective intention decision for a source and destination?

Question 91mediummultiple choice

Read the full Service Mesh With Consul Connect explanation →

A developer notices that the application process in a Connect-enabled pod connects to 127.0.0.1:8080 to reach an upstream, but the sidecar proxy's actual listener was assigned a different port. The application is failing to reach the upstream. Which action should the developer take to provide a predictable local address for the upstream?