Consul 1.15 Service Mesh With Consul Connect Practice Test 4 — 15 Questions

Question 1

If you are using SPIRE for certificate management, how does this interact with Consul Connect?

Accepted Answer

Consul Connect can delegate CA operations to an external provider like SPIRE.. Consul Connect supports pluggable CA providers, and SPIRE is one of the supported external CA integrations. When configured, Consul delegates certificate signing and issuance for service mesh identities to SPIRE, allowing organizations already standardized on SPIFFE/SPIRE to unify workload identity across Consul and non-Consul workloads.

Answer

Only static certificates can be used.

Answer

Consul must be disabled.

Answer

SPIRE replaces the Consul agent.

Question 2

What is the primary benefit of using a Mesh Gateway in a Consul Connect architecture?

Accepted Answer

It enables communication between services in different datacenters.. Mesh gateways provide a single point of ingress/egress for cross-datacenter traffic, reducing the need for direct cross-DC networking.

Answer

It encrypts traffic at the storage layer.

Answer

It improves local mTLS performance.

Answer

It provides load balancing for local services.

Question 3

What is the purpose of the 'upstreams' block in a service definition?

Accepted Answer

To configure the outbound dependencies of the service.. It defines the targets that the sidecar proxy should be allowed to proxy requests to.

Answer

To set the service's health check interval.

Answer

To limit the total number of connections.

Answer

To define the ingress rules.

Question 4

Which of the following is a key feature of Consul Connect's intentions?

Accepted Answer

Service authorization (allow/deny).. Consul Connect's intentions define which services are allowed to communicate with which other services. They are essentially authorization policies that allow or deny connections based on service identity. Intentions are a core feature for enforcing zero-trust security in a service mesh.

Answer

Global load balancing.

Answer

Certificate rotation.

Answer

Traffic splitting.

Question 5

What is the correct way to specify a local bind port for an upstream service?

Accepted Answer

upstreams { destination_name = "svc", local_bind_port = 9000 }. The correct syntax for defining an upstream service with a local bind port in Consul's service definition is within the 'upstreams' block, specifying 'destination_name' and 'local_bind_port'. This tells the local proxy to listen on the specified port and forward traffic to the destination service. The other options use incorrect block names or syntax that Consul does not recognize.

Answer

service { upstream = { 9000 } }

Answer

proxy { upstream_port = 9000 }

Answer

upstream { port = 9000 }

Question 6

When configuring mTLS in Consul Connect, how are certificates distributed to the sidecar proxies?

Accepted Answer

The agent fetches them from the server and provides them via the Envoy xDS API.. In Consul Connect mTLS, the Consul agent on each node acts as the local certificate authority client: it fetches leaf certificates and the CA bundle from the Consul servers and delivers them to the sidecar proxy (Envoy) dynamically through the xDS API. This means certificates are rotated automatically without restarting the proxy or editing service definitions.

Answer

They are hardcoded in the service definition.

Answer

Via an external secret management service only.

Answer

Via a shared disk volume.

Question 7

You need to perform a canary deployment for a service. What Consul feature should you use?

Accepted Answer

Service splitting via Service Resolver.. Consul's service resolver supports service splitting, which allows you to define weighted subsets of service instances for canary deployments. By configuring a service resolver with a split, you can direct a percentage of traffic to a new version (canary) while the rest goes to the stable version. This is the intended feature for gradual rollouts. Other options like KV store updates, intentions, and mesh gateways do not provide traffic splitting capabilities.

Answer

KV store manual updates.

Answer

Intentions.

Answer

Service mesh gateway.

Question 8

What is the 'Consul Connect proxy' kind used for?

Accepted Answer

To mark a service definition as a sidecar proxy.. It defines a service that is explicitly a sidecar proxy.

Answer

To define a gateway.

Answer

To define the service that the proxy runs in front of.

Answer

To enable mTLS for the service.

Question 9

What is the function of the 'consul intention check' command?

Accepted Answer

To verify if traffic is allowed between two services.. The 'consul intention check' command verifies whether traffic is allowed between two services based on the current intentions. It takes a source and destination service and returns whether the connection is allowed or denied, along with the matching intention. This is useful for troubleshooting connectivity issues in the mesh.

Answer

To list all intentions.

Answer

To create a new intention.

Answer

To delete an intention.

Question 10

Which THREE factors influence the mTLS handshake in a Consul Connect mesh?

Accepted Answer

The identity certificate issued to the service.. In Consul Connect, the mTLS handshake is driven by the cryptographic material each side presents and validates: option A, the identity certificate issued to the service, is the leaf certificate (with SPIFFE-style URI SAN) that the sidecar proxy presents to prove its service identity, so it directly determines the handshake. Option B, the CA root certificate, is the anchor both proxies use to verify the peer's leaf certificate chain, making it essential to the handshake's trust decision. Option C, the trust bundle, is the set of CA certificates (including roots and any intermediates) that Consul distributes to proxies so they can validate certificates during the handshake, especially across CA rotations. Option D, the intention status, is enforced by the sidecar proxy as an authorization decision after/around connection establishment and does not alter the TLS handshake cryptography. Option E, the service health check result, affects service discovery and routing but is not part of the mTLS handshake itself.

Answer

The intention status.

Answer

The service health check result.

Question 11

When troubleshooting a service that fails to start its Envoy proxy, which service definition field should you check for incorrect configuration?

Accepted Answer

proxy. The proxy field in a Consul service definition configures the Envoy sidecar, including upstreams, protocol, and the sidecar's port and configuration. If Envoy fails to start, the proxy stanza is the first place to inspect for malformed upstream definitions, invalid protocol values, or missing sidecar service registration.

Answer

checks

Answer

tags

Question 12

Which TWO of the following are valid ways to configure Consul Connect?

Accepted Answer

JSON service definition files.. Option D (JSON service definition files) is correct because Consul Connect is configured by declaring a service with a `connect` block (e.g., `"connect": {"sidecar_service": {}}`) inside a service registration JSON file, which the agent reads to enable the sidecar proxy and intentions. Option E (Consul HTTP API) is correct because the same service registration, including the `connect` stanza, can be submitted programmatically via the `/v1/agent/service/register` endpoint, and intentions can be managed through the `/v1/connect/intentions` endpoints. Options A, B, and C are not valid configuration methods: modifying the Envoy binary, the Consul source code, or the agent binary are unsupported hacks that alter the software itself rather than configuring Connect through its documented interfaces, and they would break upgrades and support.

Answer

Directly modifying the Envoy binary.

Answer

Modifying the Consul source code.

Answer

Editing the agent binary.

Question 13

Which THREE of the following are components of a Consul Connect service definition?

Accepted Answer

proxy. Connect services typically use 'proxy', 'upstreams', and 'connect' blocks to define their behavior in the mesh.

Answer

acl_policy

Answer

kv_store

Question 14

Which TWO of the following are benefits of using Consul Connect?

Accepted Answer

Centralized authorization policies.. Consul Connect is HashiCorp's service mesh feature, and one of its core benefits is centralized authorization policies (Option A): intentions define which services may communicate with which others, and these policies are managed centrally in Consul and enforced by sidecar proxies, giving consistent, identity-based access control across the mesh. Option B is also correct because Consul Connect automatically manages mTLS: it provides built-in certificate authority functionality that issues, rotates, and distributes certificates to sidecar proxies, so service-to-service traffic is encrypted and mutually authenticated without application changes. Option C is wrong because Connect's sidecar proxies add only minimal overhead and are not intended to increase latency as a benefit. Option D is wrong because firewalls are still required for network segmentation and host-level security; Connect complements rather than eliminates them. Option E is wrong because Consul Connect is a service mesh for secure service communication, not a database replication tool.

Answer

Increased application latency.

Answer

Elimination of firewalls.

Answer

Automatic database replication.

Question 15

Which TWO of the following are valid ways to monitor Consul Connect performance?

Accepted Answer

Envoy stats endpoint.. Option A (Envoy stats endpoint) is correct because Consul Connect uses Envoy sidecar proxies for its service mesh data plane, and each Envoy proxy exposes a /stats endpoint (typically on port 19000 via the admin interface) that reports detailed metrics such as upstream request counts, latency histograms, and connection errors, making it a valid way to monitor Connect performance. Option C (Prometheus metrics) is correct because Consul and Envoy both expose metrics in Prometheus format — Consul's /v1/agent/metrics endpoint and Envoy's /stats/prometheus endpoint — which can be scraped to monitor Connect proxy and mesh health. Option B is not a valid monitoring method because changing Consul log levels to 'debug' only increases log verbosity for troubleshooting; it does not provide performance metrics. Option D is not specific to Consul Connect, as checking system RAM is a generic host resource check rather than a Connect performance monitoring technique. Option E is incorrect because Consul Connect does not involve directly querying a database; it is a service mesh feature for securing service-to-service communication.

Answer

Modifying Consul log levels to 'debug'.

Answer

Checking the system RAM.

Answer

Directly querying the database.