Consul 1.15 Service Mesh With Consul Connect Practice Test 6 — 15 Questions

Question 1

A developer is deploying a new service called 'inventory' with a Connect sidecar proxy. They want to verify that the sidecar is running and registered correctly. Which command should they use to check the status of the Connect-enabled service?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

consul health service inventory. To check the status of a Connect-enabled service, you should use 'consul health service' because it returns the health checks for the service and its sidecar proxy. The sidecar proxy is registered as a separate service, so you can also query it directly. Commands like 'consul catalog nodes' only show node placement, not health or proxy status.

Answer

consul catalog nodes -service=inventory

Answer

consul services status inventory

Answer

consul connect status inventory

Question 2

An operator manages a Consul 1.15 cluster where Connect is enabled and mTLS is active. They need to rotate the Connect CA root certificate for the datacenter. The new root must be distributed to all sidecar proxies without dropping existing connections, and the old root must remain trusted during the transition. Which sequence of actions accomplishes this?

Accepted Answer

Generate a new CA, cross-sign the new intermediate with the old root, update the CA configuration with the cross-signed bundle, then allow proxies to rotate leaf certificates via the existing CA provider.. The safe rotation path uses cross-signing: the new intermediate is signed by the old root so both roots are trusted during the transition. Updating the CA configuration with the cross-signed bundle lets Consul distribute the new root, and leaf certificates rotate automatically through the CA provider. This avoids downtime and preserves existing connections, unlike replacing the root outright or toggling mTLS.

Answer

Disable Connect, replace the CA, re-enable Connect, and re-register all services with new sidecar proxies.

Answer

Use 'consul connect ca set-config' to update the root certificate and private key, then restart all sidecar proxies to pick up the new root.

Answer

Set 'connect.enable_mtls' to false, update the CA, then set it back to true to force proxies to fetch new certificates.

Question 3

A team is running Consul 1.15 with Connect and wants to expose a TCP service through an ingress gateway so external clients can reach it over mTLS. They define the gateway and a listener on port 8443. External clients report TLS handshake failures. The gateway logs show no matching certificate. Which configuration element must be present for the listener to serve TLS?

Accepted Answer

A TLS certificate and private key must be provided for the listener, either inline or via an SDS or file reference.. Ingress gateway listeners that terminate TLS must be given a certificate and private key. Consul supports inline certificates, file-based references, and SDS integrations such as Vault. Without this material the gateway cannot complete the TLS handshake, producing the handshake failures and missing-certificate log entries. Routing and intention configuration are separate concerns from certificate provisioning.

Answer

The gateway's service registration must include the 'connect: { gateway: {} }' stanza and a matching intention for the external client.

Answer

The listener must set 'protocol = "tcp"' and rely on the client to perform mTLS directly to the backend service.

Answer

The listener must reference a service-resolver that includes a 'tls' subset before it can accept TLS connections.

Question 4

A developer needs to see which intentions currently govern traffic between services in a Consul 1.15 datacenter. Which command lists all intentions stored in the catalog?

Accepted Answer

consul intention list. Intentions are managed through the consul intention command family, and the list subcommand returns all stored rules for the datacenter. Commands that inspect the catalog or test a single source-destination pair do not enumerate the full set of authorization rules. For a complete audit, listing intentions is the correct operation.

Answer

consul connect intentions

Answer

consul intention check

Answer

consul catalog services -intentions

Question 5

A service mesh operator is troubleshooting a connectivity issue between two services in a Consul 1.15 datacenter. The sidecar proxy for the 'frontend' service cannot reach the 'backend' upstream. The operator has confirmed that intentions allow the traffic. Which log should they inspect first to diagnose the issue on the sidecar proxy?

Accepted Answer

The Envoy proxy logs for the frontend sidecar.. The Envoy sidecar proxy logs are the most detailed source for diagnosing connectivity issues between services in a Connect mesh. They record upstream connection attempts, TLS errors, and response flags. While Consul agent and server logs can provide context, they lack the granularity needed to pinpoint why a specific proxy cannot reach its upstream. Checking the proxy logs first is the most efficient troubleshooting step.

Answer

The systemd journal for the 'backend' service.

Answer

The Consul agent logs on the node running the frontend service.

Answer

The Consul server logs on the leader.

Question 6

You are configuring a Consul Connect service mesh and need to enable mTLS for all services in the datacenter. Which configuration setting must be enabled in the Consul server agent configuration to turn on Connect and enforce mTLS globally?

Accepted Answer

connect { enabled = true }. To enable Consul Connect and mTLS globally, the 'connect' stanza with 'enabled = true' must be set in the Consul agent configuration, typically on all servers and clients. This activates the Connect subsystem, allowing services to obtain certificates and use sidecar proxies. Other settings like TLS verification for the agent, HTTPS port, or ACLs do not enable Connect.

Answer

tls { defaults { verify_incoming = true } }

Answer

ports { https = 8501 }

Answer

acl { enabled = true, default_policy = "deny" }

Question 7

A developer registers a service called 'web' with a sidecar proxy in a Consul 1.15 datacenter. The service needs to call a backend service named 'api' through the mesh. The developer adds an upstream block to the 'web' service definition pointing to 'api' on port 8080. What does this upstream configuration accomplish for the 'web' sidecar proxy?

Accepted Answer

It creates a local listener on the 'web' sidecar that forwards traffic to an 'api' proxy instance on port 8080.. Upstreams are declared in the calling service's definition and cause its sidecar proxy to open a local listener. The application connects to that local port, and the proxy forwards traffic to a healthy instance of the upstream service through the mesh. This provides service discovery, mTLS, and load balancing without the application knowing backend addresses.

Answer

It configures the 'web' sidecar to accept inbound connections from 'api' on port 8080.

Answer

It enables mTLS between 'web' and 'api' by generating a shared certificate for both services.

Answer

It registers 'api' as a dependency in the Consul catalog so that 'web' can discover its IP address directly.

Question 8

A service 'orders' must call an upstream database service through its sidecar proxy. The upstream is registered in the same Consul datacenter and the operator wants the sidecar to discover it dynamically rather than hard-code an address. Which upstream configuration entry in the sidecar_service stanza accomplishes this?

Accepted Answer

destination_name set to the upstream service name, with no destination_type or fixed address.. Dynamic discovery for a sidecar upstream is achieved by naming the target service and letting the default service destination type drive catalog lookups. The proxy then watches Consul for healthy instances and balances across them. Static addressing, remote datacenter scoping, and prepared queries all change that behavior in ways the scenario does not require.

Answer

A local_bind_port and a destination_name, but with destination_type omitted and datacenter set to a remote value.

Answer

destination_type set to 'static' with a destination_name equal to the upstream's DNS name.

Answer

destination_type set to 'prepared_query' with a destination_name matching the upstream service.

Question 9

You are deploying a Consul Connect service mesh in a Consul 1.15 datacenter. You want to ensure that all service-to-service traffic is encrypted and authenticated. What is the default behavior for intentions when no intention is defined between two services?

Accepted Answer

Traffic is denied by default, and mTLS is enforced for allowed connections.. Consul Connect uses a default-deny model for intentions. If no intention explicitly allows traffic between two services, the connection is denied. For allowed connections, mTLS is enforced by the sidecar proxies. This is a fundamental security principle of Consul Connect, ensuring that no unauthorized traffic flows between services.

Answer

Traffic is denied only if the Consul ACL system is enabled.

Answer

Traffic is allowed only if both services have mTLS enabled.

Answer

Traffic is allowed by default, and mTLS is still enforced.

Question 10

A security team requires that a service 'reporting' only accept connections from services presenting a valid mesh certificate issued by the Connect CA, and that all other traffic be rejected. They have registered reporting with a sidecar proxy. Which combination ensures this behavior?

Accepted Answer

Rely on the default deny behavior of intentions and create allow intentions only for the intended callers.. Connect's built-in default-deny behavior means a sidecar rejects any inbound connection without a matching allow intention, and mTLS ensures only holders of valid Connect certificates can attempt the handshake. Explicit allow intentions for the intended callers complete the configuration. Protocol settings, agent TLS flags, and wildcard allows do not provide the required selective access.

Answer

Set 'protocol' to 'tcp' in a service-defaults entry and create a deny intention for all other services.

Answer

Create a wildcard allow intention for all sources, then use ACLs to restrict which services can obtain a certificate.

Answer

Disable TLS verification on the sidecar by setting verify_outgoing to false.

Question 11

You are troubleshooting a Consul Connect service mesh and need to verify which intentions are currently configured. Which Consul CLI command lists all intentions?

Accepted Answer

consul intention list. The correct command to list all intentions is 'consul intention list'. This command retrieves and displays all intentions configured in the Consul datacenter. The other options are either non-existent commands or incorrect syntax. Being able to quickly list intentions is essential for troubleshooting and auditing Connect authorization.

Answer

consul connect intentions

Answer

consul intention get -all

Answer

consul catalog intentions

Question 12

A financial services firm requires that all service-to-service traffic inside its Consul 1.15 datacenter be encrypted and that services accept connections only when an explicit intention permits them. An operator enables Connect on all agents but services still accept plaintext traffic from non-mesh clients. Which additional step is required to enforce encryption and deny-by-default for the whole datacenter?

Accepted Answer

Set 'connect.enabled = true' in the agent configuration and register a default-deny intention, then ensure services only listen on loopback or are reachable solely through their sidecar proxy.. Enabling Connect provides the mTLS data plane, and a default-deny intention establishes least privilege so every allowed path must be stated explicitly. However, if the application still listens on a routable address, non-mesh clients can connect in plaintext and bypass the proxy entirely. Binding the workload to loopback or exposing it only through the proxy closes that gap, making encryption and deny-by-default enforceable for all traffic.

Answer

Enable TLS on the agents and rely on gossip encryption to protect service traffic.

Answer

Create a default-deny intention and set 'connect.enabled = true' in the server configuration only.

Answer

Configure the sidecar proxies to bind the service's original port and set a default-deny intention, so all inbound traffic must pass through the proxy.

Question 13

You are operating a Consul 1.15 cluster with Connect enabled. A service named 'api' is registered with a sidecar proxy. You need to ensure that only the 'web' service can initiate connections to 'api'. You have created an intention that allows 'web' to connect to 'api', but you have not created any other intentions. What is the default behavior for other services trying to connect to 'api'?

Accepted Answer

They are denied because the default intention behavior is 'deny'.. In Consul Connect, intentions are deny by default. When you create an intention allowing 'web' to connect to 'api', that is the only allowed path. All other services are denied because there is no intention permitting them. This default-deny model is fundamental to Consul's security posture, ensuring that only explicitly authorized services can communicate, which reduces the attack surface.

Answer

They are allowed because the default intention behavior is 'allow'.

Answer

They are allowed only if they have a valid mesh certificate.

Answer

They are denied only if the 'api' service has a specific intention denying them.

Question 14

A platform team runs Consul 1.15 with Connect enabled. Their service 'api' is registered with a sidecar proxy, and its upstream 'database' is also mesh-enabled. The team wants 'api' to resolve 'database' through the mesh without hard-coding an IP address in the application. Which configuration in the service registration enables the sidecar to expose a stable local listener for the upstream?

Accepted Answer

Add an 'upstreams' block inside api's 'connect.sidecar_service' stanza with a 'destination_name' of 'database'.. For a mesh-enabled consumer, upstreams are declared on the consuming service's sidecar proxy. The upstream block names the destination service and optionally sets a local bind port, causing the sidecar to listen locally and forward to the destination over the mesh. This gives the application a stable local address and avoids hard-coded IPs.

Answer

Define a 'connect' block in the 'database' service registration with a 'sidecar_service' stanza.

Answer

Create a service-resolver config entry that maps 'database' to a fixed IP address.

Answer

Register 'database' with a 'tagged_addresses' entry containing a LAN address.

Question 15

A team runs Consul 1.15 with Connect. They want to observe which services are allowed to communicate with a specific service named 'inventory' and confirm whether a particular source is permitted, without sending real traffic. Which command should they use to query the effective intention decision for a source and destination?

Accepted Answer

consul intention check -source billing -destination inventory. The intention check subcommand evaluates the effective decision for a source and destination pair, factoring in matching intentions and the default policy. It is the direct way to verify whether a source is permitted to reach a destination without generating real traffic, which is exactly what the team needs.

Answer

consul catalog nodes -service inventory

Answer

consul intention list -destination inventory

Answer

consul connect envoy -sidecar-for inventory --dry-run