194 questions total · 3pages · All types, answers revealed
Page 1 of 3
Page 2Which THREE items are required to configure an upstream service?
Required to identify the dependency.
Why this answer
Upstreams require a destination service name, a local bind port, and the destination datacenter (if external).
What is the default value for the Consul KV flags field if not provided during a write?
Flags defaults to 0.
Why this answer
The default value for flags is 0.
Which Consul agent configuration parameter defines the KV store file location when running locally?
Consul stores all state data in the directory specified by data_dir.
Why this answer
While the KV store is in-memory, its persistence (if snapshots are used) is managed by the data_dir.
You need to perform a write operation to the Consul KV store that only succeeds if the current ModifyIndex of the key is zero. Which parameter should you include in your API call?
The cas parameter with a value of 0 is the standard way to perform a create-if-not-exists operation.
Why this answer
The cas (Check-And-Set) parameter allows for atomic operations. Setting cas to 0 ensures the write only occurs if the key does not already exist.
You are configuring a service check that needs to be ignored if the node is in maintenance mode. What is the correct approach?
The maintenance command puts the node into a state where health checks are ignored.
Why this answer
Maintenance mode stops health checks from affecting the service's passing/failing status.
Which interface would you use to register a service dynamically using standard tools like 'curl'?
The HTTP API allows POSTing service definitions.
Why this answer
The Consul HTTP API is the standard interface for dynamic registration.
Which TWO of the following are benefits of using Consul Connect?
Intentions provide this.
Why this answer
Consul Connect simplifies mTLS management and provides secure service-to-service authorization.
Which THREE of the following represent potential bottlenecks for Consul KV performance?
Massive key counts increase memory usage.
Why this answer
High update frequency, massive key counts, and large value sizes all impact KV performance.
You are monitoring service health using Consul and want to ensure that a service is automatically removed from the catalog if it remains in a 'critical' state for more than 24 hours. Which configuration key supports this?
This is the correct parameter for automatic removal.
Why this answer
The 'deregister_critical_service_after' parameter specifies the threshold after which a service in a critical state is automatically deregistered.
You need to register a health check that triggers an alert when memory usage is high. Which type of check is most appropriate?
Script checks allow arbitrary local execution.
Why this answer
A script check can execute a local binary or script to monitor memory and return an exit code.
Which TWO of the following are consequences of a primary datacenter outage in a federated environment?
Replication relies on the primary.
Why this answer
ACL replication stops and management changes cannot be made, but existing traffic and local discovery continue.
You need to register a service that runs on a dynamic port. How should the service definition be configured to allow Consul to detect the port?
Setting port to 0 signals to Consul that the port is dynamic.
Why this answer
Consul allows the use of 0 as a port, and the registration process typically involves discovering the port via an external process or environment variable.
A cross-datacenter service discovery request is failing. You observe the local datacenter can resolve the service via DNS, but the remote datacenter cannot. Which configuration parameter must be checked?
The primary_datacenter must be correctly defined for ACL and gossip coordination across the federation.
Why this answer
The 'primary_datacenter' and 'allow_stale' settings are crucial, but cross-DC discovery often fails if the 'enable_local_script_checks' or specific WAN gossip configurations prevent cross-link visibility.
You are troubleshooting a partition between two datacenters. The WAN gossip shows high latency. Which Consul CLI tool provides the best insight into the WAN gossip state?
This command specifically shows members across the WAN gossip pool.
Why this answer
The 'consul members -wan' command provides a view of the nodes known to the local server in the WAN pool.
You observe that a session lock is being released unexpectedly. What is the most likely cause?
If network latency prevents the renewal, the session expires.
Why this answer
If the session TTL is too short, the agent might fail to renew the session in time, causing it to expire.
If you need to perform an HTTP check over HTTPS, what configuration option is required to handle self-signed certificates?
This enables checking against self-signed certs.
Why this answer
The 'tls_skip_verify' parameter allows the agent to skip verification of the service's TLS certificate.
Which command displays all active intentions in the Consul mesh?
This command lists all configured intentions.
Why this answer
The 'consul intention list' command provides the current list of intentions.
Which THREE tasks are performed by the Consul agent for Connect?
The agent starts/stops the proxy.
Why this answer
The agent manages proxy lifecycle, certificate retrieval, and service discovery for the mesh.
You need to ensure a service instance is removed from the catalog immediately after the service process terminates. Which setting helps?
This defines how long a service stays in the catalog after failing health checks.
Why this answer
The 'deregister_critical_service_after' setting defines the timeout before cleanup.
What is the purpose of the 'Behavior' field when creating a Consul session?
The behavior field defines if locks are released or the key is deleted.
Why this answer
The behavior field determines what happens to locks when a session is invalidated; 'release' is the default, while 'delete' removes the key.
Which TWO are common use cases for Consul Connect?
Connect enables zero-trust.
Why this answer
Consul Connect is commonly used for secure service communication and service discovery in complex environments.
When configuring ACL replication, where must the 'acl_replication_token' be defined?
Secondary servers need the token to authenticate with the primary.
Why this answer
The replication token is configured on the secondary datacenter's Consul servers to allow them to read from the primary.
A service definition includes a 'meta' block. What is the intended use of this block?
Metadata allows for extensible annotations.
Why this answer
The meta block is for arbitrary key/value pairs related to the service instance.
You are troubleshooting a connection error where the sidecar proxy cannot reach the upstream service. Which log file provides the most detail regarding Envoy's connectivity issues?
Envoy access logs specifically detail proxy-level connectivity.
Why this answer
The sidecar proxy logs, typically routed to stdout or a specific file via the proxy configuration, contain Envoy access logs.
Which status indicates that a health check is successfully passing according to Consul?
Passing indicates health.
Why this answer
The status 'passing' represents a healthy check in Consul.
What is the function of the 'consul intention check' command?
This command tests the current intention configuration.
Why this answer
It tests if a connection between two services is allowed by existing intentions.
Which THREE of the following are valid check types in Consul?
Standard health check type.
How does Consul handle service discovery in multi-datacenter environments when a service is requested by name?
Using '<service>.service.<datacenter>.consul' enables cross-datacenter lookups.
Why this answer
Consul can perform cross-datacenter lookups if the query includes the datacenter or if configured to do so.
Which service definition field is used to link a sidecar proxy to its parent service?
This field links the proxy to the service it proxies.
Why this answer
The 'proxy' block inside the 'service' definition contains the 'destination_service_name' to link it.
How do you enable WAN federation between two Consul datacenters that do not share a network?
Mesh gateways are the designated way to connect isolated datacenters.
Why this answer
Mesh gateways allow cross-datacenter communication in environments where direct WAN gossip is not possible.
Which HTTP method is used to create or update a key in the Consul KV store?
PUT is used to write/update KV data.
Why this answer
The PUT method is the standard HTTP verb used for key creation and updates in the Consul API.
You need to verify if a node has successfully joined the cluster for service discovery. Which tool confirms this?
Members shows the gossip cluster status.
Why this answer
'consul members' lists the nodes in the cluster.
Which THREE of the following are valid ways to register a service in Consul?
Used with Consul K8s.
Why this answer
Services can be registered via files, HTTP API, or Consul K8s mechanisms.
You have configured a Script health check that executes a shell command. For security reasons, you want to restrict which scripts the Consul agent can run. What configuration setting must be set to 'false' in the agent configuration to disable script checks entirely?
This flag controls the ability of the agent to execute scripts.
Why this answer
The 'enable_script_checks' configuration parameter must be set to false to prevent the agent from executing scripts defined in configuration files.
When configuring a Service-specific health check, what is the impact of setting the 'expose' field to true?
This makes the status publicly reachable on the agent's port.
Why this answer
Setting 'expose' to true allows the service to expose its health checks via the local agent's HTTP interface, enabling external access to the health check status.
What is the role of a Consul server in a non-primary datacenter regarding ACLs?
This is the function of ACL replication.
Why this answer
Secondary servers in an ACL-replicated setup act as a read-only mirror of the primary's ACL policy set.
What is the recommended approach for running health checks on a service that is part of a non-containerized, multi-process architecture?
Consul allows multiple checks per service.
Why this answer
Defining separate health checks for each process or a single composite check that monitors the aggregate health is the standard practice.
If a service has multiple health checks associated with it, when is the service itself considered 'critical'?
A single failed check marks the service as critical.
Why this answer
Consul considers a service critical if any of its associated health checks are in a critical state.
What does the 'kind' field in a service definition specify for a Consul Connect service?
Setting kind to 'connect-proxy' tells Consul this is a sidecar.
Why this answer
The 'kind' field defines if the service is a standard service or a proxy/mesh-gateway.
Which TWO of the following are features of Consul Connect native integration?
Native apps skip the sidecar for mTLS.
Why this answer
Native integration allows apps to manage their own certificates and interact directly with the Consul secret API.
Which THREE of the following fields are returned in a typical Consul KV API GET response?
The index of the last modification is returned.
Why this answer
The Key, Value, and ModifyIndex are standard fields in the KV API response.
Which THREE factors influence the mTLS handshake in a Consul Connect mesh?
Required for authentication.
Why this answer
The CA, the identity certificate, and the trust bundle are all essential to the mTLS handshake.
Which THREE network considerations are vital for Consul WAN federation?
Required for cluster stability.
Why this answer
WAN federation requires specific port accessibility, bandwidth for gossip, and routing between servers.
Which Consul feature allows you to perform health checks against a service that does not have an exposed HTTP endpoint but resides on the same machine?
Script checks can execute any command locally on the node.
Why this answer
Script-based checks run locally on the agent node, allowing monitoring of processes or system resources.
You are configuring a Consul Watch to trigger a script whenever a specific KV key changes. Which type of watch should you define in your configuration file?
Key watches track updates to a specific KV path.
Why this answer
The 'key' watch type is specifically designed to monitor changes to a single KV entry.
Which command-line interface command is used to set a value in the Consul KV store?
Put is the correct verb for setting values.
Why this answer
The 'consul kv put' command is the standard CLI utility for setting key values.
Which of the following is a key feature of Consul Connect's intentions?
Intentions are specifically for access control.
Why this answer
Intentions provide a logical authorization layer for service-to-service communication.
What is the impact of setting 'enable_tag_override' to true in a service definition?
Tag override permits dynamic tag updates.
Why this answer
It allows external systems to modify service tags without updating the service definition file.
When using Consul DNS for a service, what happens if no instances are healthy?
If no service instances are passing, the DNS resolver returns an empty set.
Why this answer
By default, if no healthy instances are found, the DNS query will return no results.
You need to ensure that a service is only discoverable via DNS if it passes its health checks. Which configuration setting in the service definition achieves this?
Using the passing query parameter filters results to only include services with passing health checks.
Why this answer
Consul allows filtering services based on health checks via the 'passing' parameter in the DNS interface or by defining the service with a health check.
Which THREE of the following are true about Consul KV keys?
Values are base64 encoded, allowing binary.
Why this answer
Keys are organized in a hierarchy, they are case-sensitive, and they can store arbitrary data.
Which TWO of the following are true regarding the Consul Service Catalog?
The catalog is the source of truth.
Why this answer
The catalog is replicated via Raft and can be queried via API or DNS.
You want to delete a key and all its children in the KV store using the CLI. Which flag should you use?
-recurse allows recursive operations in the CLI.
Why this answer
The -recurse flag in the CLI allows the delete operation to act on the key and all nested keys.
What is the primary benefit of using a Mesh Gateway in a Consul Connect architecture?
This is the core purpose of the mesh gateway.
Why this answer
Mesh gateways provide a single point of ingress/egress for cross-datacenter traffic, reducing the need for direct cross-DC networking.
Which Consul API endpoint is used to create a new session that can be used for locking KV keys?
This endpoint creates the session required for session-based locking.
Why this answer
The /v1/session/create endpoint is the standard way to initialize a session object in Consul.
Which THREE settings are part of the 'proxy' configuration block?
Defines proxy-level upstream routing.
Why this answer
Proxy config includes local bind ports, configuration for Envoy, and upstream definitions.
In a multi-datacenter environment, what happens if the 'primary_datacenter' server cluster becomes unavailable?
ACL replication requires the primary, but local operations are unaffected.
Why this answer
While ACL replication will stall, the secondary datacenters continue to function using their own local raft states.
When a service check transitions to 'critical', what does Consul do with the service's DNS entry?
Consul dynamic DNS removes failed instances.
Why this answer
Consul removes the service instance from DNS results when its health check is critical.
When using the Consul KV store, what is the maximum size allowed for a single value in a key?
Consul limits the value size to 512 KB.
Why this answer
Consul enforces a hard limit of 512 KB per KV entry value.
When providing a session TTL, what is the minimum duration allowed?
The minimum is 10s.
Why this answer
The minimum session TTL allowed is 10 seconds.
To verify if two datacenters are connected via WAN, which command shows the remote datacenter's server nodes?
This command shows WAN participants.
Why this answer
The 'consul members -wan' command lists all nodes participating in the WAN gossip pool, regardless of their local datacenter.
Which TWO of the following are standard DNS records returned by Consul for service discovery?
Provides service port and target.
Why this answer
Consul uses SRV and A records for service resolution.
You need to perform a canary deployment for a service. What Consul feature should you use?
The service resolver allows traffic splitting/canary configurations.
Why this answer
Consul's service resolver and router resources allow for traffic splitting between different service subsets.
What information does the Consul HTTP API return for a health check? (Select TWO)
Message returned by the check.
Why this answer
The API returns the status and the human-readable output of the check.
Which of these are required fields for a TCP health check definition? (Select THREE)
Check identifier.
Why this answer
TCP checks require tcp, interval, and name fields.
What is true about Consul health checks? (Select TWO)
Locality is required.
Why this answer
They run locally on the agent and can be associated with specific services.
Which TWO of the following are valid ways to configure Consul Connect?
Common method for registration.
Why this answer
Consul Connect can be configured via service definition files or the HTTP API.
When multiple agents are in a cluster, how does Consul ensure that service discovery information is consistent across all nodes?
Raft ensures a consistent replicated state machine for the catalog.
Why this answer
The Gossip Protocol (serf) and Raft consensus maintain state across nodes.
What happens if you try to write to a key that is currently locked by a session you do not own?
Writes to locked keys require the matching session ID.
Why this answer
The write will be rejected if the session ID is not provided or if the session does not match the lock holder.
What is the benefit of using a Mesh Gateway in a multi-datacenter deployment with overlapping IP space?
Mesh gateways proxy traffic at Layer 7, bypassing IP routing issues.
Why this answer
Mesh gateways allow communication between datacenters with overlapping IP ranges by acting as an SNI-based proxy that terminates and re-originates the mTLS connection.
Which HTTP status code range does Consul interpret as a passing state for an HTTP health check?
Consul interprets 2xx as passing.
Why this answer
Consul considers any 2xx status code as a passing health check. Codes 4xx and 5xx result in a critical state.
An operator observes that a service is failing its HTTP health check because the application takes 15 seconds to start up, exceeding the default timeout. Which parameter should be adjusted in the service definition to prevent premature failure?
Specifies the duration the agent waits for a response.
Why this answer
The 'timeout' parameter defines how long the agent waits for a response; increasing it allows the service time to initialize.
When troubleshooting a failing health check, which tools are recommended? (Select TWO)
Provides a visual check status.
Why this answer
Inspecting logs and using the CLI/API to query status are essential for troubleshooting.
When configuring mTLS in Consul Connect, how are certificates distributed to the sidecar proxies?
This is the secure and standard way certificates are delivered.
Why this answer
The Consul agent, acting as the client to the Consul server, fetches the certificates and provides them to the proxy via the xDS API.
You need to ensure that a read operation from the KV store is strongly consistent. Which consistency mode should you specify?
Consistent forces a leader check for strong consistency.
Why this answer
The 'consistent' consistency mode forces the leader to verify its leadership with a quorum of peers, ensuring strong consistency.
Page 1 of 3
Page 2Practice Consul 1.15 by domain
Target a specific domain to shore up weak areas.