194 questions total · 3pages · All types, answers revealed
Which states can a health check report? (Select THREE)
Healthy state.
Why this answer
The three standard states are passing, warning, and critical.
You want to ensure that specific services in a remote datacenter are only accessible to certain local services. How can you achieve this?
Intentions are the correct tool for traffic authorization.
Why this answer
Intentions are the native Consul mechanism to control service-to-service communication, and they work across datacenters when correctly configured.
A service in datacenter A needs to call a service in datacenter B. If 'prepared_queries' are not used, how does the service discovery query look?
Adding the datacenter name is the standard way to cross-DC query.
Why this answer
When not using prepared queries, standard DNS discovery across DCs follows the pattern <service>.service.<datacenter>.consul.
You have a service that needs to talk to a service in a different datacenter. What configuration is required?
Mesh gateways act as the entry/exit points for cross-DC traffic.
Why this answer
Mesh gateways are required to route cross-datacenter traffic in a Consul Connect mesh.
Which flag can be used to pass arbitrary metadata to a KV entry?
Flags is the defined field for metadata.
Why this answer
The 'flags' field in the KV API allows users to store an unsigned integer for application-specific metadata.
What is the default port used for WAN gossip between Consul servers?
8302 is the correct port for WAN gossip.
Why this answer
The default port for WAN gossip is 8302, distinct from the LAN gossip port 8301.
Which THREE of the following are standard Consul KV CLI subcommands?
Used to create/update keys.
Why this answer
'put', 'get', and 'delete' are the standard CLI subcommands for KV.
When configuring an ACL policy for cross-datacenter access, what policy rule is necessary to read service information from a remote datacenter?
Reading node/service info requires read access to the namespace.
Why this answer
You need 'service_prefix' or 'node_prefix' policies that explicitly allow reading in the target datacenter.
Which TWO of the following are valid ways to trigger a KV watch?
Value updates trigger watches.
Why this answer
Watches can be triggered by a change in the KV value or a change in the ModifyIndex (which occurs on any write).
Which TWO of the following are prerequisites for successful WAN federation?
This is essential for ACL/federation consistency.
Why this answer
WAN gossip ports must be open between server nodes, and the primary datacenter must be correctly identified.
If you are using SPIRE for certificate management, how does this interact with Consul Connect?
Consul supports plugging in external CAs via the CA provider configuration.
Why this answer
SPIRE can act as the CA (Certificate Authority) for Consul, issuing identities to services within the mesh.
Which TWO of the following statements are true about the 'passing' parameter in DNS queries?
Correct behavior.
Why this answer
It filters to only healthy instances and is specific to the DNS interface.
Which THREE configuration items are part of a complete WAN gossip setup?
Only servers participate in WAN gossip.
Why this answer
WAN setup requires joining the WAN pool, defining the server role, and potentially setting encryption.
What happens to the gossip protocol if the 'encrypt' key is mismatched between two datacenters trying to join via WAN?
Encryption key mismatch prevents gossip communication.
Why this answer
If the encryption keys do not match, the agents will be unable to decrypt the gossip packets and the join will fail.
Which TWO of the following are valid ways to monitor Consul Connect performance?
Standard way to see proxy metrics.
Why this answer
Consul exposes metrics via Prometheus and Envoy provides stats through its own API.
When joining a new datacenter to an existing WAN pool, what is the best practice for server versions?
Consistency is a best practice for operational stability.
Why this answer
Running different versions of Consul is supported during upgrades, but maintaining consistent versions across the federation is recommended for stability.
Which THREE of the following fields are typically included in a service metadata (meta) block?
Common use case.
Why this answer
Meta is used for arbitrary key-value pairs to support application logic.
An administrator needs to query service information. Which DNS record type is commonly used by Consul to return service addresses?
SRV records are the standard for service discovery in DNS.
Why this answer
Consul maps service names to SRV or A records for discovery.
A service has a TTL check configured with a 30-second TTL. If the application crashes and stops sending heartbeats, when will the service status change to 'critical'?
The status transitions to critical after the TTL duration.
Why this answer
Consul marks a TTL check as critical if the heartbeat is not received within the specified TTL duration.
Which TWO of the following can be used to filter services during a DNS query?
Filters services by datacenter.
Why this answer
DNS queries allow filtering by tags and datacenters.
Which TWO of the following are valid ways to troubleshoot inter-datacenter communication issues?
RPC logs reveal cross-DC connectivity issues.
Why this answer
Verifying WAN gossip members and checking server logs for RPC errors are standard troubleshooting steps.
What is the purpose of the 'service-tag' in a Consul service definition?
Tags are flexible labels for service instances.
Why this answer
Tags are used for filtering and identifying specific instances or versions of a service.
A service 'api' is configured with mTLS. You want to rotate the CA root certificate without interrupting existing connections. What is the recommended strategy?
Adding to additional_roots allows for a transition period where both CAs are trusted.
Why this answer
Consul supports a 'prepared_ca' rotation where the new CA is added to the trust bundle before the old one is removed.
Which TWO of the following are true regarding Consul KV watches?
Watches are implemented using long polling.
Why this answer
Watches can be configured via agent configuration or the API, and they use blocking queries internally.
When defining a TCP health check, what is the primary indicator that the check is 'passing'?
Successful connection implies the service is reachable.
Why this answer
A TCP check is considered passing if the Consul agent can successfully establish a TCP connection to the specified port.
What is the function of the 'retry_join_wan' configuration?
It ensures the WAN join succeeds over time.
Why this answer
The 'retry_join_wan' configuration allows the agent to repeatedly attempt to join the WAN gossip pool at startup if the initial attempt fails, improving robustness.
You are using a Consul Watch to monitor KV changes. What does the 'handler' field specify?
The handler is the command or script to run.
Why this answer
The handler field specifies the path to an executable that should be triggered when a change is detected.
What is the purpose of the 'datacenter' field in the Consul agent configuration?
Consul uses this to organize agents into functional groups.
Why this answer
The datacenter field defines the name of the datacenter the agent belongs to, which is used for service registration and routing.
When a health check is failing, which Consul API endpoint would you call to investigate the specific error message provided by the check?
Returns the check status including the output field.
Why this answer
The '/v1/health/checks/<service>' endpoint provides detailed information about the status and output of checks for a given service.
Which THREE items are required when configuring ACL replication in Consul?
The mechanism must be turned on.
Why this answer
ACL replication needs a defined primary, a valid token for reading, and the enabled replication flag.
Which component acts as the default sidecar proxy for Consul Connect?
Envoy is the primary supported proxy for Consul Connect.
Why this answer
Envoy is the default and recommended sidecar proxy for Consul Connect.
Which TWO of the following describe a Consul 'service definition'?
The agent monitors the config dir.
Why this answer
They are JSON/HCL files and are monitored by the agent.
What is the purpose of the 'upstreams' block in a service definition?
Upstreams are the outbound dependencies.
Why this answer
It defines the targets that the sidecar proxy should be allowed to proxy requests to.
You are joining two Consul datacenters via WAN gossip. Which command must be executed on a Consul server in the secondary datacenter to initiate the federation?
The -wan flag is required for cross-datacenter gossip.
Why this answer
The consul join command with the -wan flag is the standard mechanism to introduce a node from one datacenter into the WAN gossip pool of another.
When a session is associated with a lock, what happens to the lock if the session is deleted?
Session deletion triggers the release of associated locks.
Why this answer
Deleting a session immediately releases any locks associated with that session.
Which TWO of the following are true about the 'cas' parameter in KV writes?
Correct definition.
Why this answer
The 'cas' parameter stands for Check-And-Set and requires the index to be provided to ensure atomicity.
Which THREE items are included in the metadata shared via WAN gossip?
Needed for cross-DC routing.
Why this answer
WAN gossip shares node membership, datacenter association, and health status for the server nodes.
A service is intermittently failing to resolve via DNS because it has multiple health checks, some of which are 'warning'. How do you ensure it is only returned when all checks are 'passing'?
The 'passing' parameter forces Consul to return only services with passing status.
Why this answer
Consul DNS returns services if they are not in a 'critical' state by default; enforcing strict 'passing' requires query parameters.
What happens to a session if the associated node is marked as 'failed' by the Consul health check?
Health check failure triggers the countdown for session invalidation.
Why this answer
When a node fails, the sessions associated with that node are invalidated after the session TTL expires.
Which THREE features are critical for maintaining ACL consistency across datacenters?
Required for replication.
Why this answer
Consistent ACLs require a primary source, replication tokens, and correctly configured secondary datacenters.
Which actions can you perform on a TTL check? (Select TWO)
Sets to passing.
Why this answer
You can tell Consul that the check passed or is in a warning state.
Which THREE of the following are valid ways to categorize services in Consul?
Used for custom attributes.
Why this answer
Tags, meta fields, and namespaces are ways to group services.
When using 'Consul Connect native' integration, how does the application handle mTLS?
Native apps use the Consul secret API to get their identity.
Why this answer
In native integration, the application uses the Consul API to retrieve certificates and handles the mTLS handshake itself.
You have enabled ACL replication between a primary and secondary datacenter. What is the effect of changing an ACL policy in the primary datacenter?
ACL replication is an asynchronous process that pushes updates from primary to secondaries.
Why this answer
ACL replication automatically propagates changes from the primary to secondary datacenters to maintain consistency.
You observe a 'warning' status for a service. What is the most common reason for this?
Warning signifies degraded health.
Why this answer
A 'warning' status typically occurs when the service is reachable but is reporting a non-critical issue, such as high latency or exceeding a custom defined threshold in a custom script.
What command displays the currently registered services in the local agent?
This lists all services known to the catalog.
Why this answer
'consul catalog services' is the standard way to list services.
You want to perform a blocking query on a KV key to watch for updates. Which parameter must you provide in your request based on the last observed index?
The index parameter specifies the last known index to block on.
Why this answer
The index parameter is used in the query string to inform Consul that you want to wait until the current state index is greater than the provided value.
You have a service that requires specific routing logic based on the environment. How can you distinguish between 'production' and 'staging' instances of the same service name using metadata?
Tags allow for logical grouping and filtering of services sharing the same name.
Why this answer
Service tags are the standard way to categorize and filter services within the Consul catalog.
What is the primary role of the Consul Connect 'upstream' configuration?
Upstreams define what a service depends on.
Why this answer
Upstreams define the dependencies of a service, allowing the proxy to route to specific services.
When using Consul KV for distributed locking, why is it recommended to use a session?
This prevents orphaned locks.
Why this answer
Sessions provide a mechanism for TTL-based auto-release, which prevents deadlocks if an application crashes while holding a lock.
How does Consul handle service discovery when using the 'prepared query' feature?
Prepared queries act as a template for discovery with advanced features.
Why this answer
Prepared queries allow for complex, pre-defined discovery logic including failover.
What is the primary difference between a 'script' check and an 'http' check in terms of how they are processed by the Consul agent?
Script checks require host-level execution.
Why this answer
Script checks run an external binary or shell script on the host, while HTTP checks involve the agent making a network request to the service.
Which TWO statements are true regarding Consul Mesh Gateways?
This is their primary use case.
Why this answer
Mesh gateways function at Layer 7 and are essential for connectivity between isolated datacenters.
What is the correct way to specify a local bind port for an upstream service?
This is the correct syntax for an upstream definition.
Why this answer
Inside the upstream block, the 'local_bind_port' key sets the port the proxy listens on.
Which of the following are true regarding TTL checks? (Select TWO)
Push-based model.
Why this answer
TTL checks do not have an interval and require manual updates.
Where can you define health checks in Consul? (Select THREE)
Global definitions.
Why this answer
Checks can be defined in configuration files, via the HTTP API, or within a service definition.
An application is using Consul KV to store configuration. You notice that the KV store is becoming large. What is the most efficient way to retrieve only the keys under the prefix "service/web/"?
Recurse=true returns all keys sharing the specified prefix.
Why this answer
The recurse parameter allows the KV API to return all keys with a matching prefix, rather than just the single key specified.
If a KV operation returns a 403 Forbidden status, what is the most common cause?
A 403 indicates a policy violation.
Why this answer
ACLs (Access Control Lists) are enabled, and the client token lacks the 'write' permission for that specific prefix.
How do you enable mTLS globally in a Consul datacenter?
This is the standard agent-level configuration for Connect.
Why this answer
mTLS is enabled by default in modern Consul versions, but can be configured in the agent config via 'connect.enable_connect'.
Which file format is used for Consul configuration?
Consul accepts both formats.
Why this answer
Consul supports both HCL (HashiCorp Configuration Language) and JSON for its configuration files.
How are intentions applied to services in different partitions or namespaces?
Namespaces require explicit scoping in intentions.
Why this answer
Intentions are scoped to the namespace, and cross-namespace intentions require the namespace name.
Which TWO of the following actions occur when a node fails in a Consul cluster?
Health status changes.
Why this answer
The node is marked down, and its services are removed from the catalog.
Which TWO of the following are true about Consul datacenters?
Servers are required for consensus.
Why this answer
Datacenters are logical groupings and require independent server quorums.
You need to deny all traffic between 'service-a' and 'service-b' using intentions. What is the most efficient way to achieve this?
This command directly creates a deny-type intention.
Why this answer
Intentions can be set to 'deny' explicitly, which overrides any 'allow' rules.
You have implemented a leader election mechanism using Consul KV sessions. The session has a TTL of 15 seconds. If the application crashes, how long will it take for the lock to be automatically released?
The session TTL defines the duration after which an un-renewed session is invalidated, releasing associated locks.
Why this answer
When a session has a TTL, the lock is released when the session is invalidated by the health check failure. The default session invalidation is tied to the TTL.
Which THREE factors influence cross-datacenter service discovery resolution?
Required for cross-DC communication.
Why this answer
Resolution depends on the ability to query the remote DC, the health status of the remote instances, and the configuration of the local discovery agent.
If a Consul agent is configured with 'disable_remote_exec = true', how does this affect the KV store?
Remote exec and KV store are distinct features.
Why this answer
This setting does not impact the KV store; it only restricts the execution of remote commands via the Consul event system.
You want to run a shell command as a health check. Which field in the service definition specifies the command to execute?
The 'script' field contains the execution string.
Why this answer
The 'args' or 'script' field is used to define the command the Consul agent executes to perform a script check.
Which THREE of the following are valid session behaviors when a session is invalidated?
The lock remains held (if supported by specific implementation logic).
Why this answer
Consul sessions support 'release' (default), 'delete' (deletes the key), and no other behaviors. 'Release' is the standard behavior.
You are using Consul Template to observe health status. What happens to a service's health check status if the network segment between the agent and the server is partitioned and the server cannot contact the agent?
The server marks the check as critical due to timeout/unreachability.
Why this answer
If a server cannot reach the agent performing the check, the health status becomes unknown or unreachable, often reflected as a critical status for the service until connectivity is restored.
Which of the following are valid types of health checks in Consul? (Select TWO)
Valid check type.
Which of the following best describes the 'consul agent -dev' mode in relation to service discovery?
Dev mode creates a quick, single-node cluster.
Why this answer
Dev mode is for testing and has ephemeral storage.
When using 'prepared_queries' for cross-datacenter failover, what does the 'failover' block allow you to specify?
This is the primary function of the failover block.
Why this answer
The 'failover' block in a prepared query allows you to define a list of datacenters to try if the local datacenter lookup returns no healthy instances.
Which file format is primarily used for defining services in Consul?
JSON is the standard format for Consul configuration.
Why this answer
Consul supports JSON or HCL.
In a Consul health check, what does the 'notes' field provide?
Used for documentation purposes.
Why this answer
The 'notes' field allows operators to add human-readable descriptions of what the health check monitors.
Practice Consul 1.15 by domain
Target a specific domain to shore up weak areas.