265 questions total · 4 pages · All types, answers revealed
Which component acts as the default sidecar proxy for Consul Connect?
Envoy is the default sidecar proxy that Consul Connect injects alongside services, handling mTLS and L4 authorisation between them. It satisfies the stem because Consul ships Envoy as the built-in proxy, though the interface allows alternative proxies to be registered.
Why this answer
Envoy is the default and recommended sidecar proxy for Consul Connect.
What is the purpose of the 'upstreams' block in a service definition?
The upstreams block declares a service's outbound dependencies, letting Consul register each remote service as a local listener that load-balances across healthy instances. This satisfies the stem's requirement to define what the service calls out to, distinct from service registration or health checking.
Why this answer
It defines the targets that the sidecar proxy should be allowed to proxy requests to.
A Consul operator is defining an HTTP health check for a service and wants to ensure the check request includes custom headers and that the check tolerates a slow endpoint. Which two check definition fields should be used to accomplish these goals? (Choose two.)
The timeout field defines how long Consul waits for the check to complete before considering it failed. Increasing the timeout allows the check to tolerate a slow endpoint by giving it more time to respond. This is the correct field to address the slow endpoint requirement in the scenario.
Why this answer
To add custom headers, the header field is used within the HTTP check definition. To tolerate a slow endpoint, the timeout field must be increased to allow more time for the response. Together these two fields satisfy the stated requirements, while method, interval, and tls_skip_verify address different aspects of check behavior.
Exam trap
The trap here is confusing interval with timeout, leading to the belief that running the check less frequently makes it tolerant of slow responses, when only timeout controls how long Consul waits.
You are joining two Consul datacenters via WAN gossip. Which command must be executed on a Consul server in the secondary datacenter to initiate the federation?
The -wan flag directs the join request over the WAN gossip pool rather than the LAN pool, which is the only way to federate separate Consul datacenters. Running consul join without -wan would attempt a LAN gossip join and fail to establish cross-datacenter federation.
Why this answer
The consul join -wan command is used to join a Consul server to the WAN gossip pool of another datacenter. It must be executed on a server in the secondary datacenter, specifying the address of a remote server in the primary datacenter. This establishes the WAN federation, allowing cross-datacenter communication.
Exam trap
The trap is confusing the agent startup flag -join-wan with the runtime command consul join -wan; the former is used when starting an agent, while the latter is for joining an already running agent.
How to eliminate wrong answers
Option A is wrong because consul members -wan only displays the members of the WAN gossip pool; it does not initiate a join. Option C is wrong because consul reload -wan is not a valid command; consul reload reloads agent configuration but does not join a WAN pool. Option D is wrong because consul agent -join-wan is not a valid flag; the correct flag is -join-wan when starting an agent, but the command to join an already running agent is consul join -wan.
You are deploying a Consul Connect service mesh in a Consul 1.15 datacenter. You want to ensure that all service-to-service traffic is encrypted and authenticated. What is the default behavior for intentions when no intention is defined between two services?
Consul Connect follows a default-deny model for intentions. If no intention explicitly allows traffic between two services, the connection is denied. For connections that are allowed, mTLS is automatically enforced by the sidecar proxies. This ensures a secure Zero Trust network.
Why this answer
Consul Connect uses a default-deny model for intentions. If no intention explicitly allows traffic between two services, the connection is denied. For allowed connections, mTLS is enforced by the sidecar proxies.
This is a fundamental security principle of Consul Connect, ensuring that no unauthorized traffic flows between services.
Exam trap
The trap here is assuming that traffic is allowed by default or that enabling mTLS alone permits connections, but intentions must explicitly allow traffic regardless of mTLS.
When a session is associated with a lock, what happens to the lock if the session is deleted?
Deleting a session immediately releases its associated lock, because Consul ties lock lifetime to the session's health rather than to the client holding it. This satisfies the stem's constraint: once the session no longer exists, the lock cannot persist, so waiting contenders acquire it without manual intervention.
Why this answer
Consul locks are bound to the session that acquired them. When a session is deleted — whether explicitly via the session destroy API or implicitly through TTL expiry — Consul automatically releases every lock and KV entry associated with that session. This is the core safety property that makes session-based locking reliable for leader election.
Exam trap
The trap is conflating session deletion with key deletion — candidates may think the lock persists until the KV key is removed, but Consul releases locks on session destruction regardless of whether the key still exists.
How to eliminate wrong answers
Option A is wrong because locks are not held by the server independently of a session; the session is the ownership token, and destroying it releases the lock. Option B is wrong because the lock is not tied to the key's existence — deleting the session releases the lock even though the key remains in the KV store. Option D is wrong because Consul does not transfer locks between sessions; a new session must explicitly acquire the lock via a fresh PUT with the acquire parameter, and lock-delay may block that acquisition temporarily.
Which TWO of the following are true about the 'cas' parameter in KV writes?
The `cas` parameter stands for Check-And-Set, providing optimistic concurrency control for KV writes. Supplying a `cas` value makes the write conditional: Consul compares it against the key's current `ModifyIndex` and only commits if they match, returning an error otherwise. This satisfies the scenario's requirement to prevent overwriting concurrent updates.
Why this answer
Option C is correct because 'cas' stands for Check-And-Set, the Consul KV write flag that makes a write conditional on the key's current ModifyIndex. Option E is correct because using cas requires supplying a valid ModifyIndex value: the write succeeds only if it matches the key's current index, otherwise Consul returns an error (e.g., HTTP 409). The other options are wrong: cas is available through the HTTP API and UI as well as the CLI, it works for existing keys (not only new ones), and it is optional rather than mandatory for all writes.
Exam trap
Consul 1.15 often tests the misconception that 'cas' is only for new keys or that it's mandatory, confusing candidates about its conditional nature and availability across interfaces.
You are configuring a new Consul datacenter in a multi-datacenter federation. The datacenter must be able to join the existing WAN gossip pool and participate in cross-datacenter service discovery. Which two configuration settings are required on the new datacenter's Consul servers to enable WAN gossip and ensure secure communication? (Choose two.)
retry_join_wan specifies one or more addresses of existing Consul servers in the WAN gossip pool. It allows the new datacenter's servers to automatically join the WAN pool and retry if the initial join fails. Without it, the servers would not know how to reach the existing WAN cluster, and manual joining would be required. This is essential for multi-datacenter federation.
Why this answer
To enable WAN gossip, the new datacenter's servers must be able to discover and join the existing WAN pool, which requires retry_join_wan to specify seed servers. Additionally, all servers in the WAN pool must share the same gossip encryption key configured via encrypt to secure communication. The other settings are important for ACLs and identification but do not directly enable or secure WAN gossip.
Exam trap
The trap here is confusing ACL replication settings with gossip requirements; while primary_datacenter and acl_replication_token are vital for ACLs, they are not needed for WAN gossip itself.
A system administrator needs to delete a single key named `temp/config` from the Consul KV store. They want to ensure that only that key is removed and no other keys are affected. Which command should they use?
The `consul kv delete` command removes the specified key. When given a full key path like `temp/config`, it deletes only that key. It does not affect other keys. This is the precise command for deleting a single key, matching the administrator's requirement.
Why this answer
The `consul kv delete` command with a specific key path deletes only that key. The `-recurse` flag would delete the key and all subkeys, which is not desired. Writing an empty value does not delete the key.
The pipeline approach is invalid. Therefore, the simple delete command is correct.
Exam trap
The trap here is confusing deletion with writing an empty value, or using the `-recurse` flag when only a single key should be removed.
A service is intermittently failing to resolve via DNS because it has multiple health checks, some of which are 'warning'. How do you ensure it is only returned when all checks are 'passing'?
The 'passing' query parameter filters DNS responses so only instances whose health checks are all passing are returned, excluding any with warning or critical states. This satisfies the requirement that the service resolve only when every check passes.
Why this answer
Consul DNS supports a 'passing' query parameter that filters results to only those service instances whose health checks are all passing — warning and critical instances are excluded. Appending ?passing to the DNS query (e.g., 'dig @127.0.0.1 web.service.consul SRV?passing') ensures the service is returned only when every check is green. This is the standard mechanism for strict health-based DNS filtering.
Exam trap
Consul 1.15 often tests DNS query parameters by offering plausible-sounding but unrelated options ('stale', 'service_prefix', 'enable_tag_override') to see if candidates know that 'passing' is the health filter.
How to eliminate wrong answers
Option A is wrong because 'service_prefix' is not a DNS setting that controls health filtering — it relates to service name prefixing in DNS/HTTP configurations, not check status. Option B is wrong because the 'stale' query parameter allows reads from non-leader servers for scalability; it affects consistency, not health filtering. Option C is wrong because 'enable_tag_override' is an agent configuration that lets services override their own tags via the API — it has nothing to do with DNS health filtering.
You are using Consul's DNS interface to query a service named 'web' in datacenter dc2 from a client in dc1. The query returns no results, but you know the service is running in dc2. What is the most likely reason?
By default, Consul DNS queries resolve services in the local datacenter. To query a service in another datacenter, you must include the datacenter name in the query, such as web.service.dc2.consul. Without the datacenter qualifier, the query only searches the local datacenter's catalog, which may not contain the service, resulting in no results.
Why this answer
Consul's DNS interface resolves services in the local datacenter by default. To query a service in a different datacenter, you must append the datacenter name to the query, such as web.service.dc2.consul. Without this qualifier, the query only searches the local catalog, which may not contain the service, leading to no results.
The local Consul agent forwards the query to the specified datacenter's servers.
Exam trap
The trap here is assuming that Consul DNS automatically searches all datacenters or requires a separate DNS forwarder, when in fact the datacenter must be explicitly included in the query.
A service mesh operator is troubleshooting a connectivity issue between two services in a Consul 1.15 datacenter. The sidecar proxy for the 'frontend' service cannot reach the 'backend' upstream. The operator has confirmed that intentions allow the traffic. Which log should they inspect first to diagnose the issue on the sidecar proxy?
Envoy proxy logs contain detailed information about connection attempts, including upstream cluster selection, TLS handshakes, and errors such as connection refused or timeout. Since the sidecar proxy is Envoy, its logs are the most direct source for diagnosing why it cannot reach the 'backend' upstream. These logs are typically written to a file or stdout depending on the proxy configuration. Inspecting them first will reveal specific failure reasons.
Why this answer
The Envoy sidecar proxy logs are the most detailed source for diagnosing connectivity issues between services in a Connect mesh. They record upstream connection attempts, TLS errors, and response flags. While Consul agent and server logs can provide context, they lack the granularity needed to pinpoint why a specific proxy cannot reach its upstream.
Checking the proxy logs first is the most efficient troubleshooting step.
Exam trap
The trap here is assuming that Consul agent or server logs contain detailed proxy connection errors, when in fact the Envoy sidecar logs are the primary source for data plane troubleshooting.
Which THREE of the following are valid ways to categorize services in Consul?
Metadata is a valid categorisation axis because Consul's service registration accepts arbitrary key-value pairs under the `meta` block, letting operators tag services by team, version, environment or tier. This satisfies the stem's requirement for a supported categorisation method, since meta is stored with the service definition and surfaced in catalog and health API responses.
Why this answer
Consul supports categorizing services by metadata (meta), which are arbitrary key/value pairs attached to a service registration and can be used to filter services via the catalog API (e.g., ?filter=ServiceMeta.Key==value). Namespaces are a Consul Enterprise feature that logically partitions services and other resources within a single datacenter, so services are effectively categorized by namespace. Tags are string labels attached to a service (and optionally to individual checks) that can be used to filter and query services, such as with the /v1/catalog/service/:name?tag=... endpoint.
IP subnets (A) are not a Consul service categorization mechanism; Consul does not group services by subnet. Port ranges (E) are likewise not a categorization feature, since a service's port is just a registration attribute and Consul provides no grouping or filtering by port range.
Exam trap
The trap is including infrastructure concepts like IP subnets or port ranges as categorization methods — candidates must distinguish Consul's native grouping primitives (tags, metadata, namespaces) from generic networking attributes.
A Consul operator needs to register a health check that runs a custom binary located at /opt/checks/validate.sh every 15 seconds. The check should be considered passing only when the script exits with code 0. Which check definition correctly implements this?
Consul 1.15 supports the args field for script checks, which accepts an array of the command and its arguments. Using args avoids shell interpretation and is the recommended approach. The interval of 15s sets the polling frequency, and a zero exit code from the script results in a passing status.
Why this answer
The args field is the correct way to define a script check in Consul 1.15. It takes an array containing the command and any arguments, and the check passes when the command exits with code 0. The script field is deprecated, and http and tcp fields define entirely different check types that cannot execute local binaries.
Using args also avoids shell interpretation, which is safer and more predictable.
Exam trap
The trap here is using the deprecated script field instead of the supported args array for executing local binaries.
When using 'Consul Connect native' integration, how does the application handle mTLS?
With Consul Connect native integration, the application itself performs mTLS by calling the local Consul agent's API to obtain its leaf identity certificate and CA bundle, then uses those credentials directly for encrypted, authenticated service-to-service communication.
Why this answer
In native integration, the application uses the Consul API to retrieve certificates and handles the mTLS handshake itself.
You are managing a multi-datacenter Consul deployment with ACLs enabled. The primary datacenter is in dc1, and a secondary datacenter is in dc2. You have configured ACL replication in dc2 using acl_replication_token. After some time, you notice that new ACL tokens created in dc1 are not being replicated to dc2, and the replication status shows 'No known leader'. What is the most likely cause of this issue?
The 'No known leader' status in ACL replication typically means the secondary datacenter cannot reach the primary datacenter's servers to determine the leader. This can be caused by a network partition, firewall rules blocking WAN traffic, or WAN gossip not functioning. Without connectivity to the primary, replication cannot proceed, leading to this status.
Why this answer
The 'No known leader' status in ACL replication indicates that the secondary datacenter cannot reach the primary datacenter's servers to discover the leader. This is typically due to network connectivity issues, such as a partition or misconfigured WAN gossip. The other options would produce different error messages and are less likely given the specific status.
Exam trap
The trap here is assuming that ACL replication issues are always due to token permissions or expiration, but 'No known leader' specifically points to a connectivity problem with the primary datacenter.
You are using Consul KV to coordinate a distributed job scheduler. A worker acquires a lock on a key to ensure only one worker runs a job at a time. The lock is tied to a session. The worker crashes and the session expires after its TTL. What happens to the lock on the key?
When a session that holds a lock expires, Consul releases the lock by clearing the Session field and incrementing the LockIndex. This allows other sessions to acquire the lock. The key and its value remain unchanged. This behavior ensures that locks do not become stuck after a session expires.
Why this answer
When a session expires, Consul automatically releases any locks held by that session. The lock release is indicated by clearing the Session field on the key and incrementing the LockIndex. The key and its value are not deleted.
This allows other workers to acquire the lock and continue operation. Manual intervention is not required.
Exam trap
The trap here is assuming that lock release deletes the key; in reality, the key remains and only the lock metadata changes.
You are using Consul 1.15 with Connect and want to enable Layer 7 traffic management for a service 'api' to perform HTTP path-based routing. Which configuration is required in the service definition?
To enable L7 features such as path-based routing, the service must declare its protocol as 'http' or 'grpc'. Then a service-router config entry can define routing rules based on HTTP attributes. This combination allows Consul to configure Envoy to inspect HTTP requests and route accordingly, meeting the requirement.
Why this answer
Consul's L7 traffic management requires the service to declare an HTTP-based protocol and use config entries such as service-router, service-splitter, or service-resolver. The service-router specifically supports path-based routing by matching on HTTP path, header, or query parameters. Without the correct protocol, Envoy operates in L4 mode and cannot inspect HTTP requests.
Exam trap
The trap here is confusing intentions with routing config entries; intentions only control access, not traffic routing.
An operations engineer wants a service registered in Consul to be deregistered automatically from the catalog when its health check has been critical for an extended period, without any external tooling. The service definition is written in HCL and loaded via the agent's config directory. Which combination of settings accomplishes this?
The deregister_critical_service_after field on a check tells the local Consul agent to remove the associated service instance from the catalog once the check has stayed critical for the specified duration, such as "10m". Placing the check inside the service block ties the deregistration to that service, so no external watcher or script is needed.
Why this answer
Automatic removal of a service whose check stays critical is achieved with the check-level deregister_critical_service_after setting, which the local agent enforces. Defining the check inside the service block binds that behavior to the specific service instance. No external process is required, satisfying the requirement to avoid outside tooling.
The other choices either do nothing automatically or reintroduce external scripts and manual tagging.
Exam trap
The trap here is believing Consul has a built-in garbage collector that eventually purges unhealthy services without any explicit deregistration setting.
A team is writing Consul 1.15 service definitions for a set of gRPC services that expose the standard gRPC health checking protocol on a dedicated port, and they want Consul to actively probe that protocol rather than a plain TCP connect. Which two settings must be present in each check block to make Consul perform a gRPC health check against the service? (Choose two.)
Every active check, including a gRPC health check, needs an interval to tell the agent how often to run the probe. Omitting it leaves the check without a schedule, so Consul cannot periodically invoke the gRPC health service, making this field required alongside the protocol-specific address.
Why this answer
A gRPC health check is selected by the grpc field, which carries the address Consul dials, and like any active check it needs an interval to define the probe cadence. Together those two settings make the agent invoke the standard gRPC health checking protocol against the service; TLS, a method name, and a TCP address are not required to enable that behavior.
Exam trap
The trap here is treating a plain TCP address as equivalent to a gRPC health probe, when only the grpc field selects the protocol-level check.
You have enabled ACL replication between a primary and secondary datacenter. What is the effect of changing an ACL policy in the primary datacenter?
ACL replication in Consul propagates token and policy changes from the primary to secondary datacenters asynchronously, satisfying the stem's cross-datacenter consistency requirement without blocking primary writes. Secondaries receive updates shortly after the primary commits them, so the change is not instantaneous but eventually consistent across all secondary datacenters.
Why this answer
Consul ACL replication from a primary datacenter to secondary datacenters is asynchronous by design. When an ACL policy, token, or role is modified in the primary, the change is queued and replicated to all secondaries without manual intervention, though there may be a short propagation delay. This matches the documented behavior of the `acl-replication` mechanism.
Exam trap
The trap is assuming ACL changes are synchronous or require manual action; candidates who conflate Consul's Raft-based intra-DC consistency with cross-DC replication may pick 'manual trigger' or 'ignored' instead of recognizing the asynchronous automatic model.
How to eliminate wrong answers
Option A is wrong because maintenance mode is unrelated to ACL replication; it is used to quiesce a server for upgrades and does not gate policy propagation. Option B is wrong because replication is automatic once enabled — there is no manual trigger required on secondary servers, and inventing one misrepresents how the replication endpoint works. Option C is wrong because secondary datacenters do honor replicated ACLs; ignoring them would defeat the purpose of enabling replication, and Consul explicitly applies replicated policies to authorization decisions in secondaries.
A company runs Consul 1.15 in three datacenters: dc1 (primary), dc2, and dc3 (secondaries). The operations team wants to ensure that if dc1 becomes unavailable, the remaining datacenters can still authenticate services using existing ACL tokens. They have already configured ACL replication and WAN federation. Which statement best describes the expected behavior of ACL tokens in dc2 and dc3 during a primary datacenter outage?
Once ACL data is replicated to secondary datacenters, it is stored locally. During a primary outage, secondary datacenters can continue to use the replicated tokens and policies for local authorization decisions. This allows services to authenticate and authorize without requiring the primary to be online, which is a key benefit of ACL replication.
Why this answer
ACL replication stores a local copy of ACL data in each secondary datacenter. During a primary outage, secondary datacenters can continue to authorize requests using the replicated tokens and policies. New token creation in secondaries is not replicated back to the primary, but existing tokens remain valid for local authorization.
Exam trap
The trap here is thinking that token validation always requires the primary datacenter to be online, when in fact secondary datacenters use locally replicated ACL data.
You observe a 'warning' status for a service. What is the most common reason for this?
A warning status means the service's health check is passing but a configured threshold, such as a degraded check or failing node, is breached. The service remains registered and serving traffic, yet its performance or partial availability falls short of the passing criteria.
Why this answer
In Consul, a 'warning' status means the check is returning a warning result — typically the service is up and responding but is degraded or experiencing performance issues. This is distinct from 'critical', which indicates failure. The most common cause of warning is a service that is operational but not fully healthy.
Exam trap
Consul 1.15 often tests the confusion between 'warning' and 'critical' — candidates must remember that warning means degraded but operational, while critical means failed or unreachable.
How to eliminate wrong answers
Option A is wrong because an agent restarting would cause checks to be in 'critical' or unknown state, not warning. Option B is wrong because a network outage would cause checks to fail and go 'critical', not warning. Option D is wrong because a crashed service would return a critical status, not warning.
An operator registers a service 'cache' with an HTTP health check pointing to https://10.0.0.5:8443/health. The service appears in the catalog, but DNS queries for cache.service.consul return no records, and the check status shows critical with the message 'Get https://10.0.0.5:8443/health: x509: certificate signed by unknown authority'. Which action resolves the issue while keeping the check functional?
The error indicates the Consul agent does not trust the certificate presented by the HTTPS endpoint. Configuring the agent's TLS verification with the correct CA via ca_file or ca_path allows the HTTP check to validate the server certificate and transition to passing. Once the check passes, the instance is included in DNS answers. This addresses the root cause without disabling security.
Why this answer
The critical status is caused by the agent's inability to verify the HTTPS endpoint's certificate. Supplying the issuing CA through the agent's ca_file or ca_path configuration lets the HTTP check complete TLS validation and report passing, which restores the instance to DNS answers. This corrects the trust configuration rather than disabling verification or weakening the check.
Exam trap
The trap here is reaching for tls_skip_verify or an HTTP downgrade to silence the certificate error, when the proper fix is to give the agent the CA it needs to trust the endpoint.
The TCP check type is purpose-built for verifying that a TCP port is open and accepting connections. It requires only the address and port, plus an interval, and does not depend on external binaries or HTTP endpoints. This directly satisfies the requirement for the legacy Java application that listens on 8443 but cannot expose HTTP.
Why this answer
The TCP check type is the correct choice because it directly tests whether a TCP port is open and accepting connections without requiring the application to expose HTTP or run external scripts. It uses only the address and port, making it ideal for legacy services that cannot be instrumented. Other check types either demand capabilities the application lacks or add unnecessary dependencies.
Exam trap
The trap here is assuming that any check that can detect a listening port is equally valid, when only the TCP check type is designed for raw port liveness without extra dependencies.
You want to perform a blocking query on a KV key to watch for updates. Which parameter must you provide in your request based on the last observed index?
Supplying the index parameter tells Consul to hold the blocking query open until the KV store's modify index exceeds that value, returning only on change or timeout. This satisfies the stem's requirement to watch for updates based on the last observed index, avoiding repeated polling.
Why this answer
To perform a blocking query on a KV key, you must provide the 'index' parameter, which specifies the last observed ModifyIndex. Consul will hold the request until the key's index exceeds this value or the wait time expires.
Exam trap
Consul 1.15 often tests blocking query parameters; candidates may confuse 'wait' with 'index', but 'index' is mandatory to enable blocking behavior.
How to eliminate wrong answers
Option A is wrong because 'consistency' is used to specify consistency modes (e.g., 'stale', 'consistent') but does not enable blocking. Option B is wrong because 'wait' specifies the maximum duration to wait, but without 'index', the query is not blocking. Option D is wrong because 'timeout' is not a standard parameter for blocking queries; 'wait' is used instead.
You have a service that requires specific routing logic based on the environment. How can you distinguish between 'production' and 'staging' instances of the same service name using metadata?
Consul tags are arbitrary key-value metadata attached to a service registration, so tagging instances 'production' or 'staging' lets upstream routing, such as prepared queries or intentions, select the correct subset by tag rather than by service name alone.
Why this answer
Consul tags are arbitrary key-value-like labels attached to a service registration and are the standard mechanism for distinguishing instances of the same service across environments. By registering production instances with the tag 'production' and staging instances with 'staging', you can use service discovery queries (e.g., via DNS SRV or the HTTP API with tag filters) to route traffic to the correct environment. This preserves a single service name while enabling environment-aware routing.
Exam trap
Consul 1.15 often tests whether candidates confuse tags (used for DNS/API filtering and routing) with Meta (used for arbitrary non-routing metadata), leading them to pick a wrong option.
How to eliminate wrong answers
Option A is wrong because using different service names for every environment defeats the purpose of Consul's service discovery — it fragments the service catalog and prevents clients from using a consistent name with tag-based filtering. Option B is wrong because modifying the port number is not a metadata mechanism; ports are transport-level endpoints and do not convey environment semantics for routing logic. Option D is wrong because assigning different Consul datacenters separates environments at the infrastructure level, which is a heavier architectural decision and does not use metadata to distinguish instances within the same service name.
A service team wants its check to be automatically deregistered along with the service when the service is deregistered, but they also want the check to survive a Consul agent restart without being manually recreated. Which configuration achieves both goals?
When a check is nested in a service block and has no explicit ID, Consul generates an ID tied to the service. The check is removed when the service is deregistered, and because it is declared in the agent's configuration directory, it is re-registered automatically whenever the agent starts, satisfying both requirements.
Why this answer
Nesting a check inside a service block without an explicit check ID causes Consul to generate an ID linked to the service, so deregistering the service also removes the check. Declaring that service in the agent configuration directory means the agent re-registers it on every startup, providing restart persistence. API-only registration and in-memory reliance fail both the automatic removal and the restart-survival requirements.
Exam trap
The trap here is assuming that any check registered near a service is automatically tied to it, when only checks nested in the service block without a separate explicit ID inherit that lifecycle linkage.
A platform team runs a fleet of Consul 1.15 server agents behind a strict network policy that blocks all outbound DNS traffic from the server hosts. The team wants the servers to periodically verify that each registered catalog node's DNS name resolves, without installing any extra binaries. Which check definition should they use, and what must they configure so the check can run?
The dns check type is built into the Consul agent and resolves the supplied name (or the service name if omitted) using the host's resolver or an explicit address. Because the check runs inside the agent process, no extra binary is needed. The team must still supply a reachable resolver, since the check cannot succeed if every DNS destination is blocked.
Why this answer
The dns check type runs inside the Consul agent and resolves a hostname through the system resolver or an address supplied in the check definition, which satisfies the no-extra-binaries requirement. The network policy still matters: the check needs a resolver it can actually reach, so the team must point the check at a permitted DNS server or lift the block for that destination.
Exam trap
The trap here is assuming that a DNS-based check needs an external tool or that alias checks resolve names, when the native dns check type already performs resolution in-process.
A Consul 1.15 cluster spans three datacenters: dc1 (primary), dc2, and dc3. The operations team wants to enable cross-datacenter service discovery for a service named 'web' that is deployed in all datacenters. They configure a prepared query with a failover policy. Which statement accurately describes how the failover block in the prepared query affects query results when the local datacenter's 'web' service has no healthy instances?
The failover block in a prepared query allows you to define a prioritized list of datacenters. When the local datacenter lacks healthy instances, Consul queries the specified datacenters in order and returns results from the first one with healthy instances. This enables controlled cross-datacenter failover.
Why this answer
Prepared queries support a failover block that lists datacenters in priority order. When the local datacenter has no healthy instances, Consul tries each listed datacenter in sequence and returns results from the first with healthy instances. This provides deterministic cross-datacenter failover for service discovery.
Exam trap
The trap here is thinking failover uses dynamic criteria like latency, when it actually follows the explicit order defined in the failover block.
You are troubleshooting a Consul Connect service mesh and need to verify which intentions are currently configured. Which Consul CLI command lists all intentions?
The 'consul intention list' command queries Consul and displays all intentions that have been created. It shows the source and destination services, the action (allow or deny), and other metadata. This is the correct command to verify the current intentions in the mesh. It is a straightforward and commonly used command for auditing Connect authorization.
Why this answer
The correct command to list all intentions is 'consul intention list'. This command retrieves and displays all intentions configured in the Consul datacenter. The other options are either non-existent commands or incorrect syntax.
Being able to quickly list intentions is essential for troubleshooting and auditing Connect authorization.
Exam trap
The trap here is assuming that intentions are managed under the 'consul connect' command, when they are actually a top-level command.
What is the primary role of the Consul Connect 'upstream' configuration?
An upstream block declares the service dependencies a local sidecar proxy should establish, generating listeners and intentions for outbound Connect traffic. This satisfies the stem's constraint: defining which services the local service can connect to.
Why this answer
The Consul Connect 'upstream' configuration defines the services that a local service can connect to through the mesh. It specifies the destination service name, optional datacenter, and local port that the sidecar proxy listens on to forward traffic to the upstream. This is the core mechanism for establishing service-to-service connections in Consul Connect.
Exam trap
The trap is confusing upstreams with intentions — upstreams define what a service can connect to, while intentions define whether that connection is allowed; candidates often mix these two Connect concepts.
How to eliminate wrong answers
Option B is wrong because intention priority is not configured through upstreams; intentions are separate ACL-like rules that define whether a connection is allowed, and they do not have a priority field set by upstreams. Option C is wrong because registering external services is done through service definitions with the 'external' or 'external-source' fields, not through upstream configuration. Option D is wrong because health check ports are defined in the service's check block, not in the upstream block, which is about outbound connections.
You need to store a value in Consul KV that will be read by a service. The value should be retrievable by a simple HTTP GET request to the Consul API. Which HTTP endpoint should you use to read the value of a key named 'app/config/db_host'?
The correct endpoint to read a KV value is GET /v1/kv/ followed by the key path. For the key 'app/config/db_host', the URL is /v1/kv/app/config/db_host. This returns a JSON array containing the key's value, flags, and metadata. It is the standard way to retrieve a single key.
Why this answer
The Consul KV API uses the /v1/kv/ prefix for all key operations. To read a key, you perform a GET request to /v1/kv/<key>. This returns a JSON response containing the value and metadata.
Other paths like /v1/store or /v1/kv/read are not valid. The ?raw parameter is optional and returns the value directly, but the standard endpoint is without it.
Exam trap
The trap here is adding unnecessary path segments or using a different prefix; the KV API is consistently under /v1/kv/.
A DevOps engineer needs to register an external service that runs outside the Consul datacenter, such as a third-party API. The service has a static IP address and a known port. Which Consul feature should be used to make this service discoverable within Consul?
Consul allows registering external services by specifying a node name and address that are not part of the Consul cluster. This is done by registering a service with an address and port, and optionally a health check. The service appears in the catalog and DNS, enabling discovery. This is the appropriate method for external endpoints with static IPs.
Why this answer
To register an external service in Consul, you can use the service registration API or configuration files to define a service with a static address and port. Consul treats it as a regular service in the catalog, and it can be discovered via DNS or HTTP API. This is the correct approach for integrating external endpoints into Consul's service discovery.
Exam trap
The trap here is confusing service mesh or prepared queries with the actual registration mechanism for external services.
When using Consul KV for distributed locking, why is it recommended to use a session?
A Consul session binds the lock key to a TTL-backed session, so if the holder fails or stops renewing, the session expires and the lock is released automatically. This prevents deadlocks without manual intervention, satisfying the need for automatic lock release.
Why this answer
Sessions in Consul provide a mechanism for TTL-based automatic lock release. When a lock is acquired using a session, the session must be periodically renewed; if the client fails to renew before the TTL expires, Consul automatically invalidates the session and releases any locks held by it, preventing deadlocks from crashed or partitioned clients.
Exam trap
The trap is conflating sessions with security features like encryption; candidates may assume 'session' implies confidentiality, when in fact its purpose is liveness detection and automatic lock cleanup.
How to eliminate wrong answers
Option B is wrong because sessions do not encrypt lock data; encryption is handled separately via TLS and gossip encryption, and the KV values themselves are not encrypted by Consul. Option C is wrong because a session-based lock is designed for mutual exclusion — only one holder at a time — not multiple concurrent holders. Option D is wrong because sessions add coordination overhead and do not accelerate read operations; reads are served from the KV store regardless of session state.
What is the primary difference between a 'script' check and an 'http' check in terms of how they are processed by the Consul agent?
Script checks run an executable or script as a local process on the Consul agent host, whereas HTTP checks issue network requests to a specified URL. The processing distinction is local process execution versus remote HTTP request handling.
Why this answer
Script checks execute a local command or script on the Consul agent's host, while HTTP checks make an HTTP request to a specified URL. The key processing difference is that script checks spawn a subprocess, which can be resource-intensive and requires the script to be present on the node. HTTP checks are handled internally by the agent's HTTP client without executing external code.
Exam trap
Consul 1.15 often tests the confusion that HTTP checks are more secure or that only HTTP checks support intervals, when in fact both support intervals and security depends on configuration.
How to eliminate wrong answers
Option B is wrong because HTTP checks are not inherently more secure; both can be secured with TLS and authentication, and script checks can run in isolated environments. Option C is wrong because both script and HTTP checks support intervals; the 'interval' field is common to all check types. Option D is wrong because script checks are generally slower due to process execution overhead, not faster.
An engineer is designing a service that must coordinate access to a shared resource using Consul KV sessions and needs to understand the guarantees the lock provides. Which TWO statements accurately describe how Consul's KV locking with sessions behaves? (Choose two.)
Lock acquisition uses the `acquire` operation, passing the candidate's session ID. Consul checks whether the key is currently held by a live session; if not, the write succeeds and records the session ID in the key's Session field. If another valid session holds it, the acquire fails. This is the fundamental mechanism that makes Consul KV locks mutually exclusive.
Why this answer
Consul locks are acquired with the `acquire` operation carrying a session ID, and they are released automatically when that session expires or is invalidated. Mutual exclusion is guaranteed because only one valid session can hold a given key. Release is performed through the same key-write path with the `release` operation, and session renewal happens at the session endpoint, not the KV endpoint.
Exam trap
The trap here is conflating session renewal with KV lock operations, when renewal occurs through the session endpoint and locks are managed through acquire and release on the key itself.
A security engineer is configuring intentions for a service mesh. They want to allow traffic from 'frontend' to 'backend' only when the connection is encrypted with mTLS and originates from a specific namespace in Consul Enterprise. Which intention attribute should they use to enforce the namespace constraint?
SourceNamespace is the correct attribute to enforce that the source service resides in a specific Consul Enterprise namespace. By setting SourceNamespace to the desired namespace, the intention only matches connections from 'frontend' within that namespace. This provides the granular control needed to restrict traffic based on namespace, which is critical in multi-tenant environments. Other attributes do not capture namespace information.
Why this answer
In Consul Enterprise, intentions support namespace and partition attributes to provide fine-grained authorization. To allow traffic only from a specific namespace, the SourceNamespace attribute must be set. This ensures that only service instances registered in that namespace can establish connections.
Other attributes like SourceName or SourcePartition do not fulfill the namespace-specific requirement.
Exam trap
The trap here is confusing namespace with admin partition or assuming that SourceName includes namespace, when in fact namespaces require a dedicated SourceNamespace field.
An operations team runs a legacy application that cannot expose an HTTP endpoint but does listen on TCP port 5432. They define a TCP health check in the service registration. During an incident, the port remains open but the application process is hung and no longer accepts new connections. What will Consul report for this check?
A TCP check only attempts to open a connection to the configured host and port. If the TCP handshake succeeds, the check is passing regardless of whether the application accepts or processes data on that connection. In this scenario the port is still open, so Consul reports passing even though the process is hung.
Why this answer
A TCP health check validates only that a connection to the specified host and port can be established. It does not perform any application-level handshake or data exchange. Because the port remains open in this scenario, the check stays passing even though the application is unresponsive.
This is a common limitation when using TCP checks for services that can hang while keeping their socket open.
Exam trap
The trap here is believing that a TCP check verifies application responsiveness, when it only verifies that the port accepts a connection.
What is the correct way to specify a local bind port for an upstream service?
The upstreams block inside the service definition accepts destination_name to identify the target service and local_bind_port to fix the loopback port the sidecar listens on. This exact HCL syntax lets the local application reach the upstream at a predictable address.
Why this answer
The correct syntax for defining an upstream service with a local bind port in Consul's service definition is within the 'upstreams' block, specifying 'destination_name' and 'local_bind_port'. This tells the local proxy to listen on the specified port and forward traffic to the destination service. The other options use incorrect block names or syntax that Consul does not recognize.
Exam trap
The trap is mixing up the block names and field names (e.g., 'upstream' vs 'upstreams', 'port' vs 'local_bind_port'), causing candidates to select a syntactically plausible but invalid option.
How to eliminate wrong answers
Option A is wrong because 'service { upstream = { 9000 } }' is not valid HCL syntax for Consul; upstreams must be defined as a list of objects with specific fields. Option B is wrong because 'proxy { upstream_port = 9000 }' is not a valid field; the proxy block does not accept 'upstream_port'. Option C is wrong because 'upstream { port = 9000 }' is missing the destination service name and uses an incorrect block name; the correct block is 'upstreams' (plural) with 'destination_name' and 'local_bind_port'.
Which of the following are true regarding TTL checks? (Select TWO)
TTL checks are passive: the service must periodically PUT its status to Consul's agent endpoint, so health depends on the application actively pushing updates. Without that push, Consul marks the check critical after the TTL expires, satisfying the stem's requirement for a push-based mechanism.
Why this answer
Option A is correct because TTL-based checks rely on the application or service itself to push updates (e.g., via an API or heartbeat) before the TTL expires; the monitoring system does not actively poll, so the app must refresh the record to keep the check healthy. Option D is correct because TTL checks are event-driven rather than scheduled: instead of running on a fixed interval, they expire after a defined time-to-live, making them the only check type without a polling interval. Option B is wrong because TTL checks are not automatically removed; they transition to a failed/expired state when the TTL lapses unless the app pushes an update.
Option C is wrong because TTL checks are not inherently faster than script checks—speed depends on the push mechanism and network, not on the check type itself. Option E is wrong because TTL checks are explicitly not polled at a fixed interval; that description applies to standard interval-based checks.
Exam trap
Consul 1.15 often tests the misconception that TTL checks are polled like script checks, causing candidates to select the fixed-interval option instead of recognizing the push-based, interval-less nature.
An operator registers a service with a TTL health check. The service is responsible for updating the check status via the HTTP API. The service fails to send updates for 90 seconds. The check is configured with 'DeregisterCriticalServiceAfter' set to 10 minutes. What is the current health status of the service, and what will happen after 10 minutes?
TTL checks transition to critical if not updated within the TTL interval. After 90 seconds without an update, the check is critical. The 'DeregisterCriticalServiceAfter' setting specifies that if the check remains critical for 10 minutes, the service instance is automatically deregistered from the catalog. This matches the scenario, making this the correct answer.
Why this answer
TTL health checks require periodic updates from the service. If no update is received within the TTL period, the check becomes critical. The 'DeregisterCriticalServiceAfter' field, when set, schedules deregistration of the service instance after the check has been critical for the specified duration.
In this case, after 90 seconds the check is critical, and after 10 minutes of being critical, the service is deregistered.
Exam trap
The trap here is assuming that a missed TTL update results in a warning state, but TTL checks only support passing, critical, and maintenance states.
A platform team runs Consul 1.15 with Connect enabled in a single datacenter. They register a new service 'payments' with a sidecar proxy, but when the application team tries to reach 'payments' through its local proxy, the connection is refused. Running 'consul intention check web payments' returns 'Result: denied'. No intentions have been created yet. What should the team do to allow the traffic while following Consul's default security model?
In Consul 1.15, when no intention matches a service pair, Connect defaults to deny. Explicitly creating an allow intention between the source 'web' and destination 'payments' authorizes the L4 connection and is the intended way to open traffic under the default-deny model.
Why this answer
Connect evaluates intentions for every proxied connection and, absent a match, defaults to deny. The 'consul intention check' output confirms denial. Creating an allow intention between the source service 'web' and destination 'payments' establishes the required authorization.
Environment toggles, re-registration, and explicit deny intentions do not open the path under the default-deny posture.
Exam trap
The trap here is assuming that registering a sidecar proxy automatically permits inbound traffic, when intentions must explicitly allow the source-to-destination pair.
Where can you define health checks in Consul? (Select THREE)
Agent configuration files let you declare checks in the agent's own configuration, applying them to the node rather than a single service. This satisfies the question's requirement for defining checks, covering node-level and service-level checks.
Why this answer
Health checks in Consul can be defined in agent configuration files (A), where you place `check` blocks or `checks` arrays in HCL/JSON to register node-level or service-level checks that the agent loads at startup. They can also be defined via the HTTP API (B), using endpoints such as `PUT /v1/agent/check/register` to register a check at runtime, or within a service registration payload sent to `/v1/agent/service/register`. Service definition files (E) are also valid, since a service registration JSON/HCL file can include a `checks` array (or a single `check`) that defines checks tied to that service, commonly loaded via the agent's `services` configuration directory.
The Consul UI (C) is only for viewing and managing existing checks, not for authoring their definitions, and the Consul KV store (D) holds arbitrary key/value data and has no role in defining health checks.
Exam trap
The trap is confusing where Consul stores data (KV) with where it accepts configuration (agent config, service definitions, API); candidates often assume the UI or KV store can define checks because both are prominent Consul features.
A financial services firm requires that all service-to-service traffic inside its Consul 1.15 datacenter be encrypted and that services accept connections only when an explicit intention permits them. An operator enables Connect on all agents but services still accept plaintext traffic from non-mesh clients. Which additional step is required to enforce encryption and deny-by-default for the whole datacenter?
Connect must be enabled in the agent configuration so proxies can be injected, and a default-deny intention ensures no service is reachable over the mesh without an explicit allow. Restricting the application to loopback or making it reachable only via the proxy forces all inbound traffic through mTLS, so plaintext connections from non-mesh clients are refused.
Why this answer
Enabling Connect provides the mTLS data plane, and a default-deny intention establishes least privilege so every allowed path must be stated explicitly. However, if the application still listens on a routable address, non-mesh clients can connect in plaintext and bypass the proxy entirely. Binding the workload to loopback or exposing it only through the proxy closes that gap, making encryption and deny-by-default enforceable for all traffic.
Exam trap
The trap here is believing that enabling Connect and adding a default-deny intention secures traffic that never enters the mesh in the first place.
A platform team runs a Consul 1.15 datacenter with Connect enabled. They deploy a new service called 'payments' and register it with a sidecar proxy. Security policy requires that only the 'checkout' service may initiate connections to 'payments', and all other services must be denied, even if they present a valid service token. No intentions exist yet for this pair. Which action should the team take to enforce this requirement with the least operational overhead?
Consul's default behavior when no intention matches is to deny the connection. By creating a single allow intention from checkout to payments, only checkout can connect; every other service falls through to the default deny. This is the least overhead because no wildcard deny rule is needed and future services are automatically blocked.
Why this answer
Intentions are the Connect authorization mechanism, and Consul denies any connection that does not match an allow intention. Creating a single allow intention from checkout to payments satisfies the requirement because all other sources are denied by default. Adding a wildcard deny is redundant and complicates the intention set, while ACLs and proxy upstream settings address different concerns.
Exam trap
The trap here is assuming you must explicitly create a deny-all intention, when Consul's default posture already denies unmatched connections.
A Consul 1.15 operator is configuring a service mesh with Connect and needs to ensure that the sidecar proxy for 'frontend' can establish mTLS connections to the 'backend' service. The operator has already registered both services with Connect sidecars. Which two actions are required to allow this communication? (Choose two.)
The upstream stanza in the 'frontend' service registration tells the sidecar proxy to create a local listener that forwards traffic to the 'backend' service. Without this configuration, the frontend application has no local endpoint to send requests to, and the sidecar will not establish the mTLS connection. This stanza is necessary for the proxy to know the destination service and port.
Why this answer
To allow 'frontend' to communicate with 'backend' through Connect, two things are needed: an intention that authorizes the traffic, and an upstream configuration in the 'frontend' service registration so its sidecar knows where to forward requests. Intentions enforce authorization, while the upstream stanza provides the necessary listener and routing information for the sidecar to initiate the mTLS connection.
Exam trap
The trap here is assuming that enabling Connect sidecars alone is sufficient, overlooking that both an intention and an upstream definition are required for service-to-service communication.
A platform team operates two Consul datacenters, dc1 (primary) and dc2 (secondary), with ACLs enabled. They have configured token replication using a replication token in dc2. After rotating the replication token in dc1, they update the configuration in dc2 and restart the Consul agents. However, ACL replication stops working and dc2 logs show 'Permission denied'. What is the most likely cause?
ACL replication requires a token that exists in the primary datacenter and has read access to ACL policies, tokens, and roles. After rotating the token in dc1, the old token is invalid, causing permission denied in dc2. Creating a new token in dc1 with appropriate read permissions and updating dc2's configuration resolves the issue. The token must be from the primary, not the secondary.
Why this answer
ACL token replication in Consul allows secondary datacenters to mirror ACL data from the primary. The replication token must be created in the primary datacenter with read permissions on ACL resources. After rotating the token, the old token becomes invalid, leading to permission errors in the secondary.
Updating the secondary's configuration with a valid token from the primary restores replication.
Exam trap
The trap here is assuming the replication token must be identical or configured in both datacenters, when it only needs to exist in the primary and be referenced in the secondary.
A team is using the Consul KV store to store application configuration. They want to implement a watch that runs a script whenever the value of the key `config/app` changes. Which two of the following statements are true regarding Consul KV watches? (Choose two.)
Consul watches support a `key` type that monitors a single key. The watch uses blocking queries to wait for changes. When the key's value or metadata changes, the watch returns the new data and invokes the configured handler. This is the intended use for reacting to changes in a specific key.
Why this answer
Watches in Consul allow monitoring of KV changes. The `key` type watches a single key and blocks until it changes. The `keyprefix` type watches a prefix and triggers on any change within it.
These are both standard watch types. Watches can be configured via CLI, API, or agent configuration, and they do not create keys. They are available in all Consul versions.
Exam trap
The trap here is assuming that watches can create keys or are limited to Enterprise, or that they are configured only via one method.
If a KV operation returns a 403 Forbidden status, what is the most common cause?
A 403 Forbidden from Consul's KV store signals authorisation failure, not authentication failure. The ACL token presented is valid but its policy grants no matching `key:read` or `key:write` capability for that path. Consul evaluates token policies against the requested KV prefix and denies access when no rule permits it.
Why this answer
A 403 Forbidden response from Consul's HTTP API indicates the request was authenticated but the associated ACL token does not have the required policy permissions for the target resource. Consul returns 403 specifically when an ACL is enforced and the token lacks the necessary 'read', 'write', or 'list' capability on the KV prefix being accessed. This is distinct from 401 (missing/invalid token) and 404 (key not found).
How to eliminate wrong answers
Option B is wrong because a down server produces a connection refused/timeout error, not an HTTP 403 response — the API would not be reachable to return a status code. Option C is wrong because oversized values return 413 Request Entity Too Large (Consul caps KV values at 512 KB), not 403. Option D is wrong because a missing key returns 404 Not Found (or an empty result for a prefix list), not 403 Forbidden.
A Consul 1.15 operator needs to register a service with a health check that verifies the service is accepting TCP connections on port 9200. The check must run every 10 seconds. Which check configuration should be used?
This correctly configures a TCP health check that attempts to open a connection to localhost on port 9200 every 10 seconds. If the connection succeeds, the check is passing; if it fails, the service is marked critical. This is the appropriate check type for verifying that a service is listening on a specific TCP port without requiring HTTP or a script.
Why this answer
The TCP health check is designed to verify that a service is accepting TCP connections on a specified address and port. By setting the tcp field to localhost:9200 and an interval of 10s, Consul will attempt a connection every 10 seconds. This matches the requirement of checking TCP connectivity on port 9200 at the specified interval.
Which file format is used for Consul configuration?
Consul accepts configuration in either HCL or JSON, satisfying the stem's requirement for the supported file format. HCL provides comments and a more readable syntax, while JSON suits machine-generated files; both are parsed natively by the Consul agent for service definitions, checks and agent settings.
Why this answer
Consul accepts configuration in either HCL or JSON format. HCL is the more human-readable format used in most examples, while JSON is supported for programmatic generation and legacy compatibility. Both are parsed into the same configuration structure.
Exam trap
The trap is assuming Consul uses YAML because it is ubiquitous in modern infrastructure tooling, when Consul actually supports only HCL and JSON.
How to eliminate wrong answers
Option B is wrong because INI is not a supported Consul configuration format — it is used by other tools but not Consul. Option C is wrong because YAML is not natively supported for Consul agent configuration files, despite being common in Kubernetes and CI tooling. Option D is wrong because XML is not a Consul configuration format.
You have a Consul 1.15 cluster with two datacenters, dc1 and dc2, federated via WAN gossip. You want to use a prepared query to automatically failover to a service in dc2 if the service in dc1 becomes unhealthy. Which configuration in the prepared query is required to achieve this?
In a prepared query, the `Failover` block allows you to specify a list of datacenters to try if the local datacenter's service instances are unhealthy. Setting `Datacenters` to `["dc2"]` will cause the query to failover to dc2 when no healthy instances are available in the local datacenter. This is the correct configuration for automatic cross-datacenter failover.
Why this answer
Prepared queries support a `Failover` block that can list datacenters to try when local instances are unhealthy. By setting `Datacenters` to `["dc2"]`, the query will automatically attempt to find healthy instances in dc2 if none are available in the local datacenter. This is the standard method for cross-datacenter failover in Consul.
Other options either misuse fields or do not provide the required failover behavior.
Exam trap
The trap here is confusing `NearestN` (which sorts by proximity) with the `Datacenters` field (which explicitly lists failover targets). Only the latter achieves directed failover to a specific datacenter.
How are intentions applied to services in different partitions or namespaces?
Intentions are scoped to a namespace, so cross-namespace traffic requires the namespace explicitly named in the intention definition. This satisfies the stem's constraint that source and destination in different namespaces cannot be matched by service name alone.
Why this answer
In Consul Enterprise, intentions are applied to services in different partitions or namespaces by specifying the namespace (and partition, if applicable) in the intention definition. This allows fine-grained control over which services can communicate across these boundaries. Intentions are not limited to the default namespace, nor are they always global.
Exam trap
The trap is assuming that intentions are always global or only work in the default namespace, ignoring the need to specify namespace and partition for cross-boundary communication.
How to eliminate wrong answers
Option A is wrong because intentions can be defined in any namespace, not just the default. Option C is wrong because intentions are not always global; they can be scoped to a namespace and partition. Option D is wrong because intentions can be created via the UI, CLI, or API, not only via API.
Which TWO of the following actions occur when a node fails in a Consul cluster?
When a node fails, Consul's health checks for its services fail, so the catalog marks every service on that node as critical. This reflects the stem's node-failure scenario, where the failed node's services transition to critical health status.
Why this answer
Option A is correct because when a Consul node fails, its health checks stop passing and Consul marks all services registered on that node as critical, reflecting their unhealthy state in the catalog. Option D is correct because Consul's DNS interface only returns healthy service instances by default, so services on the failed node are removed from DNS results until the node recovers. Option B is incorrect because a failed node is not immediately deleted; it remains in the catalog and is only removed after being marked as failed or explicitly deregistered.
Option C is incorrect because Consul does not reboot nodes; it only detects and reports failures. Option E is incorrect because Consul is a distributed, fault-tolerant system and a single node failure does not shut down the entire cluster.
Which TWO of the following are true about Consul datacenters?
Every Consul datacenter requires its own server cluster to maintain the Raft quorum and manage the catalogue, intentions and ACLs; a datacenter cannot function with client agents alone. This satisfies the stem's requirement that each datacenter operates independently, with servers in one datacenter not replicating data to servers in another.
Why this answer
Option A is correct because every Consul datacenter requires at least one server node to form the Raft quorum and maintain the catalog, since servers are the only agents that participate in the consensus protocol and store cluster state. Option C is correct because a Consul datacenter is defined as a group of nodes that are expected to have low-latency, high-bandwidth connectivity to each other, which is why datacenters are typically mapped to a single network region or availability zone. Option B is incorrect because a datacenter in Consul is a logical grouping, not strictly a physical location, and can span or subdivide physical sites.
Option D is incorrect because each datacenter maintains its own independent Raft quorum; servers in different datacenters do not share a single quorum. Option E is incorrect because a single Consul agent belongs to exactly one datacenter and cannot join multiple datacenters simultaneously.
Exam trap
Consul 1.15 often tests the misconception that datacenters must be physical or share a Raft quorum — candidates confuse the WAN gossip pool with a shared consensus group.
An operator has two Consul datacenters, 'dc1' and 'dc2', federated via WAN gossip. They want to query the health of a service named 'web' in dc2 from a Consul agent in dc1 using the HTTP API. Which endpoint should they use?
The /v1/health/service endpoint returns health checks for a given service. The dc query parameter specifies the target datacenter. Since dc1 and dc2 are federated, a request to the local agent in dc1 with dc=dc2 will be forwarded to dc2's servers and return the health information for 'web' in dc2. This is the correct way to query remote datacenter health via the HTTP API.
Why this answer
To query the health of a service in a remote federated datacenter, the correct endpoint is /v1/health/service/<service> with the dc query parameter set to the target datacenter. This endpoint returns the health checks and statuses for the service instances. The local Consul agent in dc1 will forward the request to dc2's servers because the datacenters are federated, allowing cross-datacenter health queries.
Exam trap
The trap here is confusing the health endpoint with the catalog endpoint or using the wrong datacenter parameter, which would return incorrect or incomplete information for the remote service's health.
A developer registers a service 'web-frontend' with Consul using the HTTP API. The service registration includes a health check with a TCP check on port 8080 and an interval of '15s'. After registration, the developer queries the service using the DNS interface: 'dig @127.0.0.1 -p 8600 web-frontend.service.consul'. The query returns no results. Which of the following is the most likely reason?
Consul DNS returns only healthy service instances by default. If the TCP check on port 8080 is failing, the service instance is marked critical, and DNS queries will not return its IP address. This is the most likely reason for no results. The developer should verify the health check status using the HTTP API or the Consul UI.
Why this answer
Consul DNS returns only service instances that are passing their health checks. If the TCP check on port 8080 is failing, the instance is marked critical and excluded from DNS results. The developer should check the health status via the HTTP API or UI.
The other options are incorrect because the DNS query format is valid, the 'passing' parameter is not required, and service names do not need underscores.
Exam trap
The trap here is forgetting that Consul DNS by default filters out unhealthy instances, so a failing health check leads to no DNS results.
You are using Consul 1.15 with Connect enabled. A service 'web' needs to communicate with an upstream service 'api' in a different datacenter. You have configured a mesh gateway in each datacenter. The 'web' service's sidecar proxy is configured with an upstream for 'api'. However, traffic is failing. You check the sidecar proxy logs and see 'no healthy upstream'. What is the most likely cause?
The error 'no healthy upstream' indicates that the sidecar proxy cannot find any healthy instances of the upstream service. In a cross-datacenter scenario, the local Consul servers must be able to discover the remote service via the mesh gateway. If 'api' is not registered or has no healthy instances in the remote datacenter, the local proxy will report this error. This is the most likely cause.
Why this answer
The error 'no healthy upstream' means the sidecar proxy cannot find any healthy instances of the upstream service. In a cross-datacenter setup with mesh gateways, this typically occurs when the upstream service is not registered or has no healthy instances in the remote datacenter. Other issues like missing gateway registration or deny intentions would produce different errors.
Exam trap
The trap here is assuming that a deny intention causes 'no healthy upstream', but intentions affect authorization, not service discovery.
You need to deny all traffic between 'service-a' and 'service-b' using intentions. What is the most efficient way to achieve this?
This command directly creates a deny-type intention.
Why this answer
Intentions can be set to 'deny' explicitly, which overrides any 'allow' rules.
You have implemented a leader election mechanism using Consul KV sessions. The session has a TTL of 15 seconds. If the application crashes, how long will it take for the lock to be automatically released?
The session TTL defines the duration after which an un-renewed session is invalidated, releasing associated locks.
Why this answer
Consul sessions are invalidated when their TTL expires without a renewal. With a 15-second TTL, if the application crashes and stops calling session renew, the session becomes invalid after 15 seconds, and any locks or KV entries tied to that session are released at that point. The lock release is therefore bounded by the session TTL, not by any manual intervention.
Exam trap
The trap is assuming Consul detects failures instantly or that lock release requires manual action — candidates must remember that session-based locks are released only after the configured TTL elapses, and that lock-delay can extend that window further.
How to eliminate wrong answers
Option A is wrong because Consul cannot detect a crash instantaneously — it relies on TTL expiry or explicit session destruction, so release is not immediate. Option B is wrong because 60 seconds is not derived from any Consul default; the session TTL is explicitly configured as 15 seconds, and Consul honors that value (subject to the 10x TTL multiplier for lock-delay, which is a separate concept). Option C is wrong because sessions are designed precisely to auto-release locks on failure; manual deletion is only required if the session is still being renewed or if lock-delay is configured to hold the lock.
If a Consul agent is configured with 'disable_remote_exec = true', how does this affect the KV store?
disable_remote_exec only blocks Consul's remote exec functionality, preventing command execution on agents. The KV store is a separate subsystem accessed via its own HTTP API, so this setting leaves key-value operations entirely unaffected, matching the option's no-effect claim.
Why this answer
'disable_remote_exec' controls whether Consul's remote execution feature (the 'consul exec' command) is allowed on the agent. It has no relationship to the KV store — KV reads, writes, watches, and consistency modes are governed by separate ACL and query parameters. Setting this flag simply blocks remote command execution for security hardening.
Exam trap
Consul 1.15 often tests whether candidates conflate security-hardening flags with data-plane behaviour — the trap is assuming any agent-level restriction affects the KV store, when in fact disable_remote_exec only gates the exec subsystem.
How to eliminate wrong answers
Option A is wrong because KV read consistency is controlled by the 'consistent', 'stale', or 'default' query parameters and the '?consistent' flag, not by remote exec settings. Option B is wrong because KV writes are gated by ACL policies and Raft leadership, not by disable_remote_exec. Option C is wrong because KV watches are implemented via blocking queries on the KV endpoint and are unaffected by remote exec configuration.
You are deploying a Consul Connect service mesh in a single datacenter. A developer asks how service-to-service authorization is enforced when two services communicate through their sidecar proxies. What is the primary mechanism that controls whether the connection is allowed?
Intentions are the authorization layer in Consul Connect. They evaluate the source identity (from the client certificate) against the destination service and return allow or deny. This is independent of network ACLs or firewall rules, and it is enforced by the sidecar proxies when a connection is established. Therefore, intentions are the correct mechanism for controlling service-to-service authorization.
Why this answer
Consul intentions are the authorization mechanism in Consul Connect. They evaluate the source service identity against the destination service and determine whether the connection is allowed. While mTLS provides authentication and encryption, it is the intention that enforces authorization.
Network ACLs and static proxy configurations do not fulfill this role. Therefore, intentions are the correct answer.
Exam trap
The trap here is confusing authentication (mTLS) with authorization (intentions), assuming that a valid certificate automatically grants access.
A team is standardizing health check definitions across a fleet of Consul 1.15 agents. They want checks that can be expressed entirely in HCL and do not require an external script interpreter on the node. Which two check types meet these criteria? (Choose two.)
The http check is defined declaratively in HCL with fields such as http, method, header, and tls_skip_verify. The agent performs the request itself using its internal HTTP client, so no external interpreter or binary is needed on the node. This makes it ideal for fleets where installing curl or a scripting runtime is undesirable, and it returns rich status based on the response code.
Why this answer
Both http and tcp checks are evaluated directly by the Consul agent using its internal networking stack, and both are fully declarable in HCL without any external interpreter or binary. Script and docker checks depend on external runtimes, while alias checks merely mirror other checks and are not standalone probes. This makes http and tcp the portable choices for a standardized fleet.
Exam trap
The trap here is treating alias as a self-contained probe because it is declarative, when it actually requires another check to exist and be healthy.
You are deploying a service that requires distributed locking with automatic release if the service instance fails. You have created a session named 'lock-session' and acquired a lock on the KV key 'locks/db'. After a few minutes, the lock is unexpectedly released even though the service instance is still running. Which action should you take to diagnose the most likely cause?
Consul sessions are invalidated if not renewed within their TTL. If the service fails to renew the session, the lock is released automatically. This is the most likely cause when the service is still running but not properly renewing. Checking renewal activity directly addresses the root cause and is the correct diagnostic step.
Why this answer
Consul sessions have a TTL and must be periodically renewed by the client. If the service fails to renew within the TTL, the session is invalidated and any locks held by that session are released. In this scenario, the service is still running but likely not renewing the session, causing the lock to be released.
Verifying renewal activity is the correct diagnostic step.
Exam trap
The trap here is assuming that the lock is released due to external interference or server issues, rather than the session TTL expiring because of missed renewals.
Which of the following best describes the 'consul agent -dev' mode in relation to service discovery?
The -dev flag starts an in-memory, single-node agent that acts as both server and client, with no persistence or clustering. It is intended purely for local testing and development of service registration and discovery, not production use.
Why this answer
The 'consul agent -dev' flag starts a single-node Consul agent configured as a server and client in one process, with an in-memory datastore, no persistence, and no cluster join. It is explicitly designed for local development, testing, and demos — not for production — and it still exposes the DNS interface, HTTP API, and service catalog so you can exercise service discovery locally.
Exam trap
The trap is assuming dev mode is a lightweight production option or that it disables interfaces — candidates should remember it is strictly a single-node, in-memory, non-persistent environment intended only for testing.
How to eliminate wrong answers
Option A is wrong because dev mode does not disable the DNS interface; DNS is enabled by default on port 8600, which is one of the reasons dev mode is useful for testing service discovery. Option B is wrong because Consul never stores its catalog in Redis — the catalog lives in Consul's own Raft-backed state store, and dev mode simply keeps that state in memory. Option C is wrong because dev mode has no persistence, no redundancy, and no security hardening, making it unsuitable for production clusters.
An operator writes a feature flag to `app/features/new-ui` using `consul kv put app/features/new-ui true`. Later, a health-check script reads that key and receives an error instead of the value. The operator confirms the key exists with `consul kv get app/features/new-ui`. Which command should the operator run to inspect the metadata that would reveal a problem such as a missing or expired session on the key?
The -detailed flag adds CreateIndex, ModifyIndex, LockIndex, Flags, and Session to the output. Inspecting the Session field shows whether a session is attached to the key, and the absence or expiry of that session explains why a lock-holding reader may fail while a plain read succeeds.
Why this answer
Metadata such as the attached session and lock index is only exposed when the detailed view is requested. A key can be readable while still being held by a session, and a health script that attempts to acquire the lock will fail in that case. Requesting the detailed output surfaces the session identifier needed to investigate further.
Exam trap
The trap here is treating a successful plain read as proof the key is healthy, when the real fault lies in session metadata that only the detailed view exposes.
When using 'prepared_queries' for cross-datacenter failover, what does the 'failover' block allow you to specify?
The `failover` block within `prepared_queries` accepts a `targets` list naming datacenters in priority order, so Consul attempts service resolution against each in turn when the local datacenter's instances are unreachable. This satisfies the cross-datacenter failover constraint by defining exactly which remote datacenters to query.
Why this answer
The failover block in a prepared query specifies a list of datacenters to attempt for service resolution when the local datacenter has no healthy instances. This enables cross-datacenter failover by defining an ordered fallback list. It does not control timeouts, encryption, or retry counts.
Exam trap
Consul 1.15 often tests the confusion between failover datacenter selection and unrelated settings like timeouts or encryption, leading candidates to pick options that sound plausible but are configured elsewhere.
How to eliminate wrong answers
Option A is wrong because WAN gossip timeout is configured elsewhere (e.g., serf_wan settings), not in the prepared query failover block. Option C is wrong because encryption algorithms are configured at the gossip and RPC layer, not per prepared query failover. Option D is wrong because retry counts per node are not part of the failover block; failover defines datacenter targets, not retry behavior.
In a Consul health check, what does the 'notes' field provide?
The notes field carries a human-readable description attached to a health check, displayed in the Consul UI and API output to explain the check's purpose. It has no effect on check status evaluation or service registration behaviour.
Why this answer
The 'notes' field in a Consul health check is a free-form, human-readable string that operators use to document the purpose, ownership, or remediation guidance for the check. It is displayed in the Consul UI and API responses but has no effect on the check's pass/fail evaluation. This makes it purely informational metadata for operators and dashboards.
Exam trap
Consul 1.15 often tests confusion between 'notes' (human-readable metadata) and 'Output' (last check result message), causing candidates to pick the wrong field for describing check results.
How to eliminate wrong answers
Option A is wrong because the trigger time is not stored in 'notes'; timing is captured in fields like 'Status', 'Output', and the check's interval/timeout configuration. Option C is wrong because the expected result is defined by the check type itself (e.g., HTTP status 2xx, script exit code 0), not by 'notes'. Option D is wrong because the check logic is defined in the check definition (HTTP URL, TCP port, script, TTL), not in the 'notes' field.
Which THREE of the following are components of a Consul Connect service definition?
The proxy block declares the sidecar or native proxy that mediates inbound and outbound Connect traffic for the service. It is a valid top-level component of a Consul Connect service definition, satisfying the stem's requirement to identify Connect definition components.
Why this answer
Connect services typically use 'proxy', 'upstreams', and 'connect' blocks to define their behavior in the mesh.
You notice that the KV store is not consistent across datacenters. What is the cause?
Consul's KV store is scoped per datacenter; entries written in one datacenter are not replicated to peers. Cross-datacenter inconsistency is therefore expected behaviour, not replication failure, because each datacenter maintains its own independent KV namespace.
Why this answer
Consul's KV store is datacenter-local by design — each datacenter maintains its own independent KV namespace with no automatic replication to peer datacenters. When you write a key in dc1, it does not appear in dc2 unless you explicitly write it there or use a tool like consul-replicate. This is expected behaviour, not a fault.
Exam trap
Consul 1.15 often tests the misconception that Consul is a globally consistent KV store — candidates assume cross-DC replication is automatic and blame Raft or gossip when they see divergence, missing that KV is DC-scoped by design.
How to eliminate wrong answers
Option A is wrong because a broken Raft protocol would cause loss of consensus and leader election failures within a single datacenter, not cross-DC KV divergence — and it would manifest as write failures, not silent inconsistency. Option B is wrong because a missing 'write' ACL permission would cause 403 errors on writes, not inconsistent reads across datacenters. Option D is wrong because WAN gossip carries only membership and serf events between datacenters; it does not replicate KV data, so disabling it would break federation but not explain KV divergence.
Which command line tool can you use to manually trigger a TTL check update for a specific service?
Consul's HTTP API exposes agent check endpoints, so a PUT to /v1/agent/check/pass/checkID marks the named TTL check as passing and resets its timer. This is the documented manual method for pushing a TTL check update without waiting for the service to report.
Why this answer
The Consul HTTP API exposes agent check endpoints that allow external systems to push health status updates. A TTL check registered with the local agent can be manually marked passing by sending an HTTP PUT to /v1/agent/check/pass/<checkID> on port 8500. This is the documented mechanism for scripts and external monitors to report liveness without waiting for the TTL to expire.
Exam trap
The trap here is confusing the KV store API with the health check API — candidates who remember 'consul kv put' as the generic write command often pick it, forgetting that health state is managed through the agent check endpoints, not the KV store.
How to eliminate wrong answers
Option A is wrong because 'consul kv put' writes key/value pairs into the KV store and has no relationship to health check state. Option C is wrong because 'consul agent -check-update' is not a valid Consul CLI subcommand or flag; the agent command starts the agent process and does not accept a check-update argument. Option D is wrong because 'consul health update' does not exist — the 'consul health' subcommand only supports node, service, state, and checks queries, not updates.
A platform team operates two Consul datacenters, 'dc1' and 'dc2', and wants operators in dc2 to resolve service names registered in dc1 without a full mesh of local agents. They have already used 'consul join -wan' to link the server agents. Which feature should they rely on for DNS lookups of remote services?
Consul's DNS interface natively understands the '.dcX.consul' suffix. When a local agent receives a query for a service in a remote datacenter, it forwards the request to that datacenter's servers across the WAN gossip and RPC federation link, so no extra components or manual forwarding rules are required once servers are joined.
Why this answer
Once server agents are joined over the WAN, Consul's DNS interface resolves remote services using the datacenter label in the query name, forwarding the request to the owning datacenter's servers. No recursor changes, address translation, or snapshot copying are needed. The federation link itself provides the cross-datacenter query path for both DNS and HTTP interfaces.
Exam trap
The trap here is assuming that cross-datacenter DNS requires extra DNS forwarding configuration, when Consul's own interface handles the datacenter suffix natively.
Which of the following is a valid method to update a TTL health check?
HTTP PUT to `/agent/check/pass/<check_id>` lets the agent mark a TTL check passing, resetting its expiry timer. This satisfies the stem's requirement to update a TTL health check, since TTL checks are updated by external processes reporting status via the agent's HTTP API rather than by Consul polling a service.
Why this answer
TTL checks are updated by calling the Consul HTTP API's agent check endpoints — specifically an HTTP PUT to /v1/agent/check/pass/<check_id> (or /warn and /fail) — which resets the TTL timer and marks the check healthy. This is the canonical heartbeat mechanism for TTL checks.
Exam trap
Consul 1.15 often tests whether candidates know that TTL checks are updated via the agent HTTP API (PUT /v1/agent/check/pass), not via KV writes, CLI health reads, or config file edits.
How to eliminate wrong answers
Option A is wrong because 'consul kv' manipulates the key-value store, not health check state — KV writes have no effect on TTL timers. Option C is wrong because the 'consul health' CLI subcommand reads health information; it does not update a TTL check. Option D is wrong because editing the service definition file and reloading only re-registers the check with a fresh TTL window; it does not constitute the ongoing heartbeat that keeps the check passing.
You need to retrieve the session information for a specific session ID. Which endpoint should you query?
The /v1/session/info/:id endpoint returns details for the session matching the supplied ID, satisfying the requirement to retrieve one specific session's information. Other session endpoints create, destroy or list sessions, so they cannot target an individual identifier.
Why this answer
The Consul HTTP API exposes session information through the /v1/session/info/:id endpoint, which returns the full session object (ID, node, checks, behavior, TTL, lock-delay) for the specified UUID. This is the documented read endpoint for a single session, distinct from /v1/session/list (all sessions) and /v1/session/node/:node (sessions on a node).
Exam trap
Consul 1.15 often tests whether candidates know the exact HTTP API verb/path for session operations — the trap is confusing /v1/session/info/:id with plausible-sounding but nonexistent paths like /read or /get.
How to eliminate wrong answers
Option A is wrong because /v1/session/read/:id is not a valid Consul API path — there is no 'read' action under the session resource. Option C is wrong because /v1/kv/session/:id does not exist; the KV store has no session sub-resource, and sessions are managed under /v1/session. Option D is wrong because /v1/session/get/:id is not a Consul endpoint — 'get' is not used as an action verb in the session API.
Practice Consul 1.15 by domain
Target a specific domain to shore up weak areas.