scenario questions

An operator wants to list every key beneath the `services/web/` prefix, including nested paths, and see each key's associated flags and modify index. Which command returns that information?

A platform team runs a Consul 1.15 cluster where a legacy VM service registers its health check through the /v1/agent/check/register HTTP API rather than a service definition file. The check is a script check that takes about 40 seconds to finish on a busy host. Operators notice the check flaps to critical roughly every minute even though the script always exits 0 when run manually. The agent's check_update_interval is left at the default. Which change most directly resolves the flapping without altering the script itself?

You are deploying Consul servers in a new datacenter that will be a secondary in a federated environment. The primary datacenter is already configured with ACLs enabled and replication is working. You need to ensure the new secondary datacenter can replicate ACLs from the primary. Which configuration must be set on the new secondary's servers?

What is the default value for the Consul KV flags field if not provided during a write?

You need to perform a write operation to the Consul KV store that only succeeds if the current ModifyIndex of the key is zero. Which parameter should you include in your API call?

A security team stores application secrets under the Consul KV prefix `app/prod/`. They want to be notified whenever any key under that prefix changes, without repeatedly polling the entire prefix. They have access to the Consul HTTP API and the `consul watch` command. Which approach should they use?

A developer is deploying a new service called 'inventory' with a Connect sidecar proxy. They want to verify that the sidecar is running and registered correctly. Which command should they use to check the status of the Connect-enabled service?

Which interface would you use to register a service dynamically using standard tools like 'curl'?

A DevOps engineer is configuring a Consul service `payment-processor` that must be discoverable only when its health check is passing. The service is registered with a script health check that runs every 10 seconds. The engineer wants to ensure that DNS queries for `payment-processor` return only healthy instances. Which two actions should the engineer take? (Choose two.)

A platform team stores service configuration under the Consul KV prefix `config/web/`. An operator runs `consul kv put config/web/timeout 30` at a time when the key already exists with value `45` and ModifyIndex `812`. The operator later needs to update the value only if no one else has changed the key since that write. Which Consul CLI invocation correctly performs this compare-and-swap using the index returned by the prior write?

An operator manages a Consul 1.15 cluster where Connect is enabled and mTLS is active. They need to rotate the Connect CA root certificate for the datacenter. The new root must be distributed to all sidecar proxies without dropping existing connections, and the old root must remain trusted during the transition. Which sequence of actions accomplishes this?

You are configuring a Consul Connect service mesh and need to enable mTLS for all services in the datacenter. Which configuration setting must be enabled in the Consul server agent configuration to turn on Connect and enforce mTLS globally?

A team stores rolling deployment state under `deploy/current`. To avoid a race where two operators both believe they own the release, the application must acquire the key only if it is not already held, and it must automatically release the key if the holding process dies. Which combination of Consul primitives achieves this?

A platform team runs a Consul 1.15 cluster where a critical payment service is registered with a TTL health check. The service owner wants Consul to mark the check as critical if the application fails to renew the TTL for more than one minute. Which configuration field should be set in the service definition to enforce this behavior?

A Consul operator observes that a web service registered on two nodes is only reachable through the DNS interface on one node. The service definition on both nodes is identical, including the same service name and port. What is the most likely cause?

Which TWO of the following are benefits of using Consul Connect?

Which THREE of the following represent potential bottlenecks for Consul KV performance?

A cloud engineer is setting up a new Consul 1.15 datacenter that will join an existing WAN federation. The existing datacenter uses a specific gossip encryption key for the WAN pool. Which configuration parameter must be set on the new datacenter's servers to ensure they can participate in WAN gossip?

You are monitoring service health using Consul and want to ensure that a service is automatically removed from the catalog if it remains in a 'critical' state for more than 24 hours. Which configuration key supports this?

An operator needs to update the value of `config/database/url` in Consul KV, but only if the current value is exactly `postgres://old:5432`. They want to use the Consul CLI to perform a compare-and-swap operation. Which command should they use?

You need to register a health check that triggers an alert when memory usage is high. Which type of check is most appropriate?

An operator configures a TCP health check for a database service on port 5432, specifying tcp = "localhost:5432" and interval = "10s". The database process is running and accepting connections, but the check is reported as critical. What is the most likely explanation?

An operator is configuring a new Consul datacenter that must be able to resolve services in a remote datacenter using the DNS interface. The remote datacenter is already federated and reachable. Which query format should the operator use to resolve a service named 'web' in the remote datacenter 'dc2'?

You are troubleshooting a partition between two datacenters. The WAN gossip shows high latency. Which Consul CLI tool provides the best insight into the WAN gossip state?

You observe that a session lock is being released unexpectedly. What is the most likely cause?

Which command displays all active intentions in the Consul mesh?

A Consul operator is using the HTTP API to register a web service with an external health check script. The operator wants to ensure that if the service process fails but the node remains up, the service is marked unhealthy and removed from DNS query results. Which of the following API endpoints should the operator use to register the service and its check together?

What is the purpose of the 'Behavior' field when creating a Consul session?

A platform team runs a service on a VM and wants Consul to automatically remove the service instance from the catalog if its health check remains critical for more than 10 minutes. The service is registered via the agent's configuration directory. Which check definition field accomplishes this?

Which TWO are common use cases for Consul Connect?

A developer needs to remove an obsolete configuration key `app/legacy/timeout` from Consul's KV store so the application no longer reads it. Which command deletes this single key?

When configuring ACL replication, where must the 'acl_replication_token' be defined?

A developer stores a feature flag at the key `config/features/new-ui` in Consul KV and wants to atomically create it only if it does not already exist, failing the write if the key is present. Which Consul CLI command accomplishes this?

An operator needs to delete the single KV entry `app/temp/cache-ttl` but must leave every other key under `app/temp/` untouched. Which command performs exactly that deletion?

An operator is configuring a new Consul 1.15 datacenter 'dc3' to join an existing WAN federation with primary datacenter 'dc1'. The operator wants to ensure that dc3 can automatically rejoin the WAN gossip pool after a restart. Which configuration parameter should be set in dc3's server configuration?

A service definition includes a 'meta' block. What is the intended use of this block?

You are configuring a Consul secondary datacenter to replicate ACLs from the primary. You have set 'primary_datacenter' and 'acl_replication_token' on the servers. However, replication is failing. Which of the following is the most likely cause?

Which status indicates that a health check is successfully passing according to Consul?

A developer uses the Consul KV store to coordinate a rolling deployment. They write a key `deploy/status` with the value `in-progress` using `consul kv put deploy/status in-progress`. Later, they want to check the current value of that key without any blocking or long-polling behavior. Which command should they run?

A Consul operator defines a service check with the following HCL block: check { id = "web-api" name = "Web API HTTP" http = "http://localhost:8080/health" interval = "10s" timeout = "1s" }. The endpoint consistently responds in 1.4 seconds but returns HTTP 200. What status will Consul report for this check?

A Consul cluster has three server nodes and multiple client agents. A service 'db' is registered on two nodes, each with a health check that includes 'DeregisterCriticalServiceAfter' set to '1h'. One of the nodes experiences a network partition and becomes unreachable. After 2 hours, the node rejoins the cluster. What happens to the service instance on that node?

What is the function of the 'consul intention check' command?

A platform team runs Consul 1.15 with Connect enabled. Their service 'api' is registered with a sidecar proxy, and its upstream 'database' is also mesh-enabled. The team wants 'api' to resolve 'database' through the mesh without hard-coding an IP address in the application. Which configuration in the service registration enables the sidecar to expose a stable local listener for the upstream?

Which THREE of the following are valid check types in Consul?

A platform team runs a gRPC service and wants Consul to use the standard gRPC health checking protocol rather than a custom script. The service listens on port 50051 and exposes the standard health service. Which check definition should they use?

A security team requires that a service 'reporting' only accept connections from services presenting a valid mesh certificate issued by the Connect CA, and that all other traffic be rejected. They have registered reporting with a sidecar proxy. Which combination ensures this behavior?

A platform team stores feature-flag values under the prefix `config/features/`. They need to read the single key `config/features/checkout` and receive its value along with metadata such as `CreateIndex` and `ModifyIndex` in the response. Which Consul CLI command accomplishes this?

You are using a Consul KV entry to store a feature flag. You want the flag to be automatically deleted if the node that owns it becomes unhealthy. Which Consul API operation should you use?

A service 'inventory' is registered in Consul 1.15 with Connect enabled. You need to verify that the sidecar proxy for 'inventory' is running and healthy. Which command should you use?

How do you enable WAN federation between two Consul datacenters that do not share a network?

Which HTTP method is used to create or update a key in the Consul KV store?

You need to verify if a node has successfully joined the cluster for service discovery. Which tool confirms this?

You are implementing a distributed semaphore using Consul KV and sessions. You create a session with a TTL of 60 seconds and use the 'acquire' parameter to lock a key. After acquiring the lock, the application holding the session experiences a 90-second pause due to a garbage collection stop-the-world event. The Consul agent on the node is healthy and continues to renew the session. What happens to the lock?

Which THREE of the following are valid ways to register a service in Consul?

When configuring a Service-specific health check, what is the impact of setting the 'expose' field to true?

What is the role of a Consul server in a non-primary datacenter regarding ACLs?

What is the recommended approach for running health checks on a service that is part of a non-containerized, multi-process architecture?

A Consul 1.15 operator registers a service with an alias health check that points to another service's check. The aliased check is currently in a warning state. What status will the alias check report?

If a service has multiple health checks associated with it, when is the service itself considered 'critical'?

You are operating a Consul 1.15 cluster with Connect enabled. A service named 'api' is registered with a sidecar proxy. You need to ensure that only the 'web' service can initiate connections to 'api'. You have created an intention that allows 'web' to connect to 'api', but you have not created any other intentions. What is the default behavior for other services trying to connect to 'api'?

What does the 'kind' field in a service definition specify for a Consul Connect service?

Which TWO of the following are features of Consul Connect native integration?

Which THREE of the following fields are returned in a typical Consul KV API GET response?

A team wants to store structured configuration for several microservices in Consul's KV store and retrieve an entire service's configuration with a single CLI call. They plan to keep all keys for `payments` under `services/payments/`. Which command retrieves every key under that prefix in one invocation?

An engineer registers an external service for a third-party payment gateway that cannot run a Consul agent. The registration uses an alias health check that points at a Consul node named 'edge-proxy-01' and a service named 'payment-gateway'. The external service stays healthy in the catalog as long as the proxy node and service are passing. A second engineer later adds a separate script check directly to the same external service definition. After a deployment, the payment gateway disappears from DNS even though the edge proxy node and its payment-gateway service both report passing. What is the most likely cause?

Which THREE factors influence the mTLS handshake in a Consul Connect mesh?

An operator wants to atomically create a key `locks/leader` only if it does not already exist, so that two competing processes cannot both become leader. Which Consul KV operation should be used?

A developer needs to see which intentions currently govern traffic between services in a Consul 1.15 datacenter. Which command lists all intentions stored in the catalog?

Which THREE network considerations are vital for Consul WAN federation?

You are configuring a Consul Watch to trigger a script whenever a specific KV key changes. Which type of watch should you define in your configuration file?

Which command-line interface command is used to set a value in the Consul KV store?

Which of the following is a key feature of Consul Connect's intentions?

What is the impact of setting 'enable_tag_override' to true in a service definition?

When using Consul DNS for a service, what happens if no instances are healthy?

You are configuring Consul Connect for a service named 'payments'. You want to allow incoming connections only from services that present a valid client certificate from a specific CA and also enforce that the source service is 'checkout'. What combination of Consul features should you use?

An operator registers a service with a script health check that runs a custom binary. The binary exits with status code 1. What status will Consul assign to the service's health check?

Which THREE of the following are true about Consul KV keys?

Which TWO of the following are true regarding the Consul Service Catalog?

You want to delete a key and all its children in the KV store using the CLI. Which flag should you use?

What is the primary benefit of using a Mesh Gateway in a Consul Connect architecture?

Which Consul API endpoint is used to create a new session that can be used for locking KV keys?

In a multi-datacenter environment, what happens if the 'primary_datacenter' server cluster becomes unavailable?

You are deploying a blue/green release where the active environment is selected by the value of the Consul KV key `deploy/active-color`, currently set to `blue`. Your CI pipeline must atomically switch the value to `green` but only if the current value is still `blue`, and must fail if another pipeline already changed it. Which API operation should the pipeline use?

A Consul service is registered with a TTL health check. The application owner wants the service to be marked unhealthy automatically if the application stops sending heartbeats, without requiring a separate check script or endpoint. The application can send heartbeats every 10 seconds. Which TTL check configuration should be used to mark the service unhealthy after no heartbeat is received for 30 seconds?

When a service check transitions to 'critical', what does Consul do with the service's DNS entry?

When using the Consul KV store, what is the maximum size allowed for a single value in a key?

You are configuring a health check that should be considered passing as long as the HTTP response code is in the 2xx range. Which HTTP check configuration achieves this?

A developer registers a service called 'web' with a sidecar proxy in a Consul 1.15 datacenter. The service needs to call a backend service named 'api' through the mesh. The developer adds an upstream block to the 'web' service definition pointing to 'api' on port 8080. What does this upstream configuration accomplish for the 'web' sidecar proxy?

An operator wants to query the Consul catalog for all nodes that provide a service named `api` in the `us-east` datacenter. They need to retrieve the node names and addresses. Which Consul HTTP API endpoint should they use?

A developer notices that the application process in a Connect-enabled pod connects to 127.0.0.1:8080 to reach an upstream, but the sidecar proxy's actual listener was assigned a different port. The application is failing to reach the upstream. Which action should the developer take to provide a predictable local address for the upstream?

You are deploying a Consul cluster across three datacenters: dc1, dc2, and dc3. Each datacenter has its own LAN gossip pool and they are all joined via WAN gossip. You want to enable cross-datacenter service discovery so that services in dc1 can discover services in dc2 and dc3. Which Consul feature allows a service in one datacenter to query services in another datacenter without additional configuration?

When providing a session TTL, what is the minimum duration allowed?

You are designing a distributed leader election system using Consul. A service instance must hold a lock on the KV key 'service/leader' to become the leader. You need to ensure that if the instance crashes or loses network connectivity, the lock is automatically released so another instance can acquire it. Which Consul feature should you use to achieve this?

A platform team runs Consul agents in server mode on three dedicated hosts and client agents on each application node. They need a check that verifies the Consul servers themselves are reachable on the Serf LAN gossip port from the perspective of every client agent, so that a partitioned server is flagged even if it still answers HTTP requests on port 8500. Which check definition should they register on each client agent?

A platform engineer is defining a TTL health check for a batch worker that cannot be polled by the Consul agent. The check must be considered healthy only when the worker actively reports in, and must become unhealthy if the worker stops reporting. Which two configuration elements are required to make this TTL check functional? (Choose two.)

To verify if two datacenters are connected via WAN, which command shows the remote datacenter's server nodes?

A developer runs `dig @127.0.0.1 -p 8600 web.service.consul SRV` and receives no records, even though `consul catalog services` lists `web` and `consul members` shows the node as alive. A health check for the `web` service is registered and currently shows a critical status. What is the most likely cause of the empty SRV response?

Which TWO of the following are standard DNS records returned by Consul for service discovery?

You need to perform a canary deployment for a service. What Consul feature should you use?

What information does the Consul HTTP API return for a health check? (Select TWO)

A DevOps engineer runs a Consul 1.15 agent on a VM and registers a web service with a script health check that executes a local shell script. The script returns exit code 0 when the service is healthy and exit code 1 when unhealthy. After the script runs, Consul reports the check status as passing. Which statement best describes how Consul interprets the script's exit code for this check?

What is true about Consul health checks? (Select TWO)

Which TWO of the following are valid ways to configure Consul Connect?

A Consul service check is configured with `deregister_critical_service_after: "10m"`. The service enters a critical state due to a failed check. What happens after 10 minutes if the check remains critical?

When multiple agents are in a cluster, how does Consul ensure that service discovery information is consistent across all nodes?

A platform team is running Consul Connect with Envoy sidecar proxies. They need to ensure that a service named 'payments' can only be accessed by services in the 'frontend' namespace, and all other access must be denied. They have Consul Enterprise with namespaces enabled. Which intention configuration achieves this requirement with the least administrative overhead?

A platform team is deploying a new service 'payments' on a Consul 1.15 cluster with Connect enabled. They want to ensure that only the 'checkout' service can initiate connections to 'payments', and all other services are denied by default. Which intention should they create?

A Consul operator wants to ensure that if the primary datacenter becomes unavailable, the secondary datacenter can continue to operate for existing services and intentions. Which statement best describes Consul's behavior in this scenario?

A service is registered with a check that has deregister_critical_service_after set to 30m. The service's check enters the critical state due to a transient network partition. The partition is resolved after 20 minutes, and the check returns to passing. What is the effect on the service registration?

A developer has stored the database connection string under the Consul KV path `config/db/primary`. A configuration management script needs to fetch this value as raw text so it can be exported directly into an environment variable. Which Consul CLI command retrieves only the value of that key?

A team is running Consul 1.15 with Connect and wants to expose a TCP service through an ingress gateway so external clients can reach it over mTLS. They define the gateway and a listener on port 8443. External clients report TLS handshake failures. The gateway logs show no matching certificate. Which configuration element must be present for the listener to serve TLS?

A Consul operator registers a web service on a node with a service-level health check that uses the HTTP type and points to http://127.0.0.1:8080/health. The check has been passing for weeks, but the team now wants to stop advertising the service in DNS and the service catalog when the /health endpoint returns HTTP 500. Which Consul check status will the service health be reported as when the endpoint returns 500?

What is the benefit of using a Mesh Gateway in a multi-datacenter deployment with overlapping IP space?

Which HTTP status code range does Consul interpret as a passing state for an HTTP health check?

When troubleshooting a failing health check, which tools are recommended? (Select TWO)

When configuring mTLS in Consul Connect, how are certificates distributed to the sidecar proxies?

You need to ensure that a read operation from the KV store is strongly consistent. Which consistency mode should you specify?

A platform engineer is adding a new service to Consul. The service must appear in the catalog with the name 'billing', be reachable over DNS at billing.service.consul, and be associated with the tag 'prod'. Which registration block correctly achieves this when using the HTTP API?

You want to ensure that specific services in a remote datacenter are only accessible to certain local services. How can you achieve this?

An engineer needs a service check that simply confirms a TCP port on the same host is accepting connections, without sending any application payload. Which Consul check configuration accomplishes this?

You have a service that needs to talk to a service in a different datacenter. What configuration is required?

A Consul operator needs to deregister a specific service instance named 'web-01' from a node without affecting other instances of the same service. The service was registered with the ID 'web-01'. Which action accomplishes this?

If you are using SPIRE for certificate management, how does this interact with Consul Connect?

A company runs a primary datacenter and a secondary datacenter with ACL replication enabled. During a maintenance window the primary's servers are taken offline for several hours while the secondary remains fully operational. What is the expected behavior in the secondary during the outage?

You are deploying a service that must store a critical configuration value in Consul KV. The value must only be visible to services with a token that has read access to that specific key. You also need to ensure that any write to the key can only be performed by a token with write access. Which Consul feature should you use?

A Consul 1.15 operator configures an HTTP health check for a service with the following settings: http = "https://api.example.com/health", tls_skip_verify = false, and method = "GET". The check is failing with a certificate error. Which configuration change should the operator make to allow the check to succeed while maintaining security?

You are configuring a new Consul datacenter named 'dc2' to join an existing WAN federation with primary datacenter 'dc1' that uses mesh gateways. The WAN is not directly routable between datacenters. Which configuration allows dc2's servers to establish WAN federation through the mesh gateways?

An operator registers a web service with a TTL health check and forgets to send periodic updates. After the TTL expires, the service appears as critical in the Consul UI. Which behavior explains why the check transitioned to critical automatically?

A developer needs to register a service named 'api' with Consul and ensure that it is only discoverable by consumers that explicitly request the 'v2' tag. Which Consul feature should be used?

Which TWO of the following statements are true about the 'passing' parameter in DNS queries?

You are deploying a new service 'api' in a Consul Connect mesh. You want to ensure that all incoming connections to 'api' are logged for auditing purposes. Which Consul feature should you configure?

What happens to the gossip protocol if the 'encrypt' key is mismatched between two datacenters trying to join via WAN?

Which TWO of the following are valid ways to monitor Consul Connect performance?

When joining a new datacenter to an existing WAN pool, what is the best practice for server versions?

A new engineer is configuring a Consul server agent for a datacenter named 'west' and wants the agent to automatically rejoin the WAN federation after a restart without manual intervention. Which configuration setting should they use?

A Consul cluster is used for service discovery across multiple datacenters. A service named 'api' is registered in both datacenter 'dc1' and 'dc2'. A client in 'dc1' needs to discover instances of 'api' in 'dc2' using DNS. Which DNS query format should the client use?

A platform team operates a Consul 1.15 cluster with a primary datacenter in us-east-1 and a secondary datacenter in eu-west-1. After configuring ACLs for replication, they update a token policy in the primary datacenter. A security engineer in the secondary datacenter immediately checks the ACL token and finds the old policy still in effect. What is the most likely reason the policy change has not propagated yet?

A team configures a script health check on a client agent with `interval` set to 30s and `timeout` set to 5s. The script normally finishes in under a second, but during a nightly batch job it occasionally blocks on a lock for over a minute. The team wants Consul to mark the service unhealthy when the script exceeds the timeout instead of waiting indefinitely. What does Consul do when the script has not exited by the timeout value?

An administrator needs to query service information. Which DNS record type is commonly used by Consul to return service addresses?

A service has a TTL check configured with a 30-second TTL. If the application crashes and stops sending heartbeats, when will the service status change to 'critical'?

Which TWO of the following are valid ways to troubleshoot inter-datacenter communication issues?

What is the purpose of the 'service-tag' in a Consul service definition?

Which TWO of the following are true regarding Consul KV watches?

When defining a TCP health check, what is the primary indicator that the check is 'passing'?

You are using a Consul Watch to monitor KV changes. What does the 'handler' field specify?

What is the purpose of the 'datacenter' field in the Consul agent configuration?

A service is registered with a health check that has the field deregister_critical_service_after set to "10m". The service's check has been in the critical state for 15 minutes. What will Consul do?

When a health check is failing, which Consul API endpoint would you call to investigate the specific error message provided by the check?

A Consul 1.15 operator is defining a TTL-based health check for a batch job that only reports in when it completes a run. The job must be marked critical if it has not checked in within 30 minutes. The operator wants the check to start in the passing state so a freshly registered job is not immediately flagged. Which configuration block accomplishes this?

An operator wants to create a distributed lock using the Consul KV store and sessions. They create a session with `consul session create` and obtain a session ID. They then attempt to acquire a lock on the key `locks/primary` by running `consul kv put -acquire locks/primary leader1`. The command fails with an error indicating the lock is already held. Which of the following best explains why the lock acquisition failed?

Which component acts as the default sidecar proxy for Consul Connect?

What is the purpose of the 'upstreams' block in a service definition?

A Consul operator is defining an HTTP health check for a service and wants to ensure the check request includes custom headers and that the check tolerates a slow endpoint. Which two check definition fields should be used to accomplish these goals? (Choose two.)

You are joining two Consul datacenters via WAN gossip. Which command must be executed on a Consul server in the secondary datacenter to initiate the federation?

You are deploying a Consul Connect service mesh in a Consul 1.15 datacenter. You want to ensure that all service-to-service traffic is encrypted and authenticated. What is the default behavior for intentions when no intention is defined between two services?

When a session is associated with a lock, what happens to the lock if the session is deleted?

Which TWO of the following are true about the 'cas' parameter in KV writes?

You are configuring a new Consul datacenter in a multi-datacenter federation. The datacenter must be able to join the existing WAN gossip pool and participate in cross-datacenter service discovery. Which two configuration settings are required on the new datacenter's Consul servers to enable WAN gossip and ensure secure communication? (Choose two.)

A system administrator needs to delete a single key named `temp/config` from the Consul KV store. They want to ensure that only that key is removed and no other keys are affected. Which command should they use?

A service is intermittently failing to resolve via DNS because it has multiple health checks, some of which are 'warning'. How do you ensure it is only returned when all checks are 'passing'?

You are using Consul's DNS interface to query a service named 'web' in datacenter dc2 from a client in dc1. The query returns no results, but you know the service is running in dc2. What is the most likely reason?

A service mesh operator is troubleshooting a connectivity issue between two services in a Consul 1.15 datacenter. The sidecar proxy for the 'frontend' service cannot reach the 'backend' upstream. The operator has confirmed that intentions allow the traffic. Which log should they inspect first to diagnose the issue on the sidecar proxy?

Which THREE of the following are valid ways to categorize services in Consul?

A Consul operator needs to register a health check that runs a custom binary located at /opt/checks/validate.sh every 15 seconds. The check should be considered passing only when the script exits with code 0. Which check definition correctly implements this?

When using 'Consul Connect native' integration, how does the application handle mTLS?

You are managing a multi-datacenter Consul deployment with ACLs enabled. The primary datacenter is in dc1, and a secondary datacenter is in dc2. You have configured ACL replication in dc2 using acl_replication_token. After some time, you notice that new ACL tokens created in dc1 are not being replicated to dc2, and the replication status shows 'No known leader'. What is the most likely cause of this issue?

You are using Consul KV to coordinate a distributed job scheduler. A worker acquires a lock on a key to ensure only one worker runs a job at a time. The lock is tied to a session. The worker crashes and the session expires after its TTL. What happens to the lock on the key?

You are using Consul 1.15 with Connect and want to enable Layer 7 traffic management for a service 'api' to perform HTTP path-based routing. Which configuration is required in the service definition?

An operations engineer wants a service registered in Consul to be deregistered automatically from the catalog when its health check has been critical for an extended period, without any external tooling. The service definition is written in HCL and loaded via the agent's config directory. Which combination of settings accomplishes this?

A team is writing Consul 1.15 service definitions for a set of gRPC services that expose the standard gRPC health checking protocol on a dedicated port, and they want Consul to actively probe that protocol rather than a plain TCP connect. Which two settings must be present in each check block to make Consul perform a gRPC health check against the service? (Choose two.)

You have enabled ACL replication between a primary and secondary datacenter. What is the effect of changing an ACL policy in the primary datacenter?

A company runs Consul 1.15 in three datacenters: dc1 (primary), dc2, and dc3 (secondaries). The operations team wants to ensure that if dc1 becomes unavailable, the remaining datacenters can still authenticate services using existing ACL tokens. They have already configured ACL replication and WAN federation. Which statement best describes the expected behavior of ACL tokens in dc2 and dc3 during a primary datacenter outage?

You observe a 'warning' status for a service. What is the most common reason for this?

An operator registers a service 'cache' with an HTTP health check pointing to https://10.0.0.5:8443/health. The service appears in the catalog, but DNS queries for cache.service.consul return no records, and the check status shows critical with the message 'Get https://10.0.0.5:8443/health: x509: certificate signed by unknown authority'. Which action resolves the issue while keeping the check functional?

You are deploying a legacy Java application that cannot expose an HTTP endpoint, but it does listen on TCP port 8443. You need Consul to verify the port is accepting connections and mark the service unhealthy if it is not. Which health check definition should you use?

You want to perform a blocking query on a KV key to watch for updates. Which parameter must you provide in your request based on the last observed index?

You have a service that requires specific routing logic based on the environment. How can you distinguish between 'production' and 'staging' instances of the same service name using metadata?

A service team wants its check to be automatically deregistered along with the service when the service is deregistered, but they also want the check to survive a Consul agent restart without being manually recreated. Which configuration achieves both goals?

A platform team runs a fleet of Consul 1.15 server agents behind a strict network policy that blocks all outbound DNS traffic from the server hosts. The team wants the servers to periodically verify that each registered catalog node's DNS name resolves, without installing any extra binaries. Which check definition should they use, and what must they configure so the check can run?

A Consul 1.15 cluster spans three datacenters: dc1 (primary), dc2, and dc3. The operations team wants to enable cross-datacenter service discovery for a service named 'web' that is deployed in all datacenters. They configure a prepared query with a failover policy. Which statement accurately describes how the failover block in the prepared query affects query results when the local datacenter's 'web' service has no healthy instances?

You are troubleshooting a Consul Connect service mesh and need to verify which intentions are currently configured. Which Consul CLI command lists all intentions?

What is the primary role of the Consul Connect 'upstream' configuration?

You need to store a value in Consul KV that will be read by a service. The value should be retrievable by a simple HTTP GET request to the Consul API. Which HTTP endpoint should you use to read the value of a key named 'app/config/db_host'?

A DevOps engineer needs to register an external service that runs outside the Consul datacenter, such as a third-party API. The service has a static IP address and a known port. Which Consul feature should be used to make this service discoverable within Consul?

When using Consul KV for distributed locking, why is it recommended to use a session?

What is the primary difference between a 'script' check and an 'http' check in terms of how they are processed by the Consul agent?

An engineer is designing a service that must coordinate access to a shared resource using Consul KV sessions and needs to understand the guarantees the lock provides. Which TWO statements accurately describe how Consul's KV locking with sessions behaves? (Choose two.)

A security engineer is configuring intentions for a service mesh. They want to allow traffic from 'frontend' to 'backend' only when the connection is encrypted with mTLS and originates from a specific namespace in Consul Enterprise. Which intention attribute should they use to enforce the namespace constraint?

An operations team runs a legacy application that cannot expose an HTTP endpoint but does listen on TCP port 5432. They define a TCP health check in the service registration. During an incident, the port remains open but the application process is hung and no longer accepts new connections. What will Consul report for this check?

What is the correct way to specify a local bind port for an upstream service?

Which of the following are true regarding TTL checks? (Select TWO)

An operator registers a service with a TTL health check. The service is responsible for updating the check status via the HTTP API. The service fails to send updates for 90 seconds. The check is configured with 'DeregisterCriticalServiceAfter' set to 10 minutes. What is the current health status of the service, and what will happen after 10 minutes?

A platform team runs Consul 1.15 with Connect enabled in a single datacenter. They register a new service 'payments' with a sidecar proxy, but when the application team tries to reach 'payments' through its local proxy, the connection is refused. Running 'consul intention check web payments' returns 'Result: denied'. No intentions have been created yet. What should the team do to allow the traffic while following Consul's default security model?

Where can you define health checks in Consul? (Select THREE)

A financial services firm requires that all service-to-service traffic inside its Consul 1.15 datacenter be encrypted and that services accept connections only when an explicit intention permits them. An operator enables Connect on all agents but services still accept plaintext traffic from non-mesh clients. Which additional step is required to enforce encryption and deny-by-default for the whole datacenter?

A platform team runs a Consul 1.15 datacenter with Connect enabled. They deploy a new service called 'payments' and register it with a sidecar proxy. Security policy requires that only the 'checkout' service may initiate connections to 'payments', and all other services must be denied, even if they present a valid service token. No intentions exist yet for this pair. Which action should the team take to enforce this requirement with the least operational overhead?

A Consul 1.15 operator is configuring a service mesh with Connect and needs to ensure that the sidecar proxy for 'frontend' can establish mTLS connections to the 'backend' service. The operator has already registered both services with Connect sidecars. Which two actions are required to allow this communication? (Choose two.)

A platform team operates two Consul datacenters, dc1 (primary) and dc2 (secondary), with ACLs enabled. They have configured token replication using a replication token in dc2. After rotating the replication token in dc1, they update the configuration in dc2 and restart the Consul agents. However, ACL replication stops working and dc2 logs show 'Permission denied'. What is the most likely cause?

A team is using the Consul KV store to store application configuration. They want to implement a watch that runs a script whenever the value of the key `config/app` changes. Which two of the following statements are true regarding Consul KV watches? (Choose two.)

If a KV operation returns a 403 Forbidden status, what is the most common cause?

A Consul 1.15 operator needs to register a service with a health check that verifies the service is accepting TCP connections on port 9200. The check must run every 10 seconds. Which check configuration should be used?

Which file format is used for Consul configuration?

You have a Consul 1.15 cluster with two datacenters, dc1 and dc2, federated via WAN gossip. You want to use a prepared query to automatically failover to a service in dc2 if the service in dc1 becomes unhealthy. Which configuration in the prepared query is required to achieve this?

How are intentions applied to services in different partitions or namespaces?

Which TWO of the following actions occur when a node fails in a Consul cluster?

Which TWO of the following are true about Consul datacenters?

An operator has two Consul datacenters, 'dc1' and 'dc2', federated via WAN gossip. They want to query the health of a service named 'web' in dc2 from a Consul agent in dc1 using the HTTP API. Which endpoint should they use?

A developer registers a service 'web-frontend' with Consul using the HTTP API. The service registration includes a health check with a TCP check on port 8080 and an interval of '15s'. After registration, the developer queries the service using the DNS interface: 'dig @127.0.0.1 -p 8600 web-frontend.service.consul'. The query returns no results. Which of the following is the most likely reason?

You are using Consul 1.15 with Connect enabled. A service 'web' needs to communicate with an upstream service 'api' in a different datacenter. You have configured a mesh gateway in each datacenter. The 'web' service's sidecar proxy is configured with an upstream for 'api'. However, traffic is failing. You check the sidecar proxy logs and see 'no healthy upstream'. What is the most likely cause?

You need to deny all traffic between 'service-a' and 'service-b' using intentions. What is the most efficient way to achieve this?

You have implemented a leader election mechanism using Consul KV sessions. The session has a TTL of 15 seconds. If the application crashes, how long will it take for the lock to be automatically released?

If a Consul agent is configured with 'disable_remote_exec = true', how does this affect the KV store?

You are deploying a Consul Connect service mesh in a single datacenter. A developer asks how service-to-service authorization is enforced when two services communicate through their sidecar proxies. What is the primary mechanism that controls whether the connection is allowed?

A team is standardizing health check definitions across a fleet of Consul 1.15 agents. They want checks that can be expressed entirely in HCL and do not require an external script interpreter on the node. Which two check types meet these criteria? (Choose two.)

You are deploying a service that requires distributed locking with automatic release if the service instance fails. You have created a session named 'lock-session' and acquired a lock on the KV key 'locks/db'. After a few minutes, the lock is unexpectedly released even though the service instance is still running. Which action should you take to diagnose the most likely cause?

Which of the following best describes the 'consul agent -dev' mode in relation to service discovery?

An operator writes a feature flag to `app/features/new-ui` using `consul kv put app/features/new-ui true`. Later, a health-check script reads that key and receives an error instead of the value. The operator confirms the key exists with `consul kv get app/features/new-ui`. Which command should the operator run to inspect the metadata that would reveal a problem such as a missing or expired session on the key?

When using 'prepared_queries' for cross-datacenter failover, what does the 'failover' block allow you to specify?

In a Consul health check, what does the 'notes' field provide?

Which THREE of the following are components of a Consul Connect service definition?

You notice that the KV store is not consistent across datacenters. What is the cause?

Which command line tool can you use to manually trigger a TTL check update for a specific service?

A platform team operates two Consul datacenters, 'dc1' and 'dc2', and wants operators in dc2 to resolve service names registered in dc1 without a full mesh of local agents. They have already used 'consul join -wan' to link the server agents. Which feature should they rely on for DNS lookups of remote services?

Which of the following is a valid method to update a TTL health check?

You need to retrieve the session information for a specific session ID. Which endpoint should you query?

When using multiple datacenters, what is the primary role of the 'consul-template' tool?

A service 'orders' must call an upstream database service through its sidecar proxy. The upstream is registered in the same Consul datacenter and the operator wants the sidecar to discover it dynamically rather than hard-code an address. Which upstream configuration entry in the sidecar_service stanza accomplishes this?

An operator registers a web service with Consul using the HTTP API. The registration includes a TTL health check with a 30-second interval, but the application code does not yet call the pass endpoint. Shortly after registration, the service disappears from healthy DNS results. What is the most likely reason?

A Consul cluster spans multiple datacenters. A service `user-auth` is registered in both `dc1` and `dc2`. A client in `dc1` queries the DNS interface for `user-auth.service.consul`. By default, which instances will be returned?

Which command is used to check the status of a registered service?

You are troubleshooting a health check that seems to be hanging. Which flag, if available, would provide more information about the check's execution within the agent logs?

Which THREE of the following are key components of a service definition?

What is the recommended number of Consul servers per datacenter to ensure high availability?

Which protocol do Consul servers use to maintain the WAN gossip pool?

What is the function of the 'consul connect envoy' command?

A service is registered with Consul using the HTTP API, but it is not appearing in DNS queries. The service definition includes a health check that is currently critical. What is the most likely reason for the DNS query failure?

When using the HTTP health check type, how can you verify that a specific header is included in the health check request?

An operator is configuring a Connect sidecar proxy in a service definition so that outbound calls to a dependency are routed through the mesh. The dependency is registered as 'redis' in the same datacenter, listening on port 6379. The application expects to reach it at localhost:6379. Which upstream block in the sidecar_service definition achieves this?

What is the effect of changing the 'interval' parameter in a service health check?

Which THREE of the following are benefits of using the Consul DNS interface?

An operator runs `consul kv put config/app/timeout 30s` and then `consul kv get config/app/timeout`. The second command prints only `30s` with no metadata. The operator wants to see the key's `CreateIndex`, `ModifyIndex`, and `Flags` from the command line without writing code against the HTTP API. Which command should be used?

When troubleshooting a service that fails to start its Envoy proxy, which service definition field should you check for incorrect configuration?

What components can affect the outcome of a health check? (Select THREE)

A developer registers a service named 'orders' on a Consul node and wants DNS queries for orders.service.consul to return the service's SRV records so clients can discover both the address and the port. The developer is verifying that the registration contains everything needed for SRV resolution. Which two registration elements must be present for SRV queries to return usable records? (Choose two.)

Which feature allows you to define a health check that depends on the health of another service?

You want to perform a list operation on a KV prefix to see all keys, but you don't want the values returned. Which API parameter helps reduce payload size?

Which Consul feature allows you to observe the KV store for changes and run a command in response?

What is the purpose of the 'check' field inside a 'service' object in a Consul configuration file?

You are deploying a new Consul datacenter and need to configure the servers to join the existing WAN gossip pool. Which configuration parameter should you set on the new servers to specify the addresses of the existing WAN servers?

What is the consequence of having a service with no health checks registered?

An operations engineer registers an external PostgreSQL service on a Consul 1.15 client agent. The database listens on 10.20.30.40:5432 and is not managed by Consul, but a co-located exporter on the same VM exposes readiness at http://127.0.0.1:9187/ready. The engineer wants Consul to gate the service on the exporter's readiness signal while still advertising the database's real address and port to consumers. Which registration best achieves this?

Which of the following conditions can cause a health check to transition to the 'critical' state? (Select TWO)

An operator registers a service with a TTL check and forgets to send periodic updates. After the TTL expires, what status does Consul report for that check, and what is the immediate effect on service discovery?

Which TWO of the following are common use cases for the Consul KV store?

A team runs Consul 1.15 with Connect. They want to observe which services are allowed to communicate with a specific service named 'inventory' and confirm whether a particular source is permitted, without sending real traffic. Which command should they use to query the effective intention decision for a source and destination?

What is the 'Consul Connect proxy' kind used for?

An operator registers a web service with an HTTP health check. The check is configured with http = "http://localhost:8080/health" and method = "GET". The service's health endpoint returns HTTP 500 when the application is running but has a database connection problem. What status will Consul report for this check?

A microservice uses a Consul session with a 30-second TTL and holds a lock on `locks/leader` via `acquire`. The service process is alive and healthy but its network link to the Consul servers is severed for several minutes. When connectivity is restored, the service finds it no longer owns the lock. Which behavior explains this outcome?

A Consul administrator is reviewing how check results propagate and wants to understand which factors determine whether a service instance is considered healthy in the catalog. Which two factors directly determine a service's aggregate health status in Consul? (Choose two.)

Which TWO of the following accurately describe Consul's WAN gossip protocol behavior?

You are designing a configuration system where multiple instances of a service must coordinate to elect a single leader using Consul KV. Which two statements accurately describe how to implement leader election with sessions? (Choose two.)

You are deploying a legacy application that does not support HTTP or TCP health checks. Which Consul health check type should you configure to allow the application to signal its own health via a heartbeat API call?

An operator is troubleshooting a Consul datacenter that was recently federated with another datacenter. They notice that cross-datacenter service discovery works, but ACL tokens created in the primary datacenter are not being recognized in the secondary datacenter. What is the most likely cause?

A Consul operator is troubleshooting a service that intermittently disappears from the catalog. The service is registered with a TTL health check that is updated every 30 seconds by a script. The operator notices that the service is marked as critical and then deregistered. Which configuration change should the operator make to prevent the service from being deregistered?

A Consul cluster has a service registered with an HTTP health check pointing to https://10.0.0.5:8443/health. The check is failing with a TLS certificate verification error even though the service is healthy. The operator wants Consul to skip certificate verification for this specific check without disabling TLS globally. Which check configuration field should be set?