Service Mesh With Consul Connect

A developer is deploying a new service called 'inventory' with a Connect sidecar proxy. They want to verify that the sidecar is running and registered correctly. Which command should they use to check the status of the Connect-enabled service?

An operator manages a Consul 1.15 cluster where Connect is enabled and mTLS is active. They need to rotate the Connect CA root certificate for the datacenter. The new root must be distributed to all sidecar proxies without dropping existing connections, and the old root must remain trusted during the transition. Which sequence of actions accomplishes this?

You are configuring a Consul Connect service mesh and need to enable mTLS for all services in the datacenter. Which configuration setting must be enabled in the Consul server agent configuration to turn on Connect and enforce mTLS globally?

Which TWO of the following are benefits of using Consul Connect?

Which command displays all active intentions in the Consul mesh?

Which TWO are common use cases for Consul Connect?

What is the function of the 'consul intention check' command?

A platform team runs Consul 1.15 with Connect enabled. Their service 'api' is registered with a sidecar proxy, and its upstream 'database' is also mesh-enabled. The team wants 'api' to resolve 'database' through the mesh without hard-coding an IP address in the application. Which configuration in the service registration enables the sidecar to expose a stable local listener for the upstream?

A security team requires that a service 'reporting' only accept connections from services presenting a valid mesh certificate issued by the Connect CA, and that all other traffic be rejected. They have registered reporting with a sidecar proxy. Which combination ensures this behavior?

A service 'inventory' is registered in Consul 1.15 with Connect enabled. You need to verify that the sidecar proxy for 'inventory' is running and healthy. Which command should you use?

You are operating a Consul 1.15 cluster with Connect enabled. A service named 'api' is registered with a sidecar proxy. You need to ensure that only the 'web' service can initiate connections to 'api'. You have created an intention that allows 'web' to connect to 'api', but you have not created any other intentions. What is the default behavior for other services trying to connect to 'api'?

What does the 'kind' field in a service definition specify for a Consul Connect service?

Which TWO of the following are features of Consul Connect native integration?

Which THREE factors influence the mTLS handshake in a Consul Connect mesh?

A developer needs to see which intentions currently govern traffic between services in a Consul 1.15 datacenter. Which command lists all intentions stored in the catalog?

Which of the following is a key feature of Consul Connect's intentions?

You are configuring Consul Connect for a service named 'payments'. You want to allow incoming connections only from services that present a valid client certificate from a specific CA and also enforce that the source service is 'checkout'. What combination of Consul features should you use?

What is the primary benefit of using a Mesh Gateway in a Consul Connect architecture?

A developer registers a service called 'web' with a sidecar proxy in a Consul 1.15 datacenter. The service needs to call a backend service named 'api' through the mesh. The developer adds an upstream block to the 'web' service definition pointing to 'api' on port 8080. What does this upstream configuration accomplish for the 'web' sidecar proxy?

A developer notices that the application process in a Connect-enabled pod connects to 127.0.0.1:8080 to reach an upstream, but the sidecar proxy's actual listener was assigned a different port. The application is failing to reach the upstream. Which action should the developer take to provide a predictable local address for the upstream?

You need to perform a canary deployment for a service. What Consul feature should you use?

Which TWO of the following are valid ways to configure Consul Connect?

A platform team is running Consul Connect with Envoy sidecar proxies. They need to ensure that a service named 'payments' can only be accessed by services in the 'frontend' namespace, and all other access must be denied. They have Consul Enterprise with namespaces enabled. Which intention configuration achieves this requirement with the least administrative overhead?

A platform team is deploying a new service 'payments' on a Consul 1.15 cluster with Connect enabled. They want to ensure that only the 'checkout' service can initiate connections to 'payments', and all other services are denied by default. Which intention should they create?

A team is running Consul 1.15 with Connect and wants to expose a TCP service through an ingress gateway so external clients can reach it over mTLS. They define the gateway and a listener on port 8443. External clients report TLS handshake failures. The gateway logs show no matching certificate. Which configuration element must be present for the listener to serve TLS?

When configuring mTLS in Consul Connect, how are certificates distributed to the sidecar proxies?

You have a service that needs to talk to a service in a different datacenter. What configuration is required?

If you are using SPIRE for certificate management, how does this interact with Consul Connect?

You are deploying a new service 'api' in a Consul Connect mesh. You want to ensure that all incoming connections to 'api' are logged for auditing purposes. Which Consul feature should you configure?

Which TWO of the following are valid ways to monitor Consul Connect performance?

Which component acts as the default sidecar proxy for Consul Connect?

What is the purpose of the 'upstreams' block in a service definition?

You are deploying a Consul Connect service mesh in a Consul 1.15 datacenter. You want to ensure that all service-to-service traffic is encrypted and authenticated. What is the default behavior for intentions when no intention is defined between two services?

A service mesh operator is troubleshooting a connectivity issue between two services in a Consul 1.15 datacenter. The sidecar proxy for the 'frontend' service cannot reach the 'backend' upstream. The operator has confirmed that intentions allow the traffic. Which log should they inspect first to diagnose the issue on the sidecar proxy?

When using 'Consul Connect native' integration, how does the application handle mTLS?

You are using Consul 1.15 with Connect and want to enable Layer 7 traffic management for a service 'api' to perform HTTP path-based routing. Which configuration is required in the service definition?

You are troubleshooting a Consul Connect service mesh and need to verify which intentions are currently configured. Which Consul CLI command lists all intentions?

What is the primary role of the Consul Connect 'upstream' configuration?

A security engineer is configuring intentions for a service mesh. They want to allow traffic from 'frontend' to 'backend' only when the connection is encrypted with mTLS and originates from a specific namespace in Consul Enterprise. Which intention attribute should they use to enforce the namespace constraint?

What is the correct way to specify a local bind port for an upstream service?

A platform team runs Consul 1.15 with Connect enabled in a single datacenter. They register a new service 'payments' with a sidecar proxy, but when the application team tries to reach 'payments' through its local proxy, the connection is refused. Running 'consul intention check web payments' returns 'Result: denied'. No intentions have been created yet. What should the team do to allow the traffic while following Consul's default security model?

A financial services firm requires that all service-to-service traffic inside its Consul 1.15 datacenter be encrypted and that services accept connections only when an explicit intention permits them. An operator enables Connect on all agents but services still accept plaintext traffic from non-mesh clients. Which additional step is required to enforce encryption and deny-by-default for the whole datacenter?

A platform team runs a Consul 1.15 datacenter with Connect enabled. They deploy a new service called 'payments' and register it with a sidecar proxy. Security policy requires that only the 'checkout' service may initiate connections to 'payments', and all other services must be denied, even if they present a valid service token. No intentions exist yet for this pair. Which action should the team take to enforce this requirement with the least operational overhead?

A Consul 1.15 operator is configuring a service mesh with Connect and needs to ensure that the sidecar proxy for 'frontend' can establish mTLS connections to the 'backend' service. The operator has already registered both services with Connect sidecars. Which two actions are required to allow this communication? (Choose two.)

How are intentions applied to services in different partitions or namespaces?

You are using Consul 1.15 with Connect enabled. A service 'web' needs to communicate with an upstream service 'api' in a different datacenter. You have configured a mesh gateway in each datacenter. The 'web' service's sidecar proxy is configured with an upstream for 'api'. However, traffic is failing. You check the sidecar proxy logs and see 'no healthy upstream'. What is the most likely cause?

You need to deny all traffic between 'service-a' and 'service-b' using intentions. What is the most efficient way to achieve this?

You are deploying a Consul Connect service mesh in a single datacenter. A developer asks how service-to-service authorization is enforced when two services communicate through their sidecar proxies. What is the primary mechanism that controls whether the connection is allowed?

Which THREE of the following are components of a Consul Connect service definition?

A service 'orders' must call an upstream database service through its sidecar proxy. The upstream is registered in the same Consul datacenter and the operator wants the sidecar to discover it dynamically rather than hard-code an address. Which upstream configuration entry in the sidecar_service stanza accomplishes this?

What is the function of the 'consul connect envoy' command?

An operator is configuring a Connect sidecar proxy in a service definition so that outbound calls to a dependency are routed through the mesh. The dependency is registered as 'redis' in the same datacenter, listening on port 6379. The application expects to reach it at localhost:6379. Which upstream block in the sidecar_service definition achieves this?

When troubleshooting a service that fails to start its Envoy proxy, which service definition field should you check for incorrect configuration?

A team runs Consul 1.15 with Connect. They want to observe which services are allowed to communicate with a specific service named 'inventory' and confirm whether a particular source is permitted, without sending real traffic. Which command should they use to query the effective intention decision for a source and destination?

What is the 'Consul Connect proxy' kind used for?