39 questions · Service Mesh With Consul Connect · All types, answers revealed
Which THREE items are required to configure an upstream service?
Required to identify the dependency.
Why this answer
Upstreams require a destination service name, a local bind port, and the destination datacenter (if external).
Which TWO of the following are benefits of using Consul Connect?
Intentions provide this.
Why this answer
Consul Connect simplifies mTLS management and provides secure service-to-service authorization.
Which command displays all active intentions in the Consul mesh?
This command lists all configured intentions.
Why this answer
The 'consul intention list' command provides the current list of intentions.
Which THREE tasks are performed by the Consul agent for Connect?
The agent starts/stops the proxy.
Why this answer
The agent manages proxy lifecycle, certificate retrieval, and service discovery for the mesh.
Which TWO are common use cases for Consul Connect?
Connect enables zero-trust.
Why this answer
Consul Connect is commonly used for secure service communication and service discovery in complex environments.
You are troubleshooting a connection error where the sidecar proxy cannot reach the upstream service. Which log file provides the most detail regarding Envoy's connectivity issues?
Envoy access logs specifically detail proxy-level connectivity.
Why this answer
The sidecar proxy logs, typically routed to stdout or a specific file via the proxy configuration, contain Envoy access logs.
What is the function of the 'consul intention check' command?
This command tests the current intention configuration.
Why this answer
It tests if a connection between two services is allowed by existing intentions.
Which service definition field is used to link a sidecar proxy to its parent service?
This field links the proxy to the service it proxies.
Why this answer
The 'proxy' block inside the 'service' definition contains the 'destination_service_name' to link it.
What does the 'kind' field in a service definition specify for a Consul Connect service?
Setting kind to 'connect-proxy' tells Consul this is a sidecar.
Why this answer
The 'kind' field defines if the service is a standard service or a proxy/mesh-gateway.
Which TWO of the following are features of Consul Connect native integration?
Native apps skip the sidecar for mTLS.
Why this answer
Native integration allows apps to manage their own certificates and interact directly with the Consul secret API.
Which THREE factors influence the mTLS handshake in a Consul Connect mesh?
Required for authentication.
Why this answer
The CA, the identity certificate, and the trust bundle are all essential to the mTLS handshake.
Which of the following is a key feature of Consul Connect's intentions?
Intentions are specifically for access control.
Why this answer
Intentions provide a logical authorization layer for service-to-service communication.
What is the primary benefit of using a Mesh Gateway in a Consul Connect architecture?
This is the core purpose of the mesh gateway.
Why this answer
Mesh gateways provide a single point of ingress/egress for cross-datacenter traffic, reducing the need for direct cross-DC networking.
Which THREE settings are part of the 'proxy' configuration block?
Defines proxy-level upstream routing.
Why this answer
Proxy config includes local bind ports, configuration for Envoy, and upstream definitions.
You need to perform a canary deployment for a service. What Consul feature should you use?
The service resolver allows traffic splitting/canary configurations.
Why this answer
Consul's service resolver and router resources allow for traffic splitting between different service subsets.
Which TWO of the following are valid ways to configure Consul Connect?
Common method for registration.
Why this answer
Consul Connect can be configured via service definition files or the HTTP API.
When configuring mTLS in Consul Connect, how are certificates distributed to the sidecar proxies?
This is the secure and standard way certificates are delivered.
Why this answer
The Consul agent, acting as the client to the Consul server, fetches the certificates and provides them to the proxy via the xDS API.
You have a service that needs to talk to a service in a different datacenter. What configuration is required?
Mesh gateways act as the entry/exit points for cross-DC traffic.
Why this answer
Mesh gateways are required to route cross-datacenter traffic in a Consul Connect mesh.
If you are using SPIRE for certificate management, how does this interact with Consul Connect?
Consul supports plugging in external CAs via the CA provider configuration.
Why this answer
SPIRE can act as the CA (Certificate Authority) for Consul, issuing identities to services within the mesh.
Which TWO of the following are valid ways to monitor Consul Connect performance?
Standard way to see proxy metrics.
Why this answer
Consul exposes metrics via Prometheus and Envoy provides stats through its own API.
A service 'api' is configured with mTLS. You want to rotate the CA root certificate without interrupting existing connections. What is the recommended strategy?
Adding to additional_roots allows for a transition period where both CAs are trusted.
Why this answer
Consul supports a 'prepared_ca' rotation where the new CA is added to the trust bundle before the old one is removed.
Which component acts as the default sidecar proxy for Consul Connect?
Envoy is the primary supported proxy for Consul Connect.
Why this answer
Envoy is the default and recommended sidecar proxy for Consul Connect.
What is the purpose of the 'upstreams' block in a service definition?
Upstreams are the outbound dependencies.
Why this answer
It defines the targets that the sidecar proxy should be allowed to proxy requests to.
When using 'Consul Connect native' integration, how does the application handle mTLS?
Native apps use the Consul secret API to get their identity.
Why this answer
In native integration, the application uses the Consul API to retrieve certificates and handles the mTLS handshake itself.
What is the primary role of the Consul Connect 'upstream' configuration?
Upstreams define what a service depends on.
Why this answer
Upstreams define the dependencies of a service, allowing the proxy to route to specific services.
What is the correct way to specify a local bind port for an upstream service?
This is the correct syntax for an upstream definition.
Why this answer
Inside the upstream block, the 'local_bind_port' key sets the port the proxy listens on.
How do you enable mTLS globally in a Consul datacenter?
This is the standard agent-level configuration for Connect.
Why this answer
mTLS is enabled by default in modern Consul versions, but can be configured in the agent config via 'connect.enable_connect'.
How are intentions applied to services in different partitions or namespaces?
Namespaces require explicit scoping in intentions.
Why this answer
Intentions are scoped to the namespace, and cross-namespace intentions require the namespace name.
You need to deny all traffic between 'service-a' and 'service-b' using intentions. What is the most efficient way to achieve this?
This command directly creates a deny-type intention.
Why this answer
Intentions can be set to 'deny' explicitly, which overrides any 'allow' rules.
Which THREE of the following are components of a Consul Connect service definition?
The proxy block defines sidecar settings.
Why this answer
Connect services typically use 'proxy', 'upstreams', and 'connect' blocks to define their behavior in the mesh.
Which protocol is used for the control plane communication between the Consul agent and the sidecar proxy?
Consul uses the gRPC-based xDS API to push configuration to Envoy.
Why this answer
The Consul agent communicates with the sidecar proxy (Envoy) using the Envoy xDS API.
What is the function of the 'consul connect envoy' command?
This command runs the Envoy process with the correct Consul configuration.
Why this answer
This command bootstraps and manages the lifecycle of the Envoy sidecar process.
When troubleshooting a service that fails to start its Envoy proxy, which service definition field should you check for incorrect configuration?
Errors here directly impact proxy startup.
Why this answer
The 'proxy' configuration block is where all Envoy-specific settings, including ports and upstreams, are defined.
Which TWO of the following are true regarding intentions?
This is their core purpose.
Why this answer
Intentions are managed via API/CLI and define allowed communication patterns between services.
Which THREE of the following are supported as sidecar proxy types in Consul?
Supported as an alternative proxy.
Why this answer
Consul natively supports Envoy, and has legacy or plugin support for others like HAProxy.
What happens if a service proxy loses its connection to the local Consul agent?
Envoy retains the last received xDS configuration.
Why this answer
The proxy will be unable to receive configuration updates and health status, potentially leading to service disruption.
Which CLI command would you use to check the status of a Connect-enabled service?
This displays the health of the service and its sidecars.
Why this answer
The 'consul catalog services' or 'consul health service' command shows the status, including Connect capabilities.
What is the 'Consul Connect proxy' kind used for?
This 'kind' identifies the resource as a proxy.
Why this answer
It defines a service that is explicitly a sidecar proxy.
You are configuring a sidecar proxy for a service named 'web'. Which configuration stanza in the service definition correctly defines the proxy's inbound port for Connect traffic?
The local_bind_port correctly specifies where the proxy listens for local traffic.
Why this answer
The 'proxy' configuration block within the service definition allows for the 'local_bind_port' and 'config' keys to define proxy behavior.
Ready to test yourself?
Try a timed practice session using only Service Mesh With Consul Connect questions.