Service Mesh With Consul Connect practice questions

Explicit Deny.

Why wrong: Standard configurations often default to allow unless configured otherwise.

The request is buffered.

Why wrong: Requests are not buffered by default.

The connection is rejected by the agent.

Why wrong: The agent does not reject connections without policy enforcement.

The service version.

Why wrong: Version is handled by 'meta' tags.

The datacenter location.

Why wrong: Datacenter is a separate field.

The language of the application.

Why wrong: Consul does not track application language in 'kind'.

Nginx

Why wrong: Nginx is not the native Consul sidecar.

HAProxy

Why wrong: HAProxy is supported but not the default.

Linkerd

Why wrong: Linkerd is a competing service mesh.

mTLS is disabled by default for native apps.

Why wrong: mTLS remains a core feature of Connect.

The sidecar proxy handles all mTLS.

Why wrong: Native integration bypasses the proxy for mTLS.

The Consul agent performs the TLS handshake on behalf of the app.

Why wrong: The app performs the handshake directly.

Direct VPC peering.

Why wrong: Consul Connect uses mesh gateways, not just VPC peering.

An external service definition.

Why wrong: External services are for non-mesh services.

A global intention.

Why wrong: Intentions control authorization, not routing.

Disable mTLS globally, update, and re-enable.

Why wrong: Disabling mTLS is a security risk and unnecessary.

Delete the existing CA and restart all agents.

Why wrong: This would cause immediate mTLS failures.

Use the 'consul tls ca create' command with the --rotate flag.

Why wrong: This command does not exist in the CLI.

consul intention create -allow-none service-a service-b

Why wrong: The -allow-none flag does not exist.

consul intention set -action=drop service-a service-b

Why wrong: The action must be 'deny' or 'allow'.

consul intention delete service-a service-b

Why wrong: Deleting an intention might revert to a default 'allow' policy.

System syslog

Why wrong: Syslog is too generic.

Consul server audit log

Why wrong: Audit logs track administrative actions.

Consul agent log

Why wrong: The agent log focuses on the service registry, not the data plane proxy traffic.

sidecar { port = 8080 }

Why wrong: There is no top-level sidecar block for port definitions.

config { inbound_port = 8080 }

Why wrong: Inbound port is not a valid key inside the proxy config block.

service { connect { port = 8080 } }

Why wrong: The connect block does not contain a port sub-key directly.

consul connect intentions

Why wrong: This is not the correct command structure.

consul kv get intentions

Why wrong: Intentions are not stored directly in the KV store in this way.

consul services intentions

Why wrong: This command does not exist.

To set intention priority.

Why wrong: Intention priority is handled in the intention definition.

To register external services.

Why wrong: External services use a different definition format.

To define health check ports.

Why wrong: Health checks are defined in the service block.

To generate TLS certificates for Envoy.

Why wrong: Consul handles certificate generation automatically.

To verify the Envoy binary installation.

Why wrong: That is not the primary function.

To update the Envoy configuration via CLI.

Why wrong: Configuration is handled by the agent, not this command.

Intentions only work within the 'default' namespace.

Why wrong: Intentions support multiple namespaces.

Intentions are always global.

Why wrong: They can be scoped.

They must be created via API only.

Why wrong: CLI supports namespaces as well.

Consul RPC

Why wrong: Consul RPC is internal to Consul, not used for proxy config.

REST

Why wrong: REST is not the primary mechanism for xDS.

HTTP/1.1

Why wrong: xDS is gRPC-based.

Only static certificates can be used.

Why wrong: Consul supports dynamic certificate rotation with external CAs.

Consul must be disabled.

Why wrong: Consul is fully compatible with external CAs.

SPIRE replaces the Consul agent.

Why wrong: SPIRE does not replace the agent.

parent_service

Why wrong: This is not a valid field.

service_id

Why wrong: Service ID is the identifier of the service, not a link.

linked_service

Why wrong: Incorrect field name.

The proxy shuts down automatically.

Why wrong: It may continue to run but will stop receiving updates.

The proxy automatically switches to a local health-check mode.

Why wrong: There is no such mode.

The proxy attempts to connect to a random Consul server.

Why wrong: It only connects to the configured agent.

consul status

Why wrong: Too generic.

consul connect status

Why wrong: This command does not exist.

consul proxy check

Why wrong: Incorrect command.

It encrypts traffic at the storage layer.

Why wrong: Consul Connect handles transport layer security.

It improves local mTLS performance.

Why wrong: Performance is local to the service.

It provides load balancing for local services.

Why wrong: Local load balancing is handled by the sidecar.

To set the service's health check interval.

Why wrong: Health checks are in the checks block.

To limit the total number of connections.

Why wrong: Connection limits are done via configuration parameters, not upstreams.

To define the ingress rules.

Why wrong: Ingress is defined by the proxy configuration.