Service Mesh With Consul Connect practice questions

Disable mTLS globally, update, and re-enable.

Why it fails: Disabling mTLS is a security risk and unnecessary.

Delete the existing CA and restart all agents.

Why it fails: This would cause immediate mTLS failures.

Use the 'consul tls ca create' command with the --rotate flag.

Why it fails: This command does not exist in the CLI.

System syslog

Why it fails: Syslog is too generic.

Consul server audit log

Why it fails: Audit logs track administrative actions.

Consul agent log

Why it fails: The agent log focuses on the service registry, not the data plane proxy traffic.

sidecar { port = 8080 }

Why it fails: There is no top-level sidecar block for port definitions.

config { inbound_port = 8080 }

Why it fails: Inbound port is not a valid key inside the proxy config block.

service { connect { port = 8080 } }

Why it fails: The connect block does not contain a port sub-key directly.

Explicit Deny.

Why it fails: Standard configurations often default to allow unless configured otherwise.

The request is buffered.

Why it fails: Requests are not buffered by default.

The connection is rejected by the agent.

Why it fails: The agent does not reject connections without policy enforcement.

Consul RPC

Why it fails: Consul RPC is internal to Consul, not used for proxy config.

REST

Why it fails: REST is not the primary mechanism for xDS.

HTTP/1.1

Why it fails: xDS is gRPC-based.

parent_service

Why it fails: This is not a valid field.

service_id

Why it fails: Service ID is the identifier of the service, not a link.

linked_service

Why it fails: Incorrect field name.

The proxy shuts down automatically.

Why it fails: It may continue to run but will stop receiving updates.

The proxy automatically switches to a local health-check mode.

Why it fails: There is no such mode.

The proxy attempts to connect to a random Consul server.

Why it fails: It only connects to the configured agent.

consul status

Why it fails: Too generic.

consul connect status

Why it fails: This command does not exist.

consul proxy check

Why it fails: Incorrect command.

Run 'consul tls enable'.

Why it fails: This command does not exist.

consul config write -enable-mtls

Why it fails: This command does not exist.

There is no global enable setting.

Why it fails: It is configurable.

They are automatically synced to all datacenters.

Why it fails: Intentions are not global by default.

They operate at the transport layer.

Why it fails: They are enforced via Envoy at the application layer/proxy.

They require a separate database.

Why it fails: They use the Consul state store.

Caddy

Why it fails: Not a standard Consul sidecar.

Traefik

Why it fails: Not a standard Consul sidecar.

Writing configuration to the disk.

Why it fails: Configuration is managed in-memory.

Issuing certificates.

Why it fails: The server issues certificates.

Hardcoded IP address.

Why it fails: Consul uses service discovery, not IPs.

Service description.

Why it fails: Not a technical requirement.

acl_token

Why it fails: Defined in the agent config.

service_name

Why it fails: Defined in the service block.

Create an intention from 'web' to 'api' with action 'allow' and set a source namespace of 'default'.

Why it fails: Setting only a source namespace does not restrict traffic by certificate authority. Namespaces are used for multi-tenancy and do not verify the CA that signed a client certificate. This intention would allow any instance of 'web' in the default namespace to reach 'api', regardless of its certificate chain, so it fails the scenario requirement.

Create an intention from 'web' to 'api' with action 'allow' and specify a source partition.

Why it fails: Source partitions control administrative boundaries in Consul Enterprise, not certificate trust. They do not inspect the client certificate's issuing CA. Using a partition would still permit any 'web' instance in that partition to connect to 'api', which does not meet the requirement of restricting access based on the signing intermediate CA.

Create an intention from 'web' to 'api' with action 'allow' and set the 'SourceType' to 'consul' with a 'SourceName' of the intermediate CA.

Why it fails: The intention source type 'consul' refers to a Consul service name, not a CA. There is no SourceType that accepts an intermediate CA as the source identity. This configuration would be invalid or misinterpreted, and would not enforce certificate-based restrictions, so it cannot satisfy the requirement.

The 'backend' service is not registered with a Connect-enabled service definition.

Why it fails: If 'backend' is not registered with Connect, the sidecar proxy for 'frontend' would not be able to discover or connect to it via the mesh. However, if 'frontend' is using its proxy, the connection attempt would fail rather than become unencrypted. Unencrypted traffic implies the proxy is being bypassed entirely.

The CA root certificate has expired, causing mTLS to fall back to plaintext.

Why it fails: If the CA root certificate expires, mTLS connections would fail, not fall back to plaintext. Consul does not automatically downgrade to unencrypted traffic. The service would experience connection errors until certificates are renewed. This is not a valid cause for unencrypted traffic.

The intention between 'frontend' and 'backend' is set to 'allow', which disables encryption.

Why it fails: Intentions control authorization, not encryption. An 'allow' intention permits the connection but does not disable mTLS. Encryption is handled by the sidecar proxies regardless of the intention action. The presence of an allow intention would not cause traffic to be unencrypted.

Configure a mesh gateway in each datacenter and set the 'connect' block for both services to use the mesh gateway mode 'local'.

Why it fails: Mesh gateways are required for cross-datacenter traffic, but setting the 'connect' block's mesh gateway mode to 'local' is not sufficient. The mesh gateway mode must be set to 'remote' or 'local' depending on the direction, and the service definitions need to include the mesh gateway configuration. Simply setting mode 'local' on both services does not ensure traffic is routed through the mesh gateway correctly. Other options are more directly required.

Define an intention in dc2 with source 'payments' and destination 'ledger', and set the action to allow.

Why it fails: Intentions must be defined in the source datacenter, which is dc1 in this case. Placing the intention in dc2 would not authorize the traffic because Consul evaluates intentions in the datacenter where the source service resides. The destination datacenter does not enforce intentions for incoming connections from other datacenters. Therefore, this option is incorrect and would not allow the desired communication.

Create a service-resolver configuration that maps 'ledger' to a specific subset in dc2 and set the default subset to 'v1'.

Why it fails: Service-resolver configurations are used for traffic splitting and failover within a datacenter, not for enabling cross-datacenter connectivity. While they can define subsets and default subsets, they do not authorize traffic or establish the necessary mesh gateway routing. The scenario requires authorization and federation, not traffic splitting. This option is a distractor because it addresses a different feature of Connect.

Configure the service's upstreams to use 'mesh_gateway' mode to force mTLS.

Why it fails: Upstreams define outbound connections from a service to its dependencies. Setting a mesh gateway mode affects how traffic is routed across datacenters, but it does not enforce mTLS for inbound connections to the service. mTLS is automatically enabled when the service is part of the mesh via a sidecar proxy.

Create a service intention that explicitly allows traffic from all sources, which automatically enables mTLS.

Why it fails: Intentions control authorization (which services may connect to which), but they do not enable mTLS. mTLS is a property of the sidecar proxy and is enabled when the service is registered with Connect. An allow-all intention would permit traffic but would not by itself turn on encryption.

Set 'verify_incoming = true' in the Consul agent configuration on the node where the service runs.

Why it fails: 'verify_incoming' is an agent-level setting that controls whether the Consul agent verifies incoming TLS connections for its own RPC and HTTP APIs, not for service mesh traffic. It does not enable mTLS for service-to-service communication. Therefore, this does not satisfy the requirement.

Create a service-resolver configuration that maps 'frontend' to 'backend' and set the default subset to allow.

Why it fails: Service-resolver is a traffic-management configuration that splits traffic among subsets; it does not grant or deny authorization. Using it here would not change the default-deny behavior for cross-namespace calls and would leave legitimate frontend traffic blocked while providing no security control.

Create an intention with source 'frontend/*' and destination 'default/backend', action allow.

Why it fails: Intentions support namespace-qualified names, but the source must be a service name or wildcard, not a namespace wildcard followed by a service. 'frontend/*' is not a valid source format; namespaces are expressed with the Namespace field or as part of a fully qualified name such as 'frontend/service'.

Enable the built-in 'allow-namespace' ACL policy on the default namespace and attach it to the frontend token.

Why it fails: ACLs govern Consul API and catalog operations, not service-to-service data-plane authorization. There is no 'allow-namespace' ACL policy that opens Connect traffic; attaching such a policy would not affect intentions, so the intended cross-namespace path would still be denied.

Enable 'auto_encrypt' on all client agents and set 'verify_outgoing = true'.

Why it fails: Auto-encrypt automates TLS certificate distribution for Consul's internal RPC and gossip encryption between agents; it does not provision service mesh sidecars or enforce mTLS for service-to-service traffic. Verify_outgoing only affects agent-to-server communication. Services would still communicate in plain text unless each service definition includes a connect block, so this approach fails the requirement.

Create a global intention with action 'allow' for every service pair.

Why it fails: Intentions control authorization between services after mTLS is established; they do not enable mTLS or inject sidecars. A global allow intention would merely permit traffic that already arrives over Connect, and non-Connect services would remain plain-text. The team would still need to register each service with a connect block, so this does not meet the requirement.

Set 'connect.enabled = true' in the agent configuration on every client agent.

Why it fails: Setting connect.enabled on client agents starts the built-in Connect CA and permits sidecar registration, but it does not change service definitions. Services without a connect block still register as non-Connect services and expose plain-text ports, so mTLS is not enforced for them. The team would need to modify each service registration individually, which is exactly what they are trying to avoid.