Question 1

Which of the following are benefits of using Consul for service discovery? (select 3)

Options :

A :

simplified communication between microservices

B : reduction or elimination of load balancers for east/west traffic

C : single point of contact for a service where the underlying containers may be dynamic or frequently change

D : scheduling of services and containers for application redundancy

Answer: A,B,C

Question 2

Given the following ACL policy, what actions below would be permitted by a token assigned to this policy? (select three)

1. service "app1" {

2. policy = "write"

3. }

4.

5. service_prefix "" {

6. policy = "read"

7. }

8.

9. node_prefix "" {

10. policy = "read"

11. }

Options :

A :

query any service registered to Consul to list the active clients for the service

B : run the consul members command to view server and client nodes in the cluster

C :

create a new Consul service call app1

D : register any service on Consul

Answer: A,B,C

Question 3

What are two ways that a client or service can programmatically discover healthy nodes for a service registered in a local Consul cluster? (select two)

Options :

A : DNS

B : User Interface (UI)

C : HTTP API

D : federation

Answer: A,C

Question 4

You need to determine the leader node for the Consul cluster. What command allows you to quickly identify the nodes and their current roles within the cluster?

Example of the command's output:

1. Node ID Address State Voter RaftProtocol

2. CONSUL-NODE-A 121abb4c-16fb-c8ec-2e2b-9595925de4dc 10.0.10.238:8300 follower true 3

3. CONSUL-NODE-C 4bead426-4471-0924-598f-cd6ce0015ebc 10.0.10.48:8300 follower true 3

4. CONSUL-NODE-E c44e8ab1-1132-1b22-9501-479c690c9e1b 10.0.10.105:8300 leader true 3

5. CONSUL-NODE-D ba86541f-cd93-6ada-b763-709b0fc6c09f 10.0.11.163:8300 follower true 3

6. CONSUL-NODE-B 2528cba1-06ea-4837-fc7b-13e44af19b0d 10.0.11.141:8300 follower true 3

Options :

A : consul nodes -leader

B : consul members

C :

consul raft- list

D :

consul operator raft list-peers

Answer: D

Question 5

You have a Consul cluster running production workloads in your environment. However, you've discovered that the cluster was initially deployed without gossip

encryption configured, which means that traffic is being sent in cleartext. The security team has requested this to be updated ASAP. However, you can't take an outage on

the Consul service right now, knowing the server nodes will stop communicating once you start editing the configuration files one by one.

How can you enable gossip encryption on the existing cluster without affecting the services it is currently providing the business?

Options :

A :

Generate the new encryption key using consul keygen. Update all the Consul server agent configuration files with the new encryption key. Using a scheduling tool,

execute the consul reload command for all nodes at the same time. This will ensure that there is minimal downtime for the Consul service.

B :

Generate the new encryption key using consul keygen. Update each Consul agent configuration file with the new configuration and set additional parameters to

verify incoming and outgoing encryption to false. Use rolling updates to walk through the steps of ultimately setting the parameters to true.

C :

Generate the new encryption key using consul keygen. Use the command consul keyring -install <key> and push the new encryption key out to all participating

nodes in the cluster. Finally, use the command consul keyring -use <key> to instruct Consul to use the key for encryption

D :

Generate the new encryption key using consul keygen. Update the Consul server agent configuration files with the new encryption key and issue a kill -HUP

<process ID> command so the Consul service reloads and picks up the new gossip configuration. Update and restart as a rolling update across the cluster so only a

single node is offline at a time.

Answer: B

Higher Test Marks with Free Online HCCAO-003 Exam Practice

Buying Options: