CA-003 sample questions

Question 1

Which of the following scenarios best illustrates the 'Zero Trust' security pillar implemented by Consul Service Mesh?

Accepted Answer

All network traffic is denied by default; 'Web' can only communicate with 'Database' if an explicit Intention allows it, utilizing mutual TLS for identity verification.

Answer

Traffic is encrypted via TLS, but any service with a valid certificate can communicate with any other service.

Answer

Traffic between the 'Web' and 'Database' services is allowed because they reside in the same VPC subnet.

Answer

External clients are authenticated via an API Gateway before entering the datacenter.

Question 2

A solutions architect is explaining the benefits of Consul's service discovery to a client. The client asks how Consul handles dynamic infrastructure where IP addresses change frequently. Which explanation accurately describes Consul's mechanism?

Accepted Answer

Consul provides a real-time DNS interface where applications query a service name (e.g., db.service.consul) and receive the currently healthy IP addresses.

Answer

Consul updates a static hosts file on every node whenever a service changes.

Answer

Consul uses a gossip protocol to broadcast IP changes directly to the application layer code.

Answer

Consul requires a centralized load balancer to manually update backend pools.

Question 3

In a Consul-based service mesh, which component is responsible for handling 'North-South' traffic entering the mesh from external clients?

Accepted Answer

API Gateway

Answer

Terminating Gateway

Answer

Sidecar Proxy

Answer

Mesh Gateway

Question 4

Regarding the service networking pillar of 'Health Monitoring', how does Consul differ from a traditional centralized load balancer health check?

Accepted Answer

Consul health checks are distributed; local agents perform checks on their services and forward status updates to servers, reducing network traffic.

Answer

Consul health checks are only performed when a DNS query is received.

Answer

Consul only supports TCP checks, whereas load balancers support HTTP checks.

Answer

Consul servers ping every registered service over HTTP every 10 seconds.

Question 5

You are deploying a Consul datacenter with 5 server agents. What is the quorum size required to elect a leader and commit logs, and what is the maximum number of server failures the cluster can tolerate without losing availability?

Accepted Answer

Quorum: 3, Tolerance: 2 failures

Answer

Quorum: 4, Tolerance: 1 failure

Answer

Quorum: 2, Tolerance: 3 failures

Answer

Quorum: 3, Tolerance: 3 failures

Question 6

In a modern Consul deployment on Kubernetes, how does the architecture differ from a traditional VM-based deployment regarding client agents?

Accepted Answer

Kubernetes deployments replace the DaemonSet of Client Agents with the 'Consul Dataplane' sidecar, removing the need for a local agent on every node.

Answer

Kubernetes deployments run Server Agents on every node to ensure maximum availability.

Answer

There is no difference; both use a DaemonSet of Client Agents.

Answer

VM deployments utilize the Consul Dataplane, while Kubernetes relies on Client Agents.

Free CA-003 sample questions