Question 1

What ports does Consul use as the default for the incoming DNS listener, where clients can send DNS queries for service discovery? (select two)

Options :

A : tcp/8600

B : tcp/53

C : udp/53

D : udp/8600

Answer: A,D

Question 2

The Consul KV store can be accessed by the following methods: (select three)

Options :

A : CLI

B :

federated cluster

C : API

D : UI

Answer: A,C,D

Question 3

You have deployed a new Consul cluster to be used for service discovery between your microservices for a new application. In the configuration file, as shown below, you

have enabled ACLs and bootstrapped the ACL system. However, clients are still being permitted to read and write to the ACL system or register services without a valid

token.

Based on the policy, what change needs to be made to finish securing Consul?

1. {

2. "server": true,

3. "node_name": "CONSUL-NODE-A",

4. "datacenter": "DC-1",

5. "data_dir": "/var/consul/data",

6. "bind_addr": "0.0.0.0",

7. "client_addr": "0.0.0.0",

8. "advertise_addr": "10.0.10.208",

9. "bootstrap_expect": 5,

10. "retry_join": ["provider=aws tag_key=consul tag_value=true"],

11. "ui": true,

12. "log_level": "INFO",

13. "acl": {

14. "enabled": true,

15. "default_policy": "allow",

16. "down_policy": "extend-cache"

17. }

18. }

Options :

A : configure the ACL policy for the anonymous token to deny all client requests

B : reload the configuration on all the nodes after the bootstrap token was created

C : update the default_policy across all of the Consul nodes

D : apply the bootstrap token to the other nodes

Answer: C

Question 4

Scenario: You have multiple services registered with Consul for your e-commerce site, including the front-end service, the shipping service, the inventory service, and the

cart service. To safeguard your customer's shipping addresses, you want to ensure that communication between the front-end and the shipping service is denied and that

traffic is only permitted from the cart service.

What feature of Consul Connect can you use to permit access to the shipping service from the cart service and deny communication from the front-end service?

Consul-Associate-Part-2-Q57-page32-image4

Options :

A : Intentions

B : Consul agent

C : Consul ACLs

D : Consul Namespaces

Answer: A

Question 5

You need to deny communication between the customer-db service and the payment service using an intention. You open the command line and issue the following

command:

$ consul intention create customer-db payment

However, the two services can still initiate new connections even after the intention is created. What would explain this?

Options :

A : the default behavior of the command issued is allow

B :

the mTLS certificates are both signed by the same CA, therefore the connectivity is permitted regardless of an intention

C : the services are communicating over HTTP rather than HTTPS

D : there is an identical intention that is permitting the connectivity

Answer: A

Confidently Practice Online with Free HCCAO-003 Exam Cram

Buying Options: