Hashicorp Certified Consul Associate 002 · Free Practice Question Medium
Question 13
Suzanne is a DevOps engineer and will manage the Consul environment at CatsAndDogs, LLC, an internet-based company that ships pet supplies worldwide. After successfully provisioning and configuring the Consul environment that satisfies the Consul security model, one of the dev teams uses an ACL token to register a new service that the call center will use to provide customer service. Suzanne checks Consul and validates the service was successfully registered. However, customer service reps cannot access the service from their desktops. Upon further testing, they seem to be getting an 'access denied' message when accessing https://customer.service.consul.
What can Suzanne change so the customer service reps can access the application?
-
A
provision a new TLS client certificate for all of the customer service desktops from the Consul CA
-
B
bootstrap the ACL system
-
C
create a new ACL policy that permits read access to all services and assign the policy to the anonymous token
-
D
update the Consul configuration file to disable Consul ACLs
Reveal correct answer
Correct answer: C
Explanation
In this scenario, the customer service reps do not have permission since they do not use an ACL token to query the Consul service registry when requesting the application. By default, any requests to Consul that do not include a token will authenticate with the anonymous token when Consul ACLs are enabled.
To fix this, Suzanne can create a new policy that permits read access to the customer service or permit read access to all services in Consul. Suzanna can then assign the policy to the anonymous token. Such as policy might look like this:
- service "customer" {
- policy = "read"
- }
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
