HashiCorp Certified: Consul Associate (003) practice questions

Question 1

A SaaS multi-region team is evaluating Consul and must enumerate, per the Consul service mesh concepts page, the four core pillars of service networking that Consul addresses. Which option matches the published pillar list?

Accepted Answer

Service discovery, service mesh, API gateway management, and network infrastructure automation — together enabling discovery, secure communication, controlled external access, and programmatic networking.

Answer

Service discovery, Vault secrets management, Terraform automation, and Boundary remote access — bundled as a single HashiCorp networking suite.

Answer

Layer 2 switching, Layer 3 routing, Layer 4 load balancing, and Layer 7 web application firewall — addressed by Consul as a Kubernetes-only OSI replacement.

Answer

Sidecar mTLS, prepared queries, DNS forwarding, and stale reads — the four pillars Consul documents for service networking in production environments.

Question 2

A cloud administrator is provisioning servers for a busy Consul cluster and must decide where to spend the hardware budget given a write-heavy registration workload. Per the Consul server resource requirements reference, which option correctly characterizes the bottleneck?

Accepted Answer

Writes are I/O bound because the Raft log store syncs to disk on every appended entry, so fast low-latency disks matter most.

Answer

Reads are I/O bound because every read replays the Raft log from disk, so the budget should go toward slower archival storage.

Answer

Writes are network bound because each entry is gossiped to all clients before commit, so the budget should target NIC throughput.

Answer

Reads and writes are both purely memory bound, so neither disk speed nor CPU capacity meaningfully affects server throughput.

Question 3

A platform team is reviewing how their Consul agents handle service registration and must confirm two documented behaviors before production rollout. Per the Consul services register command documentation, which TWO statements are correct?

Accepted Answer

Setting DeregisterCriticalServiceAfter lets the agent auto-deregister an unhealthy instance.

Accepted Answer

Registered services are persisted in the agent state directory and survive agent restarts.

Answer

A registered service is removed automatically the moment that its first health check warns.

Answer

Registered services are held purely in memory and are therefore lost when the agent restarts.

Question 4

An engineer is tasked with adding an encrypt key to an already-initialized agent's config file and is confused that the new value seems to have no effect after a restart, given the constraints described in the Consul reference. Per the encryption parameters documentation, what is happening?

Accepted Answer

Because a key was already persisted to the data directory, the newly provided key is ignored and a warning is logged.

Answer

The agent re-reads the config key on every restart, so the new value silently overwrites the persisted gossip key in place.

Answer

The agent refuses to start entirely until the operator first removes the conflicting encrypt key from the data directory.

Answer

The new key is merged into the keyring automatically, so both the persisted and the new keys then encrypt traffic together.

Question 5

A manufacturing OT platform team is designing the default intention policy for a brownfield mesh that already runs hundreds of services and must choose between allow and deny before production cutover. Per the Consul intentions documentation, which option matches the documented effect of the default_policy configuration?

Accepted Answer

The default_policy configuration in Consul determines baseline access when no intention matches apply: setting it to allow permits all service connections by default while deny requires explicit allow intentions for services to communicate.

Answer

The default_policy configuration in Consul has no effect on service-to-service traffic and is only used to gate access to the Consul UI from operator workstations.

Answer

The default_policy in Consul controls only DNS lookups against the catalog and does not influence whether sidecar proxies allow or deny mesh connections across every Consul datacenter and partition currently registered with the cluster.

Answer

The default_policy is a deprecated v0.x setting that has been replaced by a per-service intention block and no longer has any effect in modern Consul versions.

Question 6

A SaaS multi-region production team is designing how Consul agent metrics are wired into a Prometheus stack and must decide which collection interval and flush cadence to expect. Per the Consul telemetry documentation, which option matches?

Accepted Answer

Consul agents collect runtime telemetry metrics aggregated on a ten-second interval and retain them for a configurable duration, and when streaming to external stores the interval aligns with the store's flush period: DogStatsD and StatsD use ten-second intervals while Prometheus operates on a sixty-second flush.

Answer

Consul agents collect runtime telemetry only on demand when a Unix USR1 signal is delivered, and there is no periodic aggregation interval for internal retention of metrics across every Consul datacenter and partition currently registered with the cluster.

Answer

Consul agents collect telemetry on a one-millisecond interval and external stores are required to scrape the metrics endpoint at the same rate to avoid losing samples in production.

Answer

Consul agents collect telemetry only when the agent is acting as the Raft leader, so follower servers and client agents expose no metrics under the documented design, which means a Prometheus scrape pipeline would only ever see one node's worth of telemetry per datacenter regardless of how many client agents are deployed across the fleet.

Question 7

A production team is tasked with patching the host behind one registered web service and must decide how to pull just that service out of DNS and API results temporarily, without permanently deregistering it. Which command fits?

Accepted Answer

consul maint, which marks the service under maintenance by registering a critical health check so it leaves healthy results.

Answer

consul reload, which rereads the service definition file and is the supported way to temporarily hide a registered service.

Answer

consul leave, which gracefully removes the node and immediately deregisters every service the node was providing.

Answer

consul kv put, which records a maintenance flag key that DNS lookups consult before returning the service address.

Question 8

An organization has configured acl_default_policy to deny and now needs individual policy rules to grant specific access to chosen resources. Per the Consul ACL documentation, which rule mode should the organization specify in its policy rules?

Accepted Answer

Allowlist mode, because with a deny default you specify allowlist rules to explicitly allow access to the chosen resources.

Answer

Denylist mode, because a deny default already blocks everything, so rules must explicitly deny the few resources to expose.

Answer

Either mode works identically once acl_default_policy is deny, so the choice of allowlist versus denylist has no real effect.

Answer

Neither mode applies; with a deny default, access can only be granted by attaching the global-management policy to the token.

Question 9

A company is rolling out mTLS across its Consul service mesh and a new engineer asks where service mesh certificates are actually managed and signed. Per the Consul service mesh certificate authority documentation, which statement is correct?

Accepted Answer

It is centralized on the Consul servers using the configured service mesh CA provider that performs signing

Answer

Each sidecar proxy self-signs its own leaf certificate locally, and the Consul servers only store public keys

Answer

Certificates are issued by the client agents at the edge, with the servers merely replicating them afterward

Answer

An external PKI is required to sign every leaf, because Consul servers cannot host a built-in CA provider

Question 10

A network operations team is tired of manually updating firewall and load-balancer rules every time services change, and an architect is evaluating Consul-Terraform-Sync to automate it. Which description matches how NIA with CTS works?

Accepted Answer

CTS uses Consul as a data source and launches Terraform to drive network device changes when services change.

Answer

CTS streams service health events into a prepared query, which then rewrites DNS records on the network devices.

Answer

CTS uses Terraform as a read-only data source and relies on Consul agents to push device configuration changes.

Answer

CTS replaces Terraform with the API gateway, which applies north-south firewall rules whenever the catalog updates.

Question 11

A platform team is migrating from an ad-hoc DNS setup to Consul for a manufacturing OT environment and the architect must distinguish between Consul server agents and client agents. Per the Consul agent page, which option matches the documented operational modes?

Accepted Answer

Server agents form the control plane cluster, maintaining cluster state through the Raft consensus protocol and managing the quorum, while client agents are lightweight processes deployed across the majority of cluster nodes that interface with servers for operations.

Answer

Server agents and client agents are interchangeable runtime modes that can be toggled at request time by setting an HTTP header on every API call to switch between consensus and query roles.

Answer

Client agents form the control plane cluster and maintain the Raft consensus state while server agents are lightweight processes used only by humans logging in to the Consul UI from operator workstations.

Answer

Server agents are deprecated since Consul 1.10 and only client agents now exist; the control plane has been collapsed into the Envoy sidecar proxy on every workload pod or VM across every Consul datacenter and partition currently registered with the cluster.

Question 12

A platform team is rolling out service discovery for a fintech deployment and must enumerate the supported registration paths so each team can pick the right one for their runtime. Per the Consul service discovery concepts page, which option matches?

Accepted Answer

Consul supports multiple registration methods: configuration files loaded at agent startup, HTTP API endpoints for dynamic registration, and Kubernetes service sync for container environments.

Answer

Consul supports service registration only through manual editing of /etc/consul.d/services.json on each node and rejects all HTTP API or Kubernetes-based registration attempts.

Answer

Consul registers services exclusively through DNS SRV records pushed to the agent by an external IPAM controller and does not accept registration via configuration files.

Answer

Consul registers services only via a paid HashiCorp Cloud Platform sync agent that polls Stripe and AWS Marketplace for license entitlement before exposing services to the catalog.

Question 13

A security engineer is tasked with threat-modeling what happens if the consul-agent-ca-key.pem file leaks from a shared build server, given the constraints of a built-in-CA Consul deployment. Per the Consul TLS documentation, what is the impact?

Accepted Answer

Holding the CA key lets an attacker run Consul as a trusted server, mint valid certificates, and read all Consul data.

Answer

The leak only exposes public material, so an attacker can validate existing certificates but cannot mint new trusted ones.

Answer

The leak is limited to gossip traffic, so an attacker can decrypt LAN messages but cannot impersonate a Consul server.

Answer

The leak affects only that node, so revoking its single agent certificate fully restores the datacenter's trust again.

Question 14

A retail e-commerce platform team is designing L7 access control so that the catalog service can only POST to the search service on specific HTTP paths and must choose between L4 and L7 intentions. Per the Consul intentions documentation, which option matches the documented difference between L4 and L7 intentions?

Accepted Answer

L4 intentions operate at the transport layer for TCP and non-HTTP protocols enforcing identity-based access control through mTLS certificates, while L7 intentions apply to HTTP-based protocols offering application-aware enforcement that can restrict access based on specific request attributes like HTTP headers and methods.

Answer

L4 intentions only operate against UDP traffic and L7 intentions only apply to TCP, and neither layer of intention can examine HTTP headers or methods under the documented enforcement model.

Answer

L4 and L7 intentions are interchangeable shorthand for the same configuration entry and any difference between them is purely cosmetic in the Consul UI rendering of the intention list page across every Consul datacenter and partition currently registered with the cluster.

Answer

L4 intentions are deprecated since Consul 1.12 and only L7 intentions can be authored in current versions, regardless of whether the underlying protocol is HTTP or raw TCP, which means transport-layer access decisions must instead be expressed through service-defaults configuration entries to enforce identity-based rules.

Question 15

A team is designing operational dashboards for traffic between meshed services and must select between Consul's built-in Grafana dashboards. Per the Consul service-to-service dashboard documentation, which metrics does that dashboard focus on?

Accepted Answer

Logs, error rates, traffic patterns, and success rates, to keep service-to-service communication reliable for operators.

Answer

Raft commit time, leadership changes, and autopilot health, to track the consensus layer of the control plane.

Answer

Host CPU idle, memory, and disk space usage gathered from the underlying machine that each Consul agent runs on.

Answer

File descriptor counts and kernel limits, used to predict when a Consul agent will stop accepting new connections.

HashiCorp Certified: Consul Associate (003)

Sample questions

Sources

Similar exams