Free HashiCorp Consul-Associate Exam Questions

Question 1

True or False? A prepared query can be used to assist with service failover between multiple federated Consul datacenters.

A : lse

B : ue

Answer: B

Question 2

You are using the Consul KV store and need to be able to easily list all of the keys in a given path. What is the easiest way to do so?

A : consul kv read -recursive

B : nsul kv get -recurse

C : nsul kv read

D : nsul kv get *.*

Answer: B

Question 3

You have created a new gossip encryption key using consul keygen and installed it using the command consul keyring -install

TX/1dsj67x/4XdTeSG1Cb5RdC/cbAbv9Hch4H8cL8nk=.

However, when you try and delete the original gossip encryption key, you receive an error. Based on the error message below, what steps need to be taken in order to be

able to remove the old gossip encryption key?

1. $ consul keyring -remove /d+jMNoQWICjMvddXJXzyGPDWiEOFgApvUJcuPRcves=

2.

3. ==> Removing gossip encryption key...

4. error: Unexpected response code: 500 (12 errors occurred:

5. * WAN error: 5/5 nodes reported failure

6. * CONSUL-NODE-A.dc-1: Removing the primary key is not allowed

7. * CONSUL-NODE-C.dc-1: Removing the primary key is not allowed

8. * CONSUL-NODE-B.dc-1: Removing the primary key is not allowed

9. * CONSUL-NODE-D.dc-1: Removing the primary key is not allowed

10. * CONSUL-NODE-E.dc-1: Removing the primary key is not allowed

11. * dc-1 (LAN) error: 5/5 nodes reported failure

12. * CONSUL-NODE-E: Removing the primary key is not allowed

13. * CONSUL-NODE-A: Removing the primary key is not allowed

14. * CONSUL-NODE-D: Removing the primary key is not allowed

15. * CONSUL-NODE-B: Removing the primary key is not allowed

16. * CONSUL-NODE-C: Removing the primary key is not allowed

A : wait until the old key is invalidated by Consul based upon the configured validity date

B : nfigure Consul to use the new key using the consul keyring -use command

C : the original gossip key on a Consul cluster cannot be deleted

D : it for Raft to replicate the new key across all cluster nodes before you can remove it

Answer: A

Question 4

You have two Consul datacenters and you want to enable federation so services in dc1 can discover services in dc2. You run the consul join wan node2.example.com.

However, servers in dc1 can not communicate with servers in dc2 and vice versa. Based on the snippets of the server configuration files can be found below, why would

this be assuming network connectivity is working as expected?

dc1 configuration

1. "datacenter": "dc1",

2. "server": true,

3. "key_file": "/etc/consul.d/cert.key",

4. "cert_file": "/etc/consul.d/client.pem",

5. "ca_file": "/etc/consul.d/chain.pem",

6. "verify_incoming": true,

7. "verify_outgoing": true,

8. "verify_server_hostname": true,

9. "ui": true,

10. "encrypt": "XIUEktl3YjG9KPJfaBU1xE69IZ0XhsNCSH423FyknJE=",

11. "bootstrap_expect": 5,

12. "enable_syslog": true,

dc2 configuration

1. "datacenter": "dc2",

2. "server": true,

3. "key_file": "/etc/consul.d/cert.key",

4. "cert_file": "/etc/consul.d/client.pem",

5. "ca_file": "/etc/consul.d/chain.pem",

6. "verify_incoming": true,

7. "verify_outgoing": true,

8. "verify_server_hostname": true,

9. "ui": true,

10. "encrypt": "LSBSOZI5+9EX/kdY8u27mX50rk1ywcprfUCoSZjnpUg=",

11. "bootstrap_expect": 5,

12. "enable_syslog": false,

A : gossip keys need to match between federated datacenters

B : verify_incoming setting should be set to false before WAN federation can be configured

C : client certificates are issued from different CAs

D : syslog configurations do not match

Answer: A

Question 5

Scenario: You have an application that uses Consul service discovery to connect to backend services in order to process data submitted by end-users. The front-end web

service consists of 3 containers, while the backend service consists of 5 static virtual machines. All of the front-end web servers and the backend servers are registered

with Consul.

During normal operations, a user complains that the data processing is taking too long. To troubleshoot, you run a DNS query against the DNS name for the backend

service, but discover that the response only contains three of the virtual machines. Why would Consul only respond with three servers rather than all five?

A : the response only included the three underutilized nodes

B : the DNS query must specify how many nodes to return in the response

C : health check is failing for the other two servers

D : nsul has a maximum response of three nodes in a given DNS query

Answer: C