Be able to read and write KV entries with the CLI and HTTP API, apply check-and-set using the `cas` parameter (cas=0 creates only if absent), and diagnose 403s as ACL policy failures. The single most important thing: know that `cas` enforces atomic conditional writes based on ModifyIndex.
Start practicing
Key Value Store — choose a session length
Free · No account required
Domain overview
The Key Value Store domain covers Consul's distributed KV store: reading and writing keys via the HTTP API and the `consul kv` CLI, blocking queries and watches, check-and-set semantics using ModifyIndex, and ACL enforcement. Questions test API parameters, status codes, and how KV interacts with Consul's consistency and permissions model.
Exam objectives
Using `consul kv put`, `get`, `delete`, and `export`/`import` CLI subcommands correctly
HTTP API endpoints like `/v1/kv/:key` with `?cas=`, `?recurse=`, and `?index=` parameters
Blocking queries and watches that fire scripts when a watched key changes
ACL token policies granting `key` and `key_prefix` read/write permissions in Consul
Confusing `cas` check-and-set with `acquire`/`release` session locks; `cas=0` only succeeds when the key does not yet exist
Assuming a 403 Forbidden means the key is missing; it almost always indicates an ACL token lacking the required policy
Forgetting that blocking queries use `index` and return `X-Consul-Index`, and that watches need a valid token to read protected keys
Click any question to see the full explanation and answer options, or start a focused practice session above.
When using the Consul KV store, what is the maximum size allowed for a single value in a key?
2Which Consul API endpoint is used to create a new session that can be used for locking KV keys?
3You are configuring a Consul Watch to trigger a script whenever a specific KV key changes. Which type of watch should you define in your configuration file?
4You have implemented a leader election mechanism using Consul KV sessions. The session has a TTL of 15 seconds. If the application crashes, how long will it take for the lock to be automatically released?
5You observe that a session lock is being released unexpectedly. What is the most likely cause?
6You want to perform a blocking query on a KV key to watch for updates. Which parameter must you provide in your request based on the last observed index?
7You need to perform a write operation to the Consul KV store that only succeeds if the current ModifyIndex of the key is zero. Which parameter should you include in your API call?
8Which command-line interface command is used to set a value in the Consul KV store?
9When a session is associated with a lock, what happens to the lock if the session is deleted?
10Which HTTP method is used to create or update a key in the Consul KV store?
11You need to ensure that a read operation from the KV store is strongly consistent. Which consistency mode should you specify?
12What is the purpose of the 'Behavior' field when creating a Consul session?
13If a Consul agent is configured with 'disable_remote_exec = true', how does this affect the KV store?
14You want to delete a key and all its children in the KV store using the CLI. Which flag should you use?
15You need to retrieve the session information for a specific session ID. Which endpoint should you query?
16What is the default value for the Consul KV flags field if not provided during a write?
17You are using a Consul Watch to monitor KV changes. What does the 'handler' field specify?
18You want to perform a list operation on a KV prefix to see all keys, but you don't want the values returned. Which API parameter helps reduce payload size?
19When using Consul KV for distributed locking, why is it recommended to use a session?
20If a KV operation returns a 403 Forbidden status, what is the most common cause?
21Which Consul feature allows you to observe the KV store for changes and run a command in response?
22When providing a session TTL, what is the minimum duration allowed?
23Which TWO of the following are common use cases for the Consul KV store?
24Which THREE of the following fields are returned in a typical Consul KV API GET response?
25Which THREE of the following are true about Consul KV keys?
26Which TWO of the following are true regarding Consul KV watches?
27Which TWO of the following are true about the 'cas' parameter in KV writes?
28Which THREE of the following represent potential bottlenecks for Consul KV performance?
29You are using a Consul KV entry to store a feature flag. You want the flag to be automatically deleted if the node that owns it becomes unhealthy. Which Consul API operation should you use?
30You are designing a configuration system where multiple instances of a service must coordinate to elect a single leader using Consul KV. Which two statements accurately describe how to implement leader election with sessions? (Choose two.)
31A developer has stored the database connection string under the Consul KV path `config/db/primary`. A configuration management script needs to fetch this value as raw text so it can be exported directly into an environment variable. Which Consul CLI command retrieves only the value of that key?
32An operator writes a feature flag to `app/features/new-ui` using `consul kv put app/features/new-ui true`. Later, a health-check script reads that key and receives an error instead of the value. The operator confirms the key exists with `consul kv get app/features/new-ui`. Which command should the operator run to inspect the metadata that would reveal a problem such as a missing or expired session on the key?
33A developer uses the Consul KV store to coordinate a rolling deployment. They write a key `deploy/status` with the value `in-progress` using `consul kv put deploy/status in-progress`. Later, they want to check the current value of that key without any blocking or long-polling behavior. Which command should they run?
34A developer stores a feature flag at the key `config/features/new-ui` in Consul KV and wants to atomically create it only if it does not already exist, failing the write if the key is present. Which Consul CLI command accomplishes this?
35You are designing a distributed leader election system using Consul. A service instance must hold a lock on the KV key 'service/leader' to become the leader. You need to ensure that if the instance crashes or loses network connectivity, the lock is automatically released so another instance can acquire it. Which Consul feature should you use to achieve this?
36A team stores rolling deployment state under `deploy/current`. To avoid a race where two operators both believe they own the release, the application must acquire the key only if it is not already held, and it must automatically release the key if the holding process dies. Which combination of Consul primitives achieves this?
37A platform team stores feature-flag values under the prefix `config/features/`. They need to read the single key `config/features/checkout` and receive its value along with metadata such as `CreateIndex` and `ModifyIndex` in the response. Which Consul CLI command accomplishes this?
38You are deploying a service that must store a critical configuration value in Consul KV. The value must only be visible to services with a token that has read access to that specific key. You also need to ensure that any write to the key can only be performed by a token with write access. Which Consul feature should you use?
39An operator wants to create a distributed lock using the Consul KV store and sessions. They create a session with `consul session create` and obtain a session ID. They then attempt to acquire a lock on the key `locks/primary` by running `consul kv put -acquire locks/primary leader1`. The command fails with an error indicating the lock is already held. Which of the following best explains why the lock acquisition failed?
40An operator needs to delete the single KV entry `app/temp/cache-ttl` but must leave every other key under `app/temp/` untouched. Which command performs exactly that deletion?
41An operator wants to atomically create a key `locks/leader` only if it does not already exist, so that two competing processes cannot both become leader. Which Consul KV operation should be used?
42A team is using the Consul KV store to store application configuration. They want to implement a watch that runs a script whenever the value of the key `config/app` changes. Which two of the following statements are true regarding Consul KV watches? (Choose two.)
43A system administrator needs to delete a single key named `temp/config` from the Consul KV store. They want to ensure that only that key is removed and no other keys are affected. Which command should they use?
44A team wants to store structured configuration for several microservices in Consul's KV store and retrieve an entire service's configuration with a single CLI call. They plan to keep all keys for `payments` under `services/payments/`. Which command retrieves every key under that prefix in one invocation?
45You are deploying a service that requires distributed locking with automatic release if the service instance fails. You have created a session named 'lock-session' and acquired a lock on the KV key 'locks/db'. After a few minutes, the lock is unexpectedly released even though the service instance is still running. Which action should you take to diagnose the most likely cause?
46You need to store a value in Consul KV that will be read by a service. The value should be retrievable by a simple HTTP GET request to the Consul API. Which HTTP endpoint should you use to read the value of a key named 'app/config/db_host'?
47An engineer is designing a service that must coordinate access to a shared resource using Consul KV sessions and needs to understand the guarantees the lock provides. Which TWO statements accurately describe how Consul's KV locking with sessions behaves? (Choose two.)
48You are deploying a blue/green release where the active environment is selected by the value of the Consul KV key `deploy/active-color`, currently set to `blue`. Your CI pipeline must atomically switch the value to `green` but only if the current value is still `blue`, and must fail if another pipeline already changed it. Which API operation should the pipeline use?
49You are using Consul KV to coordinate a distributed job scheduler. A worker acquires a lock on a key to ensure only one worker runs a job at a time. The lock is tied to a session. The worker crashes and the session expires after its TTL. What happens to the lock on the key?
50A developer needs to remove an obsolete configuration key `app/legacy/timeout` from Consul's KV store so the application no longer reads it. Which command deletes this single key?
51An operator runs `consul kv put config/app/timeout 30s` and then `consul kv get config/app/timeout`. The second command prints only `30s` with no metadata. The operator wants to see the key's `CreateIndex`, `ModifyIndex`, and `Flags` from the command line without writing code against the HTTP API. Which command should be used?
52A microservice uses a Consul session with a 30-second TTL and holds a lock on `locks/leader` via `acquire`. The service process is alive and healthy but its network link to the Consul servers is severed for several minutes. When connectivity is restored, the service finds it no longer owns the lock. Which behavior explains this outcome?
53An operator wants to list every key beneath the `services/web/` prefix, including nested paths, and see each key's associated flags and modify index. Which command returns that information?
54You are implementing a distributed semaphore using Consul KV and sessions. You create a session with a TTL of 60 seconds and use the 'acquire' parameter to lock a key. After acquiring the lock, the application holding the session experiences a 90-second pause due to a garbage collection stop-the-world event. The Consul agent on the node is healthy and continues to renew the session. What happens to the lock?
55A platform team stores service configuration under the Consul KV prefix `config/web/`. An operator runs `consul kv put config/web/timeout 30` at a time when the key already exists with value `45` and ModifyIndex `812`. The operator later needs to update the value only if no one else has changed the key since that write. Which Consul CLI invocation correctly performs this compare-and-swap using the index returned by the prior write?
56A security team stores application secrets under the Consul KV prefix `app/prod/`. They want to be notified whenever any key under that prefix changes, without repeatedly polling the entire prefix. They have access to the Consul HTTP API and the `consul watch` command. Which approach should they use?
57An operator needs to update the value of `config/database/url` in Consul KV, but only if the current value is exactly `postgres://old:5432`. They want to use the Consul CLI to perform a compare-and-swap operation. Which command should they use?
Be able to read and write KV entries with the CLI and HTTP API, apply check-and-set using the `cas` parameter (cas=0 creates only if absent), and diagnose 403s as ACL policy failures. The single most important thing: know that `cas` enforces atomic conditional writes based on ModifyIndex.
The Courseiva Consul 1.15 question bank contains 57 questions in the Key Value Store domain. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the Key Value Store domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included