HashiCorp · Free Practice Questions · Last reviewed May 2026
30real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
When using the Consul KV store, what is the maximum size allowed for a single value in a key?
There is no limit.
128 KB
1 MB
512 KB
Consul limits the value size to 512 KB.
An application is using Consul KV to store configuration. You notice that the KV store is becoming large. What is the most efficient way to retrieve only the keys under the prefix "service/web/"?
Set the depth parameter to 1.
Use the index parameter with value 0.
Use the keys parameter with the prefix.
Use the recurse=true parameter in the query string.
Recurse=true returns all keys sharing the specified prefix.
Which Consul API endpoint is used to create a new session that can be used for locking KV keys?
/v1/kv/acquire
/v1/session/create
This endpoint creates the session required for session-based locking.
/v1/lock/init
/v1/session/renew
You are configuring a Consul Watch to trigger a script whenever a specific KV key changes. Which type of watch should you define in your configuration file?
event
service
key
Key watches track updates to a specific KV path.
nodes
You have implemented a leader election mechanism using Consul KV sessions. The session has a TTL of 15 seconds. If the application crashes, how long will it take for the lock to be automatically released?
Immediately.
60 seconds.
The lock is never released until manually deleted.
15 seconds.
The session TTL defines the duration after which an un-renewed session is invalidated, releasing associated locks.
You observe that a session lock is being released unexpectedly. What is the most likely cause?
The Consul agent is in leader mode.
The index was not incremented.
The session TTL is too low, causing premature expiration.
If network latency prevents the renewal, the session expires.
The KV key was deleted.
Want more Key Value Store practice?
Practice this domainWhat does the 'kind' field in a service definition specify for a Consul Connect service?
The proxy type (e.g., 'connect-proxy').
Setting kind to 'connect-proxy' tells Consul this is a sidecar.
The service version.
The datacenter location.
The language of the application.
Which component acts as the default sidecar proxy for Consul Connect?
Nginx
HAProxy
Envoy
Envoy is the primary supported proxy for Consul Connect.
Linkerd
When using 'Consul Connect native' integration, how does the application handle mTLS?
mTLS is disabled by default for native apps.
The application uses the local Consul agent API to fetch identity certificates.
Native apps use the Consul secret API to get their identity.
The sidecar proxy handles all mTLS.
The Consul agent performs the TLS handshake on behalf of the app.
You have a service that needs to talk to a service in a different datacenter. What configuration is required?
Direct VPC peering.
An external service definition.
A global intention.
A mesh gateway deployment.
Mesh gateways act as the entry/exit points for cross-DC traffic.
A service 'api' is configured with mTLS. You want to rotate the CA root certificate without interrupting existing connections. What is the recommended strategy?
Disable mTLS globally, update, and re-enable.
Delete the existing CA and restart all agents.
Update the CA configuration to include the new root in the 'additional_roots' field.
Adding to additional_roots allows for a transition period where both CAs are trusted.
Use the 'consul tls ca create' command with the --rotate flag.
You need to deny all traffic between 'service-a' and 'service-b' using intentions. What is the most efficient way to achieve this?
consul intention create -allow-none service-a service-b
consul intention set -action=drop service-a service-b
consul intention create -deny service-a service-b
This command directly creates a deny-type intention.
consul intention delete service-a service-b
Want more Service Mesh With Consul Connect practice?
Practice this domainYou are troubleshooting why a service registered via HTTP API is not showing up in the catalog. Which tool provides the most immediate insight into the registration status?
consul kv get
consul catalog services
This command lists all services currently registered in the catalog.
consul reload
consul members
Which Consul feature allows you to perform health checks against a service that does not have an exposed HTTP endpoint but resides on the same machine?
TCP health check.
Script health check.
Script checks can execute any command locally on the node.
HTTP health check.
gRPC health check.
An administrator wants to register a service using a JSON file. Where should this file be placed on a standard Consul agent installation to ensure automatic loading?
/var/lib/consul/
/etc/consul/
/etc/consul.d/
The default configuration directory for Consul is typically /etc/consul.d/.
/usr/local/bin/
You need to register a service that runs on a dynamic port. How should the service definition be configured to allow Consul to detect the port?
Set 'port' to 'auto' in the service definition.
Omit the 'port' field entirely.
Use the 'address' field for the port.
Set 'port' to 0 in the service definition.
Setting port to 0 signals to Consul that the port is dynamic.
You have a service that requires specific routing logic based on the environment. How can you distinguish between 'production' and 'staging' instances of the same service name using metadata?
Use different service names for every environment.
Modify the service's port number.
Apply 'production' or 'staging' tags to the service definition.
Tags allow for logical grouping and filtering of services sharing the same name.
Assign different Consul datacenters.
An administrator needs to query service information. Which DNS record type is commonly used by Consul to return service addresses?
TXT
MX
CNAME
SRV
SRV records are the standard for service discovery in DNS.
Want more Service Discovery practice?
Practice this domainWhich protocol do Consul servers use to maintain the WAN gossip pool?
gRPC
DNS
Serf (SWIM)
Consul uses Serf/SWIM for membership and gossip.
HTTP
A cross-datacenter service discovery request is failing. You observe the local datacenter can resolve the service via DNS, but the remote datacenter cannot. Which configuration parameter must be checked?
enable_central_config
node_meta
primary_datacenter
The primary_datacenter must be correctly defined for ACL and gossip coordination across the federation.
check_ttl
In a multi-datacenter environment, what happens if the 'primary_datacenter' server cluster becomes unavailable?
Secondary datacenters elect a new primary.
Secondary datacenters continue to operate, but ACL updates are blocked.
ACL replication requires the primary, but local operations are unaffected.
All secondary datacenters immediately shut down.
The entire WAN federation is dismantled.
You have enabled ACL replication between a primary and secondary datacenter. What is the effect of changing an ACL policy in the primary datacenter?
The changes only propagate if the secondary is in maintenance mode.
The changes require a manual trigger on secondary servers.
The changes are ignored by secondary datacenters.
The changes are asynchronously replicated to all secondary datacenters.
ACL replication is an asynchronous process that pushes updates from primary to secondaries.
You are troubleshooting a partition between two datacenters. The WAN gossip shows high latency. Which Consul CLI tool provides the best insight into the WAN gossip state?
consul operator raft list-peers
consul members -wan
This command specifically shows members across the WAN gossip pool.
consul monitor
consul kv get
How do you enable WAN federation between two Consul datacenters that do not share a network?
By disabling ACLs.
By increasing the gossip interval.
By using a load balancer in front of the servers.
By deploying Mesh Gateways.
Mesh gateways are the designated way to connect isolated datacenters.
Want more Multi Datacenter Federation practice?
Practice this domainAn operator observes that a service is failing its HTTP health check because the application takes 15 seconds to start up, exceeding the default timeout. Which parameter should be adjusted in the service definition to prevent premature failure?
InitialStatus
Timeout
Specifies the duration the agent waits for a response.
Interval
DeregisterCriticalServiceAfter
You are monitoring service health using Consul and want to ensure that a service is automatically removed from the catalog if it remains in a 'critical' state for more than 24 hours. Which configuration key supports this?
cleanup_interval
critical_timeout
deregister_critical_service_after
This is the correct parameter for automatic removal.
remove_service_after
Which agent configuration allows you to specify the local address that the Consul agent binds to for performing health checks?
advertise_addr
client_addr
check_addr
bind_addr
Used by the agent for internal and health check traffic.
A service has a TTL check configured with a 30-second TTL. If the application crashes and stops sending heartbeats, when will the service status change to 'critical'?
After 60 seconds
Once the agent restarts
Immediately
After 30 seconds
The status transitions to critical after the TTL duration.
When defining a TCP health check, what is the primary indicator that the check is 'passing'?
The port is listed in netstat
The service responds with a specific string
The service returns a 200 OK
The agent receives a successful TCP handshake
Successful connection implies the service is reachable.
You have configured a Script health check that executes a shell command. For security reasons, you want to restrict which scripts the Consul agent can run. What configuration setting must be set to 'false' in the agent configuration to disable script checks entirely?
allow_unprivileged_scripts
disable_remote_exec
enable_script_checks
This flag controls the ability of the agent to execute scripts.
enable_local_script_execution
Want more Health Checking practice?
Practice this domainThe Consul 1.15 exam has 200 questions and must be completed in 120 minutes. The passing score is 700/1000.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 5 domains: Key Value Store, Service Mesh With Consul Connect, Service Discovery, Multi Datacenter Federation, Health Checking. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official HashiCorp Consul 1.15 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.