Consul 1.15 Key Value Store Practice Test 4 — 15 Questions

Question 1

What is the purpose of the 'Behavior' field when creating a Consul session?

Accepted Answer

To specify what happens to locks on session invalidation.. The 'Behavior' field in a Consul session controls what happens to locks held by the session when the session is invalidated (e.g., due to TTL expiry or explicit destruction). The two valid values are 'release' (default), which releases all locks, and 'delete', which deletes the locks. This determines the fate of held locks upon session invalidation.

Answer

To define the node affinity.

Answer

To determine if the session can be renewed.

Answer

To set the session priority.

Question 2

If a Consul agent is configured with 'disable_remote_exec = true', how does this affect the KV store?

Accepted Answer

It has no effect on the KV store.. 'disable_remote_exec' controls whether Consul's remote execution feature (the 'consul exec' command) is allowed on the agent. It has no relationship to the KV store — KV reads, writes, watches, and consistency modes are governed by separate ACL and query parameters. Setting this flag simply blocks remote command execution for security hardening.

Answer

It forces all KV reads to be consistent.

Answer

It prevents all KV writes.

Answer

It disables KV watches.

Question 3

You want to delete a key and all its children in the KV store using the CLI. Which flag should you use?

Accepted Answer

-recurse. The -recurse flag in the CLI allows the delete operation to act on the key and all nested keys.

Answer

-force

Answer

--all

Answer

--cascade

Question 4

You need to retrieve the session information for a specific session ID. Which endpoint should you query?

Accepted Answer

/v1/session/info/:id. The Consul HTTP API exposes session information through the /v1/session/info/:id endpoint, which returns the full session object (ID, node, checks, behavior, TTL, lock-delay) for the specified UUID. This is the documented read endpoint for a single session, distinct from /v1/session/list (all sessions) and /v1/session/node/:node (sessions on a node).

Answer

/v1/session/read/:id

Answer

/v1/kv/session/:id

Answer

/v1/session/get/:id

Question 5

What is the default value for the Consul KV flags field if not provided during a write?

Accepted Answer

0. When a KV pair is written without specifying the flags field, Consul defaults the flags value to 0. The flags field is a 64-bit unsigned integer used for application-specific metadata, and its zero value indicates no flags set.

Answer

1

Answer

null

Answer

-1

Question 6

You are using a Consul Watch to monitor KV changes. What does the 'handler' field specify?

Accepted Answer

The path to the executable to trigger.. In a Consul watch configuration, the `handler` field specifies the path to an executable that Consul invokes when the watched data changes. Consul passes the watch results as JSON on stdin to the handler, and the handler can act on the change (e.g., reload a service, update a config file). It is not a filter, server address, or key path.

Answer

The address of the Consul server.

Answer

The filter criteria for the watch.

Answer

The KV key to watch.

Question 7

You want to perform a list operation on a KV prefix to see all keys, but you don't want the values returned. Which API parameter helps reduce payload size?

Accepted Answer

keys=true. The `keys=true` query parameter on the Consul KV list endpoint instructs the API to return only the key names under the given prefix, omitting the associated values. This dramatically reduces the response payload size when you only need to enumerate keys rather than retrieve their contents. It is the documented way to perform a lightweight listing operation against a KV prefix.

Answer

raw=true

Answer

list=true

Answer

summarize=true

Question 8

When using Consul KV for distributed locking, why is it recommended to use a session?

Accepted Answer

It allows for TTL-based automatic lock release.. Sessions in Consul provide a mechanism for TTL-based automatic lock release. When a lock is acquired using a session, the session must be periodically renewed; if the client fails to renew before the TTL expires, Consul automatically invalidates the session and releases any locks held by it, preventing deadlocks from crashed or partitioned clients.

Answer

It encrypts the lock data.

Answer

It allows for multiple lock holders.

Answer

It speeds up read operations.

Question 9

If a KV operation returns a 403 Forbidden status, what is the most common cause?

Accepted Answer

The ACL token lacks sufficient permissions.. A 403 Forbidden response from Consul's HTTP API indicates the request was authenticated but the associated ACL token does not have the required policy permissions for the target resource. Consul returns 403 specifically when an ACL is enforced and the token lacks the necessary 'read', 'write', or 'list' capability on the KV prefix being accessed. This is distinct from 401 (missing/invalid token) and 404 (key not found).

Answer

The server is down.

Answer

The data is too large.

Answer

The key does not exist.

Question 10

Which Consul feature allows you to observe the KV store for changes and run a command in response?

Accepted Answer

Consul Watches. Consul Watches are a mechanism that allows you to monitor specific Consul data (such as KV pairs, health checks, or service listings) for changes and trigger an external handler (e.g., a script or HTTP endpoint) when a change occurs. The watch polls the Consul API at a specified interval and invokes the handler with the updated data. This is the intended feature for reacting to KV store modifications.

Answer

KV Hooks

Answer

Consul Events

Answer

Consul Connect

Question 11

When providing a session TTL, what is the minimum duration allowed?

Accepted Answer

10 seconds. Consul enforces a minimum session TTL of 10 seconds; any value below this is rejected by the agent. This floor prevents excessively chatty heartbeat traffic that would overwhelm the gossip protocol and server resources. The correct answer is therefore 10 seconds.

Answer

30 seconds

Answer

5 seconds

Answer

1 second

Question 12

Which TWO of the following are common use cases for the Consul KV store?

Accepted Answer

Distributed locking. Option B (Distributed locking) is correct because Consul KV supports acquiring and releasing locks via sessions, using the KV store's compare-and-swap semantics combined with session invalidation to implement distributed locking and leader election. Option E (Distributed configuration management) is correct because Consul KV is commonly used to store application configuration key/value pairs that services read at runtime, with Consul's blocking queries and watches enabling dynamic config updates. Option A (Traffic routing) is not a KV use case; traffic routing is handled by Consul service mesh features such as intentions, service resolvers, and Envoy sidecar proxies. Option C (Service discovery) is provided by Consul's catalog and DNS/HTTP service registration APIs, not the KV store. Option D (Running custom scripts) is not a Consul KV function; Consul executes scripts only via health checks or watches that trigger external handlers, not as a KV capability.

Answer

Traffic routing

Answer

Service discovery

Answer

Running custom scripts

Question 13

Which THREE of the following fields are returned in a typical Consul KV API GET response?

Accepted Answer

ModifyIndex. A Consul KV API GET response (e.g., GET /v1/kv/<key>) returns a JSON array of entries containing the fields Key, Value, Flags, CreateIndex, ModifyIndex, LockIndex, and Session. Option A (ModifyIndex) is correct because it is the index at which the key was last modified and is included in every KV read response. Option B (Key) is correct because the full key path is returned so the client knows which key the entry corresponds to. Option C (Value) is correct because the base64-encoded value stored at the key is returned (null if the key has no value). Option D (SessionTTL) is not part of the KV response; TTL is a property of sessions (returned by the session API, e.g., /v1/session/info), not of KV entries. Option E (CreateTime) is not a Consul KV field; Consul uses CreateIndex (a Raft index) rather than a timestamp to record when the key was created.

Answer

SessionTTL

Answer

CreateTime

Question 14

Which THREE of the following are true about Consul KV keys?

Accepted Answer

Keys support storing binary data. Option B is correct because Consul KV values are stored as raw bytes, so any binary data (not just UTF-8 text) can be written and retrieved via the KV API or `consul kv put`/`consul kv get`. Option C is correct because Consul KV keys are case-sensitive, meaning `App/Config` and `app/config` are distinct keys. Option E is correct because keys use slash-delimited paths such as `service/web/port`, giving a folder-like hierarchy that can be listed with `consul kv get -recurse` or the `?recurse` API parameter. Option A is wrong because a leading slash is not required; keys like `foo/bar` are valid without one. Option D is wrong because spaces are permitted in Consul KV keys (they are just bytes in the key string), so there is no rule forbidding them.

Answer

Keys must start with a slash

Answer

Keys cannot contain spaces

Question 15

Which TWO of the following are true regarding Consul KV watches?

Accepted Answer

Watches use blocking queries internally. Option B is correct because Consul watches are implemented on top of blocking queries: the watch issues a request with an index and the Consul server holds the connection open until the data changes or the wait time expires, then returns a new index. Option D is correct because watches can be declared in the agent's configuration files (a `watches` block in HCL/JSON) so the agent starts them automatically, in addition to being startable via the `consul watch` CLI command. Option A is wrong because a watch can target a key that does not yet exist and will fire when it is created. Option C is wrong because Consul does not automatically restart a watch handler script that fails; the handler is simply invoked on each change. Option E is wrong because watches are available in the open-source edition, not only Consul Enterprise.

Answer

Watches can only monitor keys that exist

Answer

Watches automatically restart after a script failure

Answer

Watches are only available in the Enterprise edition