Consul 1.15 Key Value Store Practice Test 5 — 15 Questions

Question 1

Which TWO of the following are true about the 'cas' parameter in KV writes?

Accepted Answer

It stands for Check-And-Set. Option C is correct because 'cas' stands for Check-And-Set, the Consul KV write flag that makes a write conditional on the key's current ModifyIndex. Option E is correct because using cas requires supplying a valid ModifyIndex value: the write succeeds only if it matches the key's current index, otherwise Consul returns an error (e.g., HTTP 409). The other options are wrong: cas is available through the HTTP API and UI as well as the CLI, it works for existing keys (not only new ones), and it is optional rather than mandatory for all writes.

Answer

It is only available in the CLI

Answer

It only works for new keys

Answer

It is mandatory for all writes

Question 2

Which THREE of the following represent potential bottlenecks for Consul KV performance?

Accepted Answer

Very large number of keys. Option A is correct because Consul's KV store keeps all keys in memory and replicates them via Raft, so a very large number of keys increases memory pressure, snapshot size, and Raft log/replication overhead, degrading performance. Option B is correct because every KV write must be committed through the Raft consensus protocol and replicated to a quorum of servers, so very high write throughput becomes a bottleneck as the leader serializes and replicates each write. Option D is correct because very large value sizes inflate Raft log entries, snapshot transfers, and network replication traffic, and Consul enforces a maximum KV value size (512 KB) precisely because oversized values harm performance. Option C is not a primary bottleneck because reads can be served by any server (including non-leaders) and stale reads can be served locally, so high read frequency scales better than writes. Option E is not a bottleneck because HTTP is the standard Consul KV API transport and the RPC layer is used internally; the protocol choice itself is not a performance-limiting factor compared to key count, write volume, and value size.

Answer

High read frequency

Answer

Using HTTP instead of RPC

Question 3

You are using a Consul KV entry to store a feature flag. You want the flag to be automatically deleted if the node that owns it becomes unhealthy. Which Consul API operation should you use?

Accepted Answer

Create a session with the node's checks, then call PUT /v1/kv/feature/flag?acquire=<session> with the flag value.. Acquiring a KV entry with a session establishes a lock. When the session's health checks fail, Consul invalidates the session and releases the lock, deleting the key. This is the intended mechanism for tying a KV entry's lifetime to node health. The other operations either set metadata, perform conditional writes, or attempt to release a lock that was never acquired.

Answer

Call PUT /v1/kv/feature/flag?cas=0 with the flag value, then configure a watch to delete the key when the node fails.

Answer

Call PUT /v1/kv/feature/flag?flags=1 with the flag value, then rely on Consul's garbage collector to remove it when the node fails.

Answer

Call PUT /v1/kv/feature/flag?release=<session> with the flag value, then create a session for the node.

Question 4

You are designing a configuration system where multiple instances of a service must coordinate to elect a single leader using Consul KV. Which two statements accurately describe how to implement leader election with sessions? (Choose two.)

Accepted Answer

Each instance should create a session with a unique name and then attempt to acquire the same KV key using PUT /v1/kv/service/leader?acquire=<session_id>.. Leader election with Consul KV relies on sessions and the acquire operation. Each candidate creates a unique session and attempts to acquire a shared key. The holder must renew its session to keep the lock; if renewal fails, the session expires and the lock is released. Deleting the key or sharing sessions does not provide correct coordination, and KV entries do not support TTLs.

Answer

To release leadership, the leader can simply delete the KV key, which automatically invalidates its session and allows another instance to acquire the lock.

Answer

All instances should use the same session ID to ensure they can all attempt to acquire the lock simultaneously, and the first one to call acquire becomes the leader.

Answer

The KV key used for leader election must have a TTL set via the ?ttl= query parameter, so that it expires automatically if the leader fails.

Question 5

A developer has stored the database connection string under the Consul KV path `config/db/primary`. A configuration management script needs to fetch this value as raw text so it can be exported directly into an environment variable. Which Consul CLI command retrieves only the value of that key?

Accepted Answer

consul kv get -raw config/db/primary. The -raw flag suppresses the key name and all metadata, emitting only the stored bytes of the value. When a script needs to assign a KV value directly to a shell variable, any extra formatting breaks the assignment, so the raw form is required. The other commands either add metadata or wrap the value in JSON.

Answer

consul kv get -detailed config/db/primary

Answer

consul kv get config/db/primary

Answer

consul kv export config/db/primary

Question 6

An operator writes a feature flag to `app/features/new-ui` using `consul kv put app/features/new-ui true`. Later, a health-check script reads that key and receives an error instead of the value. The operator confirms the key exists with `consul kv get app/features/new-ui`. Which command should the operator run to inspect the metadata that would reveal a problem such as a missing or expired session on the key?

Accepted Answer

consul kv get -detailed app/features/new-ui. Metadata such as the attached session and lock index is only exposed when the detailed view is requested. A key can be readable while still being held by a session, and a health script that attempts to acquire the lock will fail in that case. Requesting the detailed output surfaces the session identifier needed to investigate further.

Answer

consul kv put app/features/new-ui -flags=42

Answer

consul catalog nodes -service=app

Answer

consul kv get -recurse app/features/

Question 7

A developer uses the Consul KV store to coordinate a rolling deployment. They write a key `deploy/status` with the value `in-progress` using `consul kv put deploy/status in-progress`. Later, they want to check the current value of that key without any blocking or long-polling behavior. Which command should they run?

Accepted Answer

consul kv get deploy/status. The correct command is the one that performs a simple read of a single key. `consul kv get` retrieves the value and optional metadata for the specified key, matching the developer's requirement to check the current value without blocking. The other commands either write, watch, or export data, none of which satisfy a straightforward read.

Answer

consul kv put deploy/status

Answer

consul kv export deploy/status

Answer

consul watch -type=key -key=deploy/status

Question 8

A developer stores a feature flag at the key `config/features/new-ui` in Consul KV and wants to atomically create it only if it does not already exist, failing the write if the key is present. Which Consul CLI command accomplishes this?

Accepted Answer

consul kv put -cas=0 config/features/new-ui true. Atomic create-if-absent writes in Consul KV are performed with the check-and-set flag. Supplying a CAS value of zero conditions the write on the key not yet existing, because a missing key reports a ModifyIndex of zero. If another client created the key first, its ModifyIndex becomes non-zero and the conditional write returns an error rather than overwriting it.

Answer

consul kv put -flags=0 config/features/new-ui true

Answer

consul kv put -acquire config/features/new-ui true

Answer

consul kv put -modify-index=0 config/features/new-ui true

Question 9

You are designing a distributed leader election system using Consul. A service instance must hold a lock on the KV key 'service/leader' to become the leader. You need to ensure that if the instance crashes or loses network connectivity, the lock is automatically released so another instance can acquire it. Which Consul feature should you use to achieve this?

Accepted Answer

Consul sessions with a TTL and the acquire parameter on a KV PUT request. Sessions are the correct mechanism for distributed locks in Consul. By creating a session with a TTL and using the acquire parameter when writing to a KV key, the key becomes locked to that session. If the session expires because the instance fails to renew it, Consul releases the lock, enabling another instance to acquire it. This pattern is fundamental for leader election.

Answer

Consul watches on the KV key with a script that releases the lock

Answer

Consul KV key with a long TTL and manual cleanup by an operator

Answer

Consul prepared queries with failover to another datacenter

Question 10

A team stores rolling deployment state under `deploy/current`. To avoid a race where two operators both believe they own the release, the application must acquire the key only if it is not already held, and it must automatically release the key if the holding process dies. Which combination of Consul primitives achieves this?

Accepted Answer

Create a session, then call the KV acquire endpoint with that session and the key; the lock is released automatically when the session expires.. Mutual exclusion with automatic release requires a session-bound acquisition. The acquire operation is atomic, so only one session can hold the key, and because the key is tied to a session it is freed when that session ends. This pairs contention safety with failure recovery, which plain writes or check-and-set alone cannot provide.

Answer

Use consul kv put with the -cas flag set to the current ModifyIndex on every write attempt.

Answer

Write the key with consul kv put, then poll the key every second to detect a competing writer.

Answer

Register a service check for the operator and rely on the catalog health status to block duplicate writes.

Question 11

A platform team stores feature-flag values under the prefix `config/features/`. They need to read the single key `config/features/checkout` and receive its value along with metadata such as `CreateIndex` and `ModifyIndex` in the response. Which Consul CLI command accomplishes this?

Accepted Answer

consul kv get config/features/checkout. Reading one exact key path with `consul kv get` returns the stored value together with the key's metadata, including CreateIndex and ModifyIndex, which the team needs for change tracking. The other commands either modify or delete the key or export a prefix in a different JSON format, so they cannot deliver a single-key read with its index fields.

Answer

consul kv put config/features/checkout

Answer

consul kv delete config/features/checkout

Answer

consul kv export config/features/checkout

Question 12

You are deploying a service that must store a critical configuration value in Consul KV. The value must only be visible to services with a token that has read access to that specific key. You also need to ensure that any write to the key can only be performed by a token with write access. Which Consul feature should you use?

Accepted Answer

Consul ACLs with a policy that restricts access to the KV path.. The requirement is to restrict read and write access to a specific KV key based on tokens. Consul ACLs with policies that define rules for the KV path are the correct mechanism. They allow you to specify exact permissions for tokens, ensuring that only authorized clients can read or write the key. Other options do not provide this level of access control.

Answer

Consul namespaces with a default policy that allows all operations.

Answer

Consul KV key-level encryption using the gossip encryption key.

Answer

Consul intentions that define which services can communicate with the KV store.

Question 13

An operator wants to create a distributed lock using the Consul KV store and sessions. They create a session with `consul session create` and obtain a session ID. They then attempt to acquire a lock on the key `locks/primary` by running `consul kv put -acquire locks/primary leader1`. The command fails with an error indicating the lock is already held. Which of the following best explains why the lock acquisition failed?

Accepted Answer

The key `locks/primary` already has an associated session that holds the lock, and the session is still active.. Lock acquisition in Consul KV uses sessions. When a key has an active session associated with it, that session holds the lock. A new `-acquire` attempt with a different session will fail because the lock is already held. The other options describe incorrect requirements or behaviors that do not match Consul's lock semantics.

Answer

The operator did not specify a value for the key, and Consul requires a non-empty value to acquire a lock.

Answer

The session ID used for the `-acquire` operation was not created with the `-behavior=release` flag, so it cannot acquire locks.

Answer

The key `locks/primary` does not exist yet, and Consul requires the key to be created before acquiring a lock.

Question 14

An operator needs to delete the single KV entry `app/temp/cache-ttl` but must leave every other key under `app/temp/` untouched. Which command performs exactly that deletion?

Accepted Answer

consul kv delete app/temp/cache-ttl. Deleting a single KV entry requires passing its full path to `consul kv delete` with no recursion flag. Consul then removes only that exact key, leaving all siblings under the same prefix intact. Recursion, check-and-set conditions, and empty-value writes all change behavior in ways that either over-delete, fail, or merely blank the value.

Answer

consul kv delete -cas=0 app/temp/cache-ttl

Answer

consul kv delete -recurse app/temp/

Answer

consul kv put app/temp/cache-ttl ""

Question 15

An operator wants to atomically create a key `locks/leader` only if it does not already exist, so that two competing processes cannot both become leader. Which Consul KV operation should be used?

Accepted Answer

A `consul kv put` using the `-cas` flag set to 0. Atomic create-if-absent is achieved with the check-and-set mechanism. Supplying `-cas 0` tells Consul to perform the write only when the key's ModifyIndex is zero, meaning the key is absent. The first writer succeeds; any later writer sees a non-zero index and is rejected, ensuring a single leader without a race condition.

Answer

A normal `consul kv put` with no extra flags

Answer

A `consul kv get` followed by a `consul kv put`

Answer

A `consul kv put` with the `-flags` option set to a unique value