Consul 1.15 Key Value Store Practice Test 6 — 15 Questions

Question 1

A team is using the Consul KV store to store application configuration. They want to implement a watch that runs a script whenever the value of the key `config/app` changes. Which two of the following statements are true regarding Consul KV watches? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A watch of type `key` blocks until the value of the specified key changes, then invokes the handler.. Watches in Consul allow monitoring of KV changes. The `key` type watches a single key and blocks until it changes. The `keyprefix` type watches a prefix and triggers on any change within it. These are both standard watch types. Watches can be configured via CLI, API, or agent configuration, and they do not create keys. They are available in all Consul versions.

Answer

Watches are only available in Consul Enterprise and not in the open-source version.

Answer

Watches can only be configured via the Consul HTTP API and not through the CLI or configuration files.

Answer

A watch of type `key` will automatically create the key if it does not exist.

Question 2

A system administrator needs to delete a single key named `temp/config` from the Consul KV store. They want to ensure that only that key is removed and no other keys are affected. Which command should they use?

Accepted Answer

consul kv delete temp/config. The `consul kv delete` command with a specific key path deletes only that key. The `-recurse` flag would delete the key and all subkeys, which is not desired. Writing an empty value does not delete the key. The pipeline approach is invalid. Therefore, the simple delete command is correct.

Answer

consul kv delete -recurse temp/config

Answer

consul kv export temp/config | consul kv delete -

Answer

consul kv put temp/config ""

Question 3

A team wants to store structured configuration for several microservices in Consul's KV store and retrieve an entire service's configuration with a single CLI call. They plan to keep all keys for `payments` under `services/payments/`. Which command retrieves every key under that prefix in one invocation?

Accepted Answer

consul kv get -recurse services/payments/. Listing all keys under a prefix requires the recursive read behavior. Passing `-recurse` to `consul kv get` returns every key beneath the specified path in a single call, which is precisely how a service loads its whole configuration subtree. A trailing slash alone does nothing, and the other commands either write data or produce a backup-oriented export format.

Answer

consul kv get services/payments/

Answer

consul kv put -recurse services/payments/

Answer

consul kv export services/payments/

Question 4

You are deploying a service that requires distributed locking with automatic release if the service instance fails. You have created a session named 'lock-session' and acquired a lock on the KV key 'locks/db'. After a few minutes, the lock is unexpectedly released even though the service instance is still running. Which action should you take to diagnose the most likely cause?

Accepted Answer

Verify that the service is sending session renewals within the TTL period.. Consul sessions have a TTL and must be periodically renewed by the client. If the service fails to renew within the TTL, the session is invalidated and any locks held by that session are released. In this scenario, the service is still running but likely not renewing the session, causing the lock to be released. Verifying renewal activity is the correct diagnostic step.

Answer

Inspect the KV key's metadata to see if it was modified externally.

Answer

Check the Consul server logs for errors related to the session.

Answer

Restart the Consul agent on the node where the service is running.

Question 5

You need to store a value in Consul KV that will be read by a service. The value should be retrievable by a simple HTTP GET request to the Consul API. Which HTTP endpoint should you use to read the value of a key named 'app/config/db_host'?

Accepted Answer

GET /v1/kv/app/config/db_host. The Consul KV API uses the /v1/kv/ prefix for all key operations. To read a key, you perform a GET request to /v1/kv/<key>. This returns a JSON response containing the value and metadata. Other paths like /v1/store or /v1/kv/read are not valid. The ?raw parameter is optional and returns the value directly, but the standard endpoint is without it.

Answer

GET /v1/kv/read/app/config/db_host

Answer

GET /v1/store/app/config/db_host

Answer

GET /v1/kv/app/config/db_host?raw

Question 6

An engineer is designing a service that must coordinate access to a shared resource using Consul KV sessions and needs to understand the guarantees the lock provides. Which TWO statements accurately describe how Consul's KV locking with sessions behaves? (Choose two.)

Accepted Answer

A lock is acquired by writing a key with the `acquire` parameter and the session ID, and succeeds only if no other valid session currently holds it.. Consul locks are acquired with the `acquire` operation carrying a session ID, and they are released automatically when that session expires or is invalidated. Mutual exclusion is guaranteed because only one valid session can hold a given key. Release is performed through the same key-write path with the `release` operation, and session renewal happens at the session endpoint, not the KV endpoint.

Answer

Session TTL renewal must be performed through the `/v1/kv` endpoint rather than the session endpoint.

Answer

A lock key can be held simultaneously by multiple sessions as long as each session renews within its TTL.

Answer

Releasing a lock requires calling a dedicated `consul kv unlock` subcommand that is separate from the put operation.

Question 7

You are deploying a blue/green release where the active environment is selected by the value of the Consul KV key `deploy/active-color`, currently set to `blue`. Your CI pipeline must atomically switch the value to `green` but only if the current value is still `blue`, and must fail if another pipeline already changed it. Which API operation should the pipeline use?

Accepted Answer

A `PUT` to `/v1/kv/deploy/active-color` with the `cas` query parameter set to the `ModifyIndex` of the current `blue` value.. Atomic conditional writes in Consul KV are performed with the check-and-set mechanism: the client reads the key to learn its `ModifyIndex`, then issues a write carrying that index in the `cas` parameter. If the stored index no longer matches, the write is rejected and the pipeline knows another actor modified the key. This gives exactly the fail-if-changed semantics a blue/green switch needs.

Answer

A `PUT` to `/v1/txn` that writes the new value and deletes the old one in the same transaction, using the key name as the version token.

Answer

A `PUT` to `/v1/kv/deploy/active-color` after acquiring a Consul session lock on the same key using `/v1/kv/deploy/active-color?acquire=<session>`.

Answer

A `PUT` to `/v1/kv/deploy/active-color?flags=1` with the body `green`, relying on the flags bit to reject concurrent writers.

Question 8

You are using Consul KV to coordinate a distributed job scheduler. A worker acquires a lock on a key to ensure only one worker runs a job at a time. The lock is tied to a session. The worker crashes and the session expires after its TTL. What happens to the lock on the key?

Accepted Answer

The lock is automatically released and the key's LockIndex is incremented.. When a session expires, Consul automatically releases any locks held by that session. The lock release is indicated by clearing the Session field on the key and incrementing the LockIndex. The key and its value are not deleted. This allows other workers to acquire the lock and continue operation. Manual intervention is not required.

Answer

The key is deleted and the lock is released.

Answer

The lock is automatically released and the key's value is deleted.

Answer

The lock remains held until a Consul operator manually releases it.

Question 9

A developer needs to remove an obsolete configuration key `app/legacy/timeout` from Consul's KV store so the application no longer reads it. Which command deletes this single key?

Accepted Answer

consul kv delete app/legacy/timeout. Removing a specific key is done with `consul kv delete` pointed at the exact path. That command eliminates the entry so the application stops seeing the obsolete timeout. Reading, overwriting with an empty value, or exporting the key all leave it in place, so none of them achieve the intended removal.

Answer

consul kv put app/legacy/timeout ""

Answer

consul kv get app/legacy/timeout

Answer

consul kv export app/legacy/timeout

Question 10

An operator runs `consul kv put config/app/timeout 30s` and then `consul kv get config/app/timeout`. The second command prints only `30s` with no metadata. The operator wants to see the key's `CreateIndex`, `ModifyIndex`, and `Flags` from the command line without writing code against the HTTP API. Which command should be used?

Accepted Answer

`consul kv get -detailed config/app/timeout`. The CLI exposes KV metadata through the `-detailed` flag on `consul kv get`, which prints `CreateIndex`, `ModifyIndex`, `LockIndex`, `Flags`, `Session`, and the value. Plain `get` and `-recurse` show only names and values, while `export` emits a JSON tree for backup. To see index and flag fields from the shell, `-detailed` is the correct choice.

Answer

`consul catalog nodes -service=config/app/timeout`

Answer

`consul kv export config/app/timeout`

Answer

`consul kv get -recurse config/app/timeout`

Question 11

A microservice uses a Consul session with a 30-second TTL and holds a lock on `locks/leader` via `acquire`. The service process is alive and healthy but its network link to the Consul servers is severed for several minutes. When connectivity is restored, the service finds it no longer owns the lock. Which behavior explains this outcome?

Accepted Answer

The session TTL expired because the service failed to renew it within the TTL window, so Consul invalidated the session and released its locks.. Session-based locks in Consul are leases: the client must renew the session before its TTL elapses, and failure to renew causes the session to expire, which deletes the session and releases all locks and keys it held. A network partition that blocks renewal therefore forfeits the lock, which is the intended safety behavior preventing a partitioned leader from retaining ownership indefinitely.

Answer

The lock was released because Consul applies a fixed maximum lock hold time of 15 seconds regardless of session TTL settings.

Answer

Consul invalidated the session because the node's health check for the service was marked critical during the outage.

Answer

The lock moved to another session immediately after the partition began because Consul rebalances locks among active sessions automatically.

Question 12

An operator wants to list every key beneath the `services/web/` prefix, including nested paths, and see each key's associated flags and modify index. Which command returns that information?

Accepted Answer

consul kv get -recurse services/web/. Listing a KV subtree with metadata requires recursion. The `-recurse` flag on `consul kv get` returns every key under the prefix, each with its value, flags, and modify index, which is precisely the audit view the operator needs. A non-recursive get targets a single key, export targets backup workflows, and the catalog command serves a different subsystem.

Answer

consul catalog services services/web/

Answer

consul kv get services/web/

Answer

consul kv export services/web/

Question 13

You are implementing a distributed semaphore using Consul KV and sessions. You create a session with a TTL of 60 seconds and use the 'acquire' parameter to lock a key. After acquiring the lock, the application holding the session experiences a 90-second pause due to a garbage collection stop-the-world event. The Consul agent on the node is healthy and continues to renew the session. What happens to the lock?

Accepted Answer

The lock remains held because the Consul agent renews the session, and the application's pause does not affect the session.. Session TTL renewal is handled by the Consul agent, not the application. Even if the application is paused, the agent continues to renew the session, keeping the lock held. This can lead to a situation where a lock is held by a session whose application is not actively using it. To avoid this, applications should explicitly release locks or use health checks that reflect application liveness.

Answer

The lock is released because the session TTL expires after 60 seconds without renewal from the application.

Answer

The lock is released immediately when the garbage collection pause begins because Consul detects the application is unresponsive.

Answer

The lock is released after 90 seconds when the application resumes and fails to renew the session in time.

Question 14

A platform team stores service configuration under the Consul KV prefix `config/web/`. An operator runs `consul kv put config/web/timeout 30` at a time when the key already exists with value `45` and ModifyIndex `812`. The operator later needs to update the value only if no one else has changed the key since that write. Which Consul CLI invocation correctly performs this compare-and-swap using the index returned by the prior write?

Accepted Answer

consul kv put -cas=812 config/web/timeout 60. Consul KV supports optimistic concurrency through the check-and-set parameter, exposed on the CLI as `-cas`. Supplying the ModifyIndex observed from a previous operation makes the write succeed only when the key has not been modified since that index was read. If any other client wrote to the key in between, Consul rejects the update with a conflict, letting the operator re-read and retry rather than silently overwriting another change.

Answer

consul kv put -index=812 config/web/timeout 60

Answer

consul kv put -lock=812 config/web/timeout 60

Answer

consul kv put -modify-index=812 config/web/timeout 60

Question 15

A security team stores application secrets under the Consul KV prefix `app/prod/`. They want to be notified whenever any key under that prefix changes, without repeatedly polling the entire prefix. They have access to the Consul HTTP API and the `consul watch` command. Which approach should they use?

Accepted Answer

Use `consul watch -type=keyprefix -prefix=app/prod/` to monitor all keys under the prefix.. The `keyprefix` watch type is designed to monitor all keys under a given prefix and trigger notifications on any change. It uses blocking queries internally, so it is efficient and immediate. The other watch types target single keys, health checks, or events, none of which would detect changes across the entire `app/prod/` prefix.

Answer

Use `consul watch -type=checks -service=app` to monitor the health of the application service.

Answer

Use `consul watch -type=event -name=app/prod/` to watch for custom events with that name.

Answer

Use `consul watch -type=key -key=app/prod/` to monitor the prefix as a single key.