Consul 1.15 Multi Datacenter Federation — 15 Questions

Question 1

A cross-datacenter service discovery request is failing. You observe the local datacenter can resolve the service via DNS, but the remote datacenter cannot. Which configuration parameter must be checked?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

primary_datacenter. In multi-datacenter Consul, the primary_datacenter parameter identifies which datacenter holds the authoritative catalog and ACL configuration. If it is misconfigured or points to the wrong DC, cross-DC service discovery and DNS resolution for remote services fail even though local resolution works.

Answer

enable_central_config

Answer

node_meta

Answer

check_ttl

Question 2

When configuring Mesh Gateways for WAN federation, what is the primary purpose of the 'wan' bind address?

Accepted Answer

To act as an entry point for cross-datacenter traffic in a mesh.. Mesh gateways use the wan bind address to facilitate cross-datacenter traffic routing when native WAN gossip cannot be used or is restricted.

Answer

To synchronize the local KV store.

Answer

To restrict gossip to the LAN only.

Answer

multiple_choice

Answer

To provide an API endpoint for remote users.

Question 3

A service in datacenter A needs to call a service in datacenter B. If 'prepared_queries' are not used, how does the service discovery query look?

Accepted Answer

.service..consul. In Consul DNS, the canonical fully-qualified name for a service in a remote datacenter is .service..consul. The datacenter label is inserted between the 'service' subdomain and the top-level 'consul' zone, so a query for 'web' in 'dc2' resolves to web.service.dc2.consul. This is the standard form used when prepared queries are not in play, because prepared queries allow failover and geo-routing via a single stable name.

Answer

<service>.service.consul

Answer

..service.consul

Answer

remote.<service>.service.consul

Question 4

Which file path is standard for storing the Consul server configuration, including WAN settings?

Accepted Answer

/etc/consul.d. Consul's conventional configuration directory on Linux is /etc/consul.d, where JSON or HCL files defining server, client, WAN, and other settings are placed. Consul automatically loads all *.json and *.hcl files from this directory when started with -config-dir=/etc/consul.d. This is the standard path used in documentation, systemd units, and production deployments.

Answer

/tmp/consul

Answer

/opt/consul/bin

Answer

/var/lib/consul

Question 5

What is the default port used for WAN gossip between Consul servers?

Accepted Answer

8302. Consul uses port 8302 for WAN gossip, which is the Serf gossip protocol used between servers across datacenters. This is distinct from LAN gossip on 8301 and the server RPC port on 8300.

Answer

8301

Answer

8500

Answer

8300

Question 6

If you are running Consul Enterprise, what feature simplifies the management of cross-datacenter secrets?

Accepted Answer

ACL Replication.. In Consul Enterprise, ACL replication is the feature that simplifies the management of cross-datacenter secrets by automatically replicating ACL tokens, policies, and roles from the primary datacenter to secondary datacenters. This ensures consistent access control across datacenters without manual intervention. Other options are not specific to cross-datacenter secret management.

Answer

KV Mirroring.

Answer

Automatic Secret Rotation.

Answer

Centralized Config.

Question 7

What is the function of the 'retry_join_wan' configuration?

Accepted Answer

To enable persistent WAN connections.. The 'retry_join_wan' configuration in Consul is used to specify a list of WAN addresses (typically the Serf WAN port 8302) of other Consul servers in remote datacenters. When set, a Consul agent will continuously attempt to join these addresses until it succeeds, thereby establishing and maintaining persistent WAN gossip connections between datacenters. This is essential for multi-datacenter federation, as it ensures that the WAN gossip pool remains connected even if a server restarts or a network partition occurs.

Answer

To sync secondary data.

Answer

To force a specific leader.

Answer

To rotate the encryption key.

Question 8

Which TWO of the following are prerequisites for successful WAN federation?

Accepted Answer

All datacenters must share the same 'primary_datacenter' setting.. WAN federation in Consul requires that every datacenter be configured with the same 'primary_datacenter' value (option A), because that setting identifies the authoritative datacenter for ACLs, intentions, and cross-datacenter operations, and a mismatch prevents proper federation. It also requires that Consul servers in each datacenter can reach the servers in other datacenters over the WAN gossip port 8302 (option E), since the WAN gossip pool is how servers exchange membership and routing information across datacenters. Option B is wrong because node names must be unique within a datacenter, not identical across datacenters. Option C is wrong because Consul clients only need to talk to servers in their own datacenter; cross-datacenter traffic is handled by the servers. Option D is wrong because WAN federation works across different subnets and networks as long as the required ports (8302 WAN gossip and 8300 server RPC) are reachable.

Answer

All datacenters must have identical node names.

Answer

Consul clients must be able to communicate directly with all remote servers.

Answer

All nodes must be in the same subnet.

Question 9

Which TWO statements are true regarding Consul Mesh Gateways?

Accepted Answer

They are required when direct WAN gossip is not possible between datacenters.. Option D is correct because a mesh gateway is the mechanism Consul uses to route service-to-service traffic between datacenters when the datacenters cannot communicate directly over WAN gossip, allowing cross-datacenter requests to be forwarded through a gateway rather than requiring a full mesh of WAN gossip connectivity. Option E is correct because Consul mesh gateways operate at Layer 7, proxying HTTP/gRPC (and other L7) traffic across datacenter boundaries and enabling features such as cross-datacenter intentions and traffic routing. Option A is not correct because mesh gateways do not replace Consul servers in a secondary datacenter; servers are still required to maintain the catalog and Raft state. Option B is not correct because mesh gateways do not increase LAN gossip latency; LAN gossip is a separate protocol used within a datacenter. Option C is not correct because mesh gateways are available in Consul open source and do not require a separate Consul Enterprise license.

Answer

They replace the need for Consul servers in the secondary datacenter.

Answer

They increase the latency of LAN gossip.

Answer

They require a separate Consul Enterprise license.

Question 10

Which command is used to check the health of the local agent?

Accepted Answer

consul info. The 'consul operator raft list-peers' or 'consul info' can provide information, but 'consul monitor' or checking the UI is more direct for health.

Answer

consul status

Answer

consul ping

Answer

consul get

Question 11

Which THREE configuration items are part of a complete WAN gossip setup?

Accepted Answer

The 'server' role flag set to true.. Option A is correct because a complete WAN gossip setup requires the 'server' role flag set to true so the agent participates as a server in the gossip protocol and can accept WAN federation traffic. Option B is correct because the 'join-wan' operation needs a list of remote server addresses (retry_join_wan or -join-wan) to establish the WAN gossip pool with other datacenters. Option D is correct because the 'encrypt' key (via encrypt or encrypt_verify_outgoing) secures gossip traffic with symmetric encryption, which is a standard part of a complete WAN gossip configuration. Option C is not required because restricting 'client_addr' to local only is a client interface binding choice, not a WAN gossip requirement. Option E is not required because enabling the 'ui' configuration only exposes the web UI and has no role in forming or securing the WAN gossip pool.

Answer

The 'client_addr' restricted to local only.

Answer

The 'ui' configuration set to true.

Question 12

When configuring an ACL policy for cross-datacenter access, what policy rule is necessary to read service information from a remote datacenter?

Accepted Answer

node_prefix "" { policy = "read" }. In Consul, cross-datacenter service discovery requires reading node information from the remote datacenter because services are registered to nodes. The node_prefix rule with read policy grants permission to read node data, which is necessary to resolve service instances in a remote datacenter. Without node read access, the catalog cannot return the nodes hosting the service, so service information remains inaccessible even if service read is allowed.

Answer

service_prefix "*" { policy = "write" }

Answer

agent_prefix "" { policy = "read" }

Answer

acl_prefix "" { policy = "read" }

Question 13

Which THREE factors influence cross-datacenter service discovery resolution?

Accepted Answer

The local server must have knowledge of the remote datacenter's server addresses.. Option A is correct because cross-datacenter service discovery requires the local server to know the addresses of servers in the remote datacenter, typically through a configured WAN federation or server-address list, so it can forward or resolve queries for remote services. Option C is correct because a valid WAN gossip link is the mechanism that propagates service and node information between datacenters; without an established WAN gossip pool, the local datacenter cannot learn about remote service registrations. Option E is correct because DNS queries must include the specific datacenter suffix (for example, service.service.dc1.consul or service.service.dc2.consul) to direct resolution to the intended remote datacenter rather than the local one. Option B is not required because services can be discovered across namespaces as long as the query and ACLs permit it, and namespace uniformity is not a prerequisite for cross-datacenter resolution. Option D is not required because service discovery queries are handled by the local agent and do not need superuser permissions; normal ACL tokens with read access are sufficient.

Answer

All services must be in the same namespace.

Answer

The local agent must have superuser permissions.

Question 14

Which THREE items are required when configuring ACL replication in Consul?

Accepted Answer

The 'acl_replication' configuration block enabled.. Option A is correct because ACL replication must be explicitly enabled in the Consul agent configuration via the acl_replication block (e.g., acl { enabled = true; default_policy = "deny"; enable_token_persistence = true } with replication configured), which activates the replication subsystem on secondary datacenters. Option C is correct because an acl_replication_token must be provided — this is a token with acl:write privileges in the primary datacenter that the secondary datacenter uses to authenticate and pull ACL data. Option E is correct because primary_datacenter must be set on the secondary datacenter's servers so they know which datacenter to replicate ACLs from. Option B is incorrect because a global root ACL token is not required on every client node; replication is a server-side operation and clients only need tokens to authenticate their own requests. Option D is incorrect because raft_protocol version 1 is unrelated to ACL replication and is not a valid requirement for configuring it.

Answer

A global root ACL token on every client node.

Answer

The 'raft_protocol' version set to 1.

Question 15

Which THREE items are included in the metadata shared via WAN gossip?

Accepted Answer

Datacenter identification.. In a WAN gossip pool (e.g., HashiCorp Consul's serf-based gossip), the metadata exchanged includes the datacenter identification (A), which lets nodes in different datacenters recognize which DC each member belongs to and is used for cross-DC awareness. It also includes the health status of participating server nodes (B), so failures and degraded members are detected cluster-wide via the gossip protocol's failure detector. Server node membership status (C) is likewise propagated, allowing nodes to join, leave, and be marked as failed or alive in the membership list. The full list of local service definitions (D) and the local KV store contents (E) are not gossiped over WAN; service registrations and KV data are replicated through the LAN gossip pool and the Raft-based catalog/KV replication mechanisms, not the WAN gossip layer.

Answer

The full list of local service definitions.

Answer

The local KV store contents.