A cross-datacenter service discovery request is failing. You observe the local datacenter can resolve the service via DNS, but the remote datacenter cannot. Which configuration parameter must be checked?
A company is setting up a new secondary datacenter (dc2) to federate with an existing primary datacenter (dc1). They want to ensure that the WAN federation is secure and that services in dc2 can discover services in dc1. Which two configurations are required to enable WAN federation and cross-datacenter service discovery? (Choose two.)
A Consul operator wants to join a new datacenter named 'dc2' to an existing datacenter 'dc1' using WAN federation. The servers in dc2 are started with retry_join_wan pointing to the LAN addresses of dc1's servers. However, the join fails and the logs show 'No installed keys could decrypt the message'. What is the most likely cause?
A Consul operator is planning to federate three datacenters: dc1, dc2, and dc3. They want to ensure that the WAN gossip encryption key is consistent across all datacenters. Where should the WAN gossip encryption key be configured?
Your organization runs Consul in two datacenters: dc1 (primary) and dc2 (secondary). ACLs are enabled with default_policy = "deny". You need to allow a service in dc2 to read a KV path that exists in dc1. Cross-datacenter KV reads are not working. What is the most likely cause?
You are deploying a new Consul secondary datacenter that must be able to forward DNS queries for the 'global' service to the primary datacenter. Which configuration on the servers in the new datacenter enables this behavior?
A Consul 1.15 operator is configuring a new datacenter to join an existing WAN federation. The existing datacenter has ACLs enabled, and the operator wants the new datacenter to replicate ACLs from the primary. Which two configuration items must be set on the new datacenter's servers to enable ACL replication? (Choose two.)
You are operating a Consul 1.15 cluster with three datacenters: dc1 (primary), dc2, and dc3. ACLs are enabled and replication is configured from dc1 to dc2 and dc3. You need to rotate the ACL replication token used by dc2 and dc3 without causing an outage. Which sequence of actions is correct?
A company operates Consul datacenters in three regions: us-east, eu-west, and ap-south. They want to enable ACL replication so that tokens and policies are consistent across all datacenters. The primary datacenter is us-east. Which configuration must be set on the servers in eu-west and ap-south to enable ACL replication?
You are designing a Consul deployment with a primary datacenter in us-east-1 and a secondary datacenter in eu-west-1. The operations team wants to ensure that if the primary datacenter becomes unreachable, the secondary datacenter can still authenticate services using ACLs and continue serving traffic. The secondary datacenter has been configured with acl_replication_token and is successfully replicating ACL data. However, after a primary failure, the secondary datacenter's ACLs stop working for new tokens. What is the most likely reason for this behavior?
You are using Consul 1.15 with ACLs enabled and have a primary datacenter (dc1) and a secondary datacenter (dc2). You want to replicate ACL policies and tokens from dc1 to dc2. Which configuration must be set on the Consul servers in dc2 to enable ACL replication?
An operator is configuring a secondary datacenter that must replicate ACL tokens and policies from a primary datacenter. The primary uses a bootstrap token stored in Vault, and the secondary's servers are provisioned by an automated pipeline. Which approach correctly supplies the replication credentials on the secondary servers?
You are configuring a Consul agent in a new datacenter to join the existing WAN gossip pool. The existing datacenter's servers are listening on port 8302. You set retry_join_wan to a list of those server addresses. After starting the agent, you notice that the WAN gossip pool is not forming. Which configuration parameter must also be set correctly?
You are setting up a new Consul datacenter that will join an existing WAN federation. Which TWO of the following are required to ensure secure and functional WAN gossip communication between the new datacenter and the existing one? (Choose two.)
You are deploying Consul 1.15 in a multi-datacenter environment with WAN federation. You need to ensure that the WAN gossip pool is properly secured and that datacenters can communicate. Which two configuration items must be set on all Consul servers across all datacenters to enable secure WAN federation? (Choose two.)
A Consul operator is configuring a secondary datacenter 'dc2' that will be federated with a primary datacenter 'dc1'. The operator wants to ensure that services in dc2 can discover services in dc1 using Consul's native DNS interface. Which configuration is required on the Consul agents in dc2 to enable cross-datacenter DNS lookups?
A network engineer is documenting what must be true for two Consul datacenters to operate as a federated pair with working cross-datacenter RPC and service discovery. Which two statements describe requirements or behaviors of WAN federation? (Choose two.)
You are designing a multi-datacenter Consul deployment with three datacenters: dc1 (primary), dc2, and dc3. You want to ensure that ACLs are enforced consistently across all datacenters and that service discovery works across datacenters. Which two actions are required to achieve this? (Choose two.)
You are designing a multi-datacenter Consul deployment with a primary datacenter in dc1 and a secondary in dc2. You need to ensure that service discovery and health checking continue to function in dc2 even if dc1 becomes completely unavailable. Which two configurations should you implement? (Choose two.)
A team is setting up a new Consul datacenter that will join an existing WAN federation. They need to configure the new datacenter's servers to communicate securely with the existing datacenter over the WAN. Which two configuration settings are required to establish WAN federation? (Choose two.)
You are using Consul 1.15 with three datacenters: dc1 (primary), dc2, and dc3. ACLs are enabled and replication is working. You need to decommission dc2 and ensure that its ACL tokens and policies are removed from the primary. What is the correct procedure?
A company is planning to deploy a new Consul datacenter in a different region and federate it with their existing datacenter. They want to ensure that WAN federation is secure and properly configured. Which two actions are necessary to securely federate the new datacenter? (Choose two.)
A company has Consul datacenters in three regions: us-east, us-west, and eu-central. They want to enable cross-datacenter service discovery and ensure that if the us-east datacenter becomes unavailable, the other datacenters can still communicate with each other. Which configuration is required to achieve this?
A platform engineer is enabling mesh gateway mode on a Consul 1.15 service mesh spanning two datacenters. The service 'payments' in dc1 must be reachable from 'checkout' in dc2, and the operator wants all cross-datacenter traffic to flow through a gateway that preserves the originating client identity for mTLS authorization. Which mesh gateway mode should be configured for the 'payments' service?
An operator manages a Consul 1.15 federation with a primary datacenter 'dc1' and a secondary datacenter 'dc2'. ACLs are enabled, and replication is working. The operator needs to grant a token in dc2 the ability to read service information from dc1 using the Consul CLI. Which ACL policy rule must be included in the token's policy to allow reading services in the remote datacenter?
A Consul 1.15 cluster is being configured for multi-datacenter federation. The operator wants to enable the built-in feature that allows services in one datacenter to discover services in another datacenter without additional proxies. Which configuration parameter must be set to true on the Consul servers to enable this capability?
A Consul 1.15 operator is troubleshooting a multi-datacenter setup where a service in dc2 cannot resolve a service in dc1 using the DNS interface. The operator runs 'dig @127.0.0.1 -p 8600 payments.service.dc1.consul' from a node in dc2 and receives NXDOMAIN. The service 'payments' is registered in dc1 and is healthy. Which configuration should the operator verify first to ensure cross-datacenter DNS resolution works?
You are troubleshooting a partition between two datacenters. The WAN gossip shows high latency. Which Consul CLI tool provides the best insight into the WAN gossip state?
You are joining two Consul datacenters via WAN gossip. Which command must be executed on a Consul server in the secondary datacenter to initiate the federation?
A platform team operates two Consul datacenters, dc1 (primary) and dc2 (secondary), with ACLs enabled. They have configured token replication using a replication token in dc2. After rotating the replication token in dc1, they update the configuration in dc2 and restart the Consul agents. However, ACL replication stops working and dc2 logs show 'Permission denied'. What is the most likely cause?
A platform team operates a Consul 1.15 cluster with a primary datacenter in us-east-1 and a secondary datacenter in eu-west-1. After configuring ACLs for replication, they update a token policy in the primary datacenter. A security engineer in the secondary datacenter immediately checks the ACL token and finds the old policy still in effect. What is the most likely reason the policy change has not propagated yet?
A company runs Consul 1.15 in three datacenters: dc1 (primary), dc2, and dc3 (secondaries). The operations team wants to ensure that if dc1 becomes unavailable, the remaining datacenters can still authenticate services using existing ACL tokens. They have already configured ACL replication and WAN federation. Which statement best describes the expected behavior of ACL tokens in dc2 and dc3 during a primary datacenter outage?
An operator is configuring a new Consul datacenter that must be able to resolve services in a remote datacenter using the DNS interface. The remote datacenter is already federated and reachable. Which query format should the operator use to resolve a service named 'web' in the remote datacenter 'dc2'?
A cloud engineer is setting up a new Consul 1.15 datacenter that will join an existing WAN federation. The existing datacenter uses a specific gossip encryption key for the WAN pool. Which configuration parameter must be set on the new datacenter's servers to ensure they can participate in WAN gossip?
You are configuring a new Consul datacenter named 'dc2' to join an existing WAN federation with primary datacenter 'dc1' that uses mesh gateways. The WAN is not directly routable between datacenters. Which configuration allows dc2's servers to establish WAN federation through the mesh gateways?
You are deploying a new Consul datacenter and need to configure the servers to join the existing WAN gossip pool. Which configuration parameter should you set on the new servers to specify the addresses of the existing WAN servers?
A platform team operates two Consul datacenters, 'dc1' and 'dc2', and wants operators in dc2 to resolve service names registered in dc1 without a full mesh of local agents. They have already used 'consul join -wan' to link the server agents. Which feature should they rely on for DNS lookups of remote services?
You are deploying Consul servers in a new datacenter that will be a secondary in a federated environment. The primary datacenter is already configured with ACLs enabled and replication is working. You need to ensure the new secondary datacenter can replicate ACLs from the primary. Which configuration must be set on the new secondary's servers?
A Consul operator wants to ensure that if the primary datacenter becomes unavailable, the secondary datacenter can continue to operate for existing services and intentions. Which statement best describes Consul's behavior in this scenario?
A company runs a primary datacenter and a secondary datacenter with ACL replication enabled. During a maintenance window the primary's servers are taken offline for several hours while the secondary remains fully operational. What is the expected behavior in the secondary during the outage?
You are configuring a new Consul datacenter in a multi-datacenter federation. The datacenter must be able to join the existing WAN gossip pool and participate in cross-datacenter service discovery. Which two configuration settings are required on the new datacenter's Consul servers to enable WAN gossip and ensure secure communication? (Choose two.)
You are configuring a Consul secondary datacenter to replicate ACLs from the primary. You have set 'primary_datacenter' and 'acl_replication_token' on the servers. However, replication is failing. Which of the following is the most likely cause?
You have a Consul 1.15 cluster with two datacenters, dc1 and dc2, federated via WAN gossip. You want to use a prepared query to automatically failover to a service in dc2 if the service in dc1 becomes unhealthy. Which configuration in the prepared query is required to achieve this?
You are managing a multi-datacenter Consul deployment with ACLs enabled. The primary datacenter is in dc1, and a secondary datacenter is in dc2. You have configured ACL replication in dc2 using acl_replication_token. After some time, you notice that new ACL tokens created in dc1 are not being replicated to dc2, and the replication status shows 'No known leader'. What is the most likely cause of this issue?
A new engineer is configuring a Consul server agent for a datacenter named 'west' and wants the agent to automatically rejoin the WAN federation after a restart without manual intervention. Which configuration setting should they use?
You are deploying a Consul cluster across three datacenters: dc1, dc2, and dc3. Each datacenter has its own LAN gossip pool and they are all joined via WAN gossip. You want to enable cross-datacenter service discovery so that services in dc1 can discover services in dc2 and dc3. Which Consul feature allows a service in one datacenter to query services in another datacenter without additional configuration?
You are using Consul's DNS interface to query a service named 'web' in datacenter dc2 from a client in dc1. The query returns no results, but you know the service is running in dc2. What is the most likely reason?
An operator is troubleshooting a Consul datacenter that was recently federated with another datacenter. They notice that cross-datacenter service discovery works, but ACL tokens created in the primary datacenter are not being recognized in the secondary datacenter. What is the most likely cause?
An operator has two Consul datacenters, 'dc1' and 'dc2', federated via WAN gossip. They want to query the health of a service named 'web' in dc2 from a Consul agent in dc1 using the HTTP API. Which endpoint should they use?
A Consul 1.15 cluster spans three datacenters: dc1 (primary), dc2, and dc3. The operations team wants to enable cross-datacenter service discovery for a service named 'web' that is deployed in all datacenters. They configure a prepared query with a failover policy. Which statement accurately describes how the failover block in the prepared query affects query results when the local datacenter's 'web' service has no healthy instances?
An operator is configuring a new Consul 1.15 datacenter 'dc3' to join an existing WAN federation with primary datacenter 'dc1'. The operator wants to ensure that dc3 can automatically rejoin the WAN gossip pool after a restart. Which configuration parameter should be set in dc3's server configuration?