Consul 1.15 Multi Datacenter Federation Practice Test 3 — 15 Questions

Question 1

You are deploying Consul 1.15 in a multi-datacenter environment with WAN federation. You need to ensure that the WAN gossip pool is properly secured and that datacenters can communicate. Which two configuration items must be set on all Consul servers across all datacenters to enable secure WAN federation? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

encrypt. To secure WAN federation, all servers in all datacenters must share the same gossip encryption key via the encrypt parameter and enable TLS verification for outgoing connections with verify_outgoing. These settings ensure that gossip and RPC traffic are encrypted and authenticated across datacenters.

Answer

primary_datacenter

Answer

retry_join_wan

Answer

acl.tokens.replication

Question 2

A Consul operator is configuring a secondary datacenter 'dc2' that will be federated with a primary datacenter 'dc1'. The operator wants to ensure that services in dc2 can discover services in dc1 using Consul's native DNS interface. Which configuration is required on the Consul agents in dc2 to enable cross-datacenter DNS lookups?

Accepted Answer

Configure 'retry_join_wan' with dc1's server addresses and ensure the 'domain' setting is consistent across datacenters.. Cross-datacenter DNS lookups require the secondary datacenter to be federated with the primary via WAN gossip using retry_join_wan. The DNS domain must be consistent across datacenters so that queries for services in the remote datacenter resolve correctly. Once federated, queries like 'web.service.dc1.consul' will be answered by the local Consul servers, which forward the request to the appropriate datacenter if needed.

Answer

Set 'enable_truncate' to true on all dc2 agents to allow DNS responses from remote datacenters.

Answer

Set the 'recursors' configuration to point to dc1's Consul servers.

Answer

Add a 'dns_config' stanza with 'recursor_timeout' set to a value greater than 5 seconds.

Question 3

A network engineer is documenting what must be true for two Consul datacenters to operate as a federated pair with working cross-datacenter RPC and service discovery. Which two statements describe requirements or behaviors of WAN federation? (Choose two.)

Accepted Answer

Server agents in each datacenter communicate over the WAN gossip pool on port 8302, and this pool is separate from the LAN gossip pool inside each datacenter.. Federation depends on server agents forming a dedicated WAN gossip pool and being able to open RPC connections to peer servers, with consistent TLS material when encryption is used. Client agents stay in their LAN pools and rely on local servers for remote lookups. KV data remains per-datacenter, and datacenter names must be unique across the federation for routing to work.

Answer

The datacenter name must be unique only within a LAN gossip pool, so two datacenters may share the same name as long as their LAN segments differ.

Answer

Every client agent in each datacenter must join the WAN gossip pool so that remote service lookups can be answered locally.

Answer

The KV store is automatically replicated to every federated datacenter so that key reads are always local.

Question 4

You are designing a multi-datacenter Consul deployment with three datacenters: dc1 (primary), dc2, and dc3. You want to ensure that ACLs are enforced consistently across all datacenters and that service discovery works across datacenters. Which two actions are required to achieve this? (Choose two.)

Accepted Answer

Set `acl_replication_token` on all servers in dc2 and dc3 with a token that has `acl:read` permissions in dc1.. To achieve consistent ACL enforcement and cross-datacenter service discovery, you must configure `primary_datacenter` on all servers to point to the primary datacenter, and set `acl_replication_token` on the servers in the secondary datacenters. These two actions enable ACL replication, which ensures that ACL policies and tokens are synchronized across datacenters. WAN federation must also be established, but that is a prerequisite. The combination of `primary_datacenter` and the replication token is essential for ACL consistency.

Answer

Configure `retry_join_wan` on all servers to include at least one server from each other datacenter.

Answer

Set `acl_default_policy` to `allow` on all servers to ensure that ACLs do not block service discovery.

Answer

Enable `translate_wan_addrs` on all agents in dc2 and dc3 to ensure proper address translation for cross-datacenter communication.

Question 5

You are designing a multi-datacenter Consul deployment with a primary datacenter in dc1 and a secondary in dc2. You need to ensure that service discovery and health checking continue to function in dc2 even if dc1 becomes completely unavailable. Which two configurations should you implement? (Choose two.)

Accepted Answer

Run a full set of Consul servers in dc2 with its own LAN gossip pool and local ACL policies replicated from dc1.. To maintain service discovery and health checking in dc2 during a dc1 outage, you need local servers in dc2 that can operate independently, and you should configure prepared queries with failover to dc2 for critical services. Local servers ensure that the datacenter's state is available, and prepared queries provide a mechanism for cross-datacenter failover when services in the primary are unreachable.

Answer

Set acl_default_policy to allow on all agents in dc2 to bypass ACL checks during a primary outage.

Answer

Configure dc2 to use dc1 as its only DNS resolver for service lookups.

Answer

Configure the WAN gossip pool to elect a new primary datacenter automatically when dc1 fails.

Question 6

A team is setting up a new Consul datacenter that will join an existing WAN federation. They need to configure the new datacenter's servers to communicate securely with the existing datacenter over the WAN. Which two configuration settings are required to establish WAN federation? (Choose two.)

Accepted Answer

encrypt with the same gossip encryption key used in the existing datacenter. WAN federation requires that new datacenter servers can discover and communicate with the existing WAN gossip pool. retry_join_wan provides the necessary contact points, and a shared gossip encryption key ensures secure and compatible gossip communication. Other settings like primary_datacenter and TLS are important for ACLs and security but are not part of the core WAN gossip federation requirements.

Answer

verify_outgoing enabled with the same CA certificate as the existing datacenter

Answer

primary_datacenter set to the name of the existing datacenter

Answer

server set to true on all nodes that will participate in the WAN gossip pool

Question 7

You are using Consul 1.15 with three datacenters: dc1 (primary), dc2, and dc3. ACLs are enabled and replication is working. You need to decommission dc2 and ensure that its ACL tokens and policies are removed from the primary. What is the correct procedure?

Accepted Answer

In dc2, run consul leave, then in dc1 delete the ACL token that was used for replication if it is no longer needed.. Decommissioning a secondary datacenter involves gracefully leaving the cluster from that datacenter, then cleaning up the replication token in the primary if it is no longer required. Replicated ACL data is stored locally in the secondary and does not need to be removed from the primary.

Answer

In dc2, run consul leave, then in dc1 delete all ACL tokens and policies that were replicated from dc2.

Answer

In dc2, disable ACL replication, then in dc1 delete the replication token used by dc2.

Answer

In dc2, run consul leave, then in dc1 delete the ACL token that was used for replication and any policies specific to dc2.

Question 8

A company is planning to deploy a new Consul datacenter in a different region and federate it with their existing datacenter. They want to ensure that WAN federation is secure and properly configured. Which two actions are necessary to securely federate the new datacenter? (Choose two.)

Accepted Answer

Configure 'retry_join_wan' on the new datacenter's servers to point to the existing datacenter's servers.. Secure WAN federation requires a shared gossip encryption key across all servers in both datacenters to encrypt and decrypt gossip messages. Additionally, the new datacenter's servers must be configured with retry_join_wan to join the existing datacenter's WAN gossip pool. These two actions are essential for establishing federation. Other security measures like TLS are recommended but not strictly necessary for the federation to function.

Answer

Ensure that all servers have the same 'datacenter' configuration value.

Answer

Enable TLS for RPC communication between servers and clients.

Answer

Set the same 'encrypt_verify_incoming' and 'encrypt_verify_outgoing' values on all servers.

Question 9

A company has Consul datacenters in three regions: us-east, us-west, and eu-central. They want to enable cross-datacenter service discovery and ensure that if the us-east datacenter becomes unavailable, the other datacenters can still communicate with each other. Which configuration is required to achieve this?

Accepted Answer

All datacenters must share the same gossip encryption key and be configured with retry_join_wan to at least one other datacenter.. To enable WAN federation across multiple datacenters, all servers must use the same gossip encryption key so they can securely exchange gossip messages. Each datacenter must join the WAN pool by contacting at least one server in another datacenter via retry_join_wan. Once joined, gossip membership is shared, allowing all datacenters to communicate. If one datacenter becomes unavailable, the remaining datacenters can still communicate as long as the WAN pool remains connected.

Answer

Each datacenter must be configured with retry_join_wan pointing to at least one server in each of the other datacenters.

Answer

Each datacenter must be configured with the same primary_datacenter value and acl_replication_token.

Answer

Each datacenter must have a unique gossip encryption key and use retry_join_wan to connect to a central datacenter.

Question 10

A platform engineer is enabling mesh gateway mode on a Consul 1.15 service mesh spanning two datacenters. The service 'payments' in dc1 must be reachable from 'checkout' in dc2, and the operator wants all cross-datacenter traffic to flow through a gateway that preserves the originating client identity for mTLS authorization. Which mesh gateway mode should be configured for the 'payments' service?

Accepted Answer

local. Local mesh gateway mode ensures that outbound cross-datacenter traffic exits through a gateway in the source datacenter. This preserves the originating client's mTLS identity, which is critical when authorization policies depend on the client's identity. Remote mode would terminate and re-originate the connection, losing that identity. The other listed values are either invalid or disable gateway routing, so local is the correct choice.

Answer

none

Answer

direct

Answer

remote

Question 11

An operator manages a Consul 1.15 federation with a primary datacenter 'dc1' and a secondary datacenter 'dc2'. ACLs are enabled, and replication is working. The operator needs to grant a token in dc2 the ability to read service information from dc1 using the Consul CLI. Which ACL policy rule must be included in the token's policy to allow reading services in the remote datacenter?

Accepted Answer

service:read with a datacenter specification for the remote datacenter. Consul ACL policies support a datacenter field to scope rules to a specific datacenter. When a token in a secondary datacenter needs to read services in the primary datacenter, the policy must include a service:read rule with datacenter set to the remote datacenter's name. Without this explicit scoping, the rule applies only locally. Node and KV rules do not grant service catalog access, so they are irrelevant.

Answer

key:read with a prefix matching the service name

Answer

service:read with a wildcard service name and no datacenter specification

Answer

node:read with a wildcard node name

Question 12

A Consul 1.15 cluster is being configured for multi-datacenter federation. The operator wants to enable the built-in feature that allows services in one datacenter to discover services in another datacenter without additional proxies. Which configuration parameter must be set to true on the Consul servers to enable this capability?

Accepted Answer

translate_wan_addrs. The translate_wan_addrs parameter, when enabled, ensures that service addresses returned in cross-datacenter queries are translated from LAN to WAN addresses. This is essential for services in one datacenter to reach services in another, as LAN addresses are not routable across datacenters. Other parameters like connect.enabled or recursor serve different purposes and do not enable cross-datacenter discovery.

Answer

enable_central_service_config

Answer

connect.enabled

Answer

recursor

Question 13

A Consul 1.15 operator is troubleshooting a multi-datacenter setup where a service in dc2 cannot resolve a service in dc1 using the DNS interface. The operator runs 'dig @127.0.0.1 -p 8600 payments.service.dc1.consul' from a node in dc2 and receives NXDOMAIN. The service 'payments' is registered in dc1 and is healthy. Which configuration should the operator verify first to ensure cross-datacenter DNS resolution works?

Accepted Answer

The 'primary_datacenter' setting and WAN federation status. Cross-datacenter DNS resolution requires that the datacenters are federated and that the primary_datacenter setting is correctly configured. If dc2 is not properly joined to dc1, queries for dc1 services will return NXDOMAIN. The operator should first verify WAN federation status and the primary_datacenter configuration. Other settings like recursors or ports.dns are not directly related to resolving internal cross-datacenter service names.

Answer

The 'ports.dns' setting in dc2's Consul configuration

Answer

The 'datacenter' parameter in dc2's Consul configuration

Answer

The 'recursors' setting in dc2's Consul configuration

Question 14

Which protocol do Consul servers use to maintain the WAN gossip pool?

Accepted Answer

Serf (SWIM). Consul servers use the Serf library, which implements the SWIM gossip protocol, to maintain the WAN gossip pool across datacenters. Serf handles membership, failure detection, and lightweight message dissemination over UDP/TCP. This is distinct from Raft, which handles consensus for the replicated state.

Answer

gRPC

Answer

DNS

Answer

HTTP

Question 15

In a multi-datacenter environment, what happens if the 'primary_datacenter' server cluster becomes unavailable?

Accepted Answer

Secondary datacenters continue to operate, but ACL updates are blocked.. In Consul's multi-datacenter model, the primary datacenter is authoritative for ACL token replication and certain global operations. If the primary becomes unavailable, secondary datacenters continue serving their local services and DNS/HTTP queries, but ACL updates and token replication are blocked until the primary returns. This design prioritizes availability of local service discovery over global consistency.

Answer

Secondary datacenters elect a new primary.

Answer

All secondary datacenters immediately shut down.

Answer

The entire WAN federation is dismantled.