Consul 1.15 Multi Datacenter Federation Practice Test 4 — 15 Questions

Question 1

You have enabled ACL replication between a primary and secondary datacenter. What is the effect of changing an ACL policy in the primary datacenter?

Accepted Answer

The changes are asynchronously replicated to all secondary datacenters.. Consul ACL replication from a primary datacenter to secondary datacenters is asynchronous by design. When an ACL policy, token, or role is modified in the primary, the change is queued and replicated to all secondaries without manual intervention, though there may be a short propagation delay. This matches the documented behavior of the `acl-replication` mechanism.

Answer

The changes only propagate if the secondary is in maintenance mode.

Answer

The changes require a manual trigger on secondary servers.

Answer

The changes are ignored by secondary datacenters.

Question 2

You are troubleshooting a partition between two datacenters. The WAN gossip shows high latency. Which Consul CLI tool provides the best insight into the WAN gossip state?

Accepted Answer

consul members -wan. The consul members -wan command lists all members of the WAN gossip pool, showing their status, address, port, protocol, and build. It is the primary CLI tool for inspecting the health and membership of the WAN gossip layer that connects datacenters in a federation. High latency or partition issues in WAN gossip will be visible as failed or left members in this output, making it the best diagnostic choice.

Answer

consul operator raft list-peers

Answer

consul monitor

Answer

consul kv get

Question 3

How do you enable WAN federation between two Consul datacenters that do not share a network?

Accepted Answer

By deploying Mesh Gateways.. Mesh Gateways are the correct solution for enabling WAN federation between datacenters that do not share a network, such as when they are behind NAT or firewalls with no direct WAN gossip connectivity. Mesh gateways relay WAN gossip and service traffic over the LAN, allowing federation without direct server-to-server WAN links. This is the standard Consul pattern for isolated datacenters.

Answer

By disabling ACLs.

Answer

By increasing the gossip interval.

Answer

By using a load balancer in front of the servers.

Question 4

You are joining two Consul datacenters via WAN gossip. Which command must be executed on a Consul server in the secondary datacenter to initiate the federation?

Accepted Answer

consul join -wan <remote-server-address>. The consul join -wan command is used to join a Consul server to the WAN gossip pool of another datacenter. It must be executed on a server in the secondary datacenter, specifying the address of a remote server in the primary datacenter. This establishes the WAN federation, allowing cross-datacenter communication.

Answer

consul members -wan

Answer

consul reload -wan

Answer

consul agent -join-wan

Question 5

What is the role of a Consul server in a non-primary datacenter regarding ACLs?

Accepted Answer

They replicate the ACL state from the primary.. In a multi-datacenter Consul deployment, ACL state is authoritative only in the primary datacenter. Non-primary datacenters, including their servers, do not accept ACL writes; instead, they replicate the ACL state (tokens, policies, roles, and bindings) from the primary datacenter. This ensures a single source of truth for ACLs and prevents conflicting policies across datacenters. The replication is one-way, from primary to secondary, and is performed by the Consul servers in the secondary datacenter.

Answer

They ignore all ACLs.

Answer

They can write new ACL policies independently.

Answer

They become the primary if the original primary fails.

Question 6

What is the purpose of the 'datacenter' field in the Consul agent configuration?

Accepted Answer

To segment the cluster into logical datacenters.. The 'datacenter' field in the Consul agent configuration assigns the agent to a named logical datacenter, which segments the cluster into independent failure domains. Each datacenter has its own LAN gossip pool, its own Raft consensus group of servers, and its own catalog and KV store. Agents in different datacenters communicate only through the WAN gossip pool and cross-datacenter RPC, not through the LAN pool.

Answer

To limit the number of clients.

Answer

To enable encryption.

Answer

To identify the node for metrics.

Question 7

What happens to the gossip protocol if the 'encrypt' key is mismatched between two datacenters trying to join via WAN?

Accepted Answer

The join fails.. If the gossip encryption key ('encrypt' for LAN or 'encrypt_wan' for WAN) is mismatched between two datacenters attempting to join via WAN, the join fails because Serf cannot decrypt the gossip messages from the remote cluster. Encryption keys must match exactly for the WAN gossip pool to form. There is no fallback to unencrypted communication.

Answer

The join proceeds with warnings.

Answer

The connection defaults to unencrypted.

Answer

Only metadata is encrypted.

Question 8

When configuring ACL replication, where must the 'acl_replication_token' be defined?

Accepted Answer

In the secondary datacenter's server agents.. ACL replication flows from the primary datacenter to secondary datacenters, and the token that authorizes this replication must be configured on the server agents in the secondary datacenter. The secondary servers use this token to authenticate to the primary and pull ACL data. Client agents do not perform ACL replication, so the token is not needed there.

Answer

In the primary datacenter's client agents.

Answer

In the Consul Enterprise license file.

Answer

On all nodes in both datacenters.

Question 9

You want to ensure that specific services in a remote datacenter are only accessible to certain local services. How can you achieve this?

Accepted Answer

Use Consul Intentions.. Consul Intentions define allow/deny rules for service-to-service communication, including across datacenters. They are the correct mechanism to restrict access to specific services in a remote datacenter based on the source service's identity.

Answer

Use firewall rules on all nodes.

Answer

Modify DNS resolution.

Answer

Use ACL tokens.

Question 10

When using 'prepared_queries' for cross-datacenter failover, what does the 'failover' block allow you to specify?

Accepted Answer

A list of datacenters to attempt for service resolution.. The failover block in a prepared query specifies a list of datacenters to attempt for service resolution when the local datacenter has no healthy instances. This enables cross-datacenter failover by defining an ordered fallback list. It does not control timeouts, encryption, or retry counts.

Answer

The timeout for the WAN gossip.

Answer

The encryption algorithm for failover traffic.

Answer

The number of retries per node.

Question 11

Which file format is used for Consul configuration?

Accepted Answer

HCL or JSON. Consul accepts configuration in either HCL or JSON format. HCL is the more human-readable format used in most examples, while JSON is supported for programmatic generation and legacy compatibility. Both are parsed into the same configuration structure.

Answer

INI

Answer

YAML

Answer

XML

Question 12

What is the benefit of using a Mesh Gateway in a multi-datacenter deployment with overlapping IP space?

Accepted Answer

It allows cross-datacenter traffic without routing overlapping networks.. A mesh gateway in Consul enables service-to-service communication across datacenters by routing traffic through a gateway that terminates and re-originates the connection, rather than relying on direct IP routing between datacenters. This is essential when two datacenters have overlapping CIDR ranges, because the mesh gateway provides a single, routable entry point that abstracts the underlying overlapping addresses. Without it, Consul's native cross-datacenter routing (which uses the remote datacenter's IPs) would fail due to routing conflicts.

Answer

It reduces the server memory usage.

Answer

It eliminates the need for ACLs.

Answer

It increases the gossip speed.

Question 13

To verify if two datacenters are connected via WAN, which command shows the remote datacenter's server nodes?

Accepted Answer

consul members -wan. The `consul members -wan` command queries the WAN gossip pool and lists all Consul servers across every datacenter that are federated via the WAN. It shows the remote datacenter's server nodes, confirming WAN connectivity. This is the only command that explicitly targets the WAN gossip layer, which is used for cross-datacenter communication.

Answer

consul members

Answer

consul info

Answer

consul operator raft list-peers

Question 14

You notice that the KV store is not consistent across datacenters. What is the cause?

Accepted Answer

KV store is datacenter-local by design.. Consul's KV store is datacenter-local by design — each datacenter maintains its own independent KV namespace with no automatic replication to peer datacenters. When you write a key in dc1, it does not appear in dc2 unless you explicitly write it there or use a tool like consul-replicate. This is expected behaviour, not a fault.

Answer

The Raft protocol is broken.

Answer

The ACL token lacks the 'write' permission.

Answer

The WAN gossip is disabled.

Question 15

When joining a new datacenter to an existing WAN pool, what is the best practice for server versions?

Accepted Answer

Versions should be consistent across all datacenters.. Consul best practice is to keep server versions consistent across all datacenters in a WAN pool. Version skew can cause protocol incompatibilities, inconsistent behavior, and upgrade complications, so the official guidance is to run the same version everywhere. This is why option C is correct.

Answer

The new DC must run a newer version.

Answer

The new DC must run an older version.

Answer

Version doesn't matter at all.