Consul 1.15 Multi Datacenter Federation Practice Test 5 — 15 Questions

Question 1

When using multiple datacenters, what is the primary role of the 'consul-template' tool?

Accepted Answer

To generate configuration files based on Consul data.. consul-template is a daemon that watches Consul for changes (KV pairs, services, health checks) and renders configuration files from templates, optionally running commands when files change. Its primary role is dynamic configuration generation based on Consul data, commonly used to configure HAProxy, Nginx, or Vault. It does not provision infrastructure or manage the cluster.

Answer

To provision infrastructure.

Answer

To replicate KV stores.

Answer

To manage the Consul cluster nodes.

Question 2

What is the recommended number of Consul servers per datacenter to ensure high availability?

Accepted Answer

3. The recommended number of Consul servers per datacenter for high availability is three, because it allows the cluster to tolerate the failure of one server while maintaining quorum. Consul uses the Raft consensus algorithm, which requires a majority of servers to be available for writes. With three servers, a single failure leaves two servers, still a majority, so the cluster remains operational.

Answer

2

Answer

1

Answer

10

Question 3

Which TWO of the following accurately describe Consul's WAN gossip protocol behavior?

Accepted Answer

It involves only the server nodes of each datacenter.. Option A is correct because Consul's WAN gossip pool is formed exclusively by the server nodes from each datacenter, which federate across datacenters; client agents do not participate in the WAN gossip. Option C is correct because the WAN gossip protocol is specifically tuned for higher latency and lower bandwidth conditions typical of cross-datacenter links, unlike the LAN gossip pool that assumes low-latency local networks. Option B is not correct because Consul's WAN gossip uses a full-mesh among servers rather than a central hub-and-spoke topology. Option D is not correct because client nodes only join the LAN gossip pool within their own datacenter, not the WAN pool. Option E is not correct because service discovery relies on the catalog and DNS/HTTP interfaces, not on the WAN gossip protocol being mandatory.

Answer

It relies on a central hub-and-spoke architecture.

Answer

It includes all client nodes in the gossip pool.

Answer

It is mandatory for service discovery.

Question 4

Which TWO of the following are true about Consul datacenters?

Accepted Answer

Each datacenter must have at least one server node.. Option A is correct because every Consul datacenter requires at least one server node to form the Raft quorum and maintain the catalog, since servers are the only agents that participate in the consensus protocol and store cluster state. Option C is correct because a Consul datacenter is defined as a group of nodes that are expected to have low-latency, high-bandwidth connectivity to each other, which is why datacenters are typically mapped to a single network region or availability zone. Option B is incorrect because a datacenter in Consul is a logical grouping, not strictly a physical location, and can span or subdivide physical sites. Option D is incorrect because each datacenter maintains its own independent Raft quorum; servers in different datacenters do not share a single quorum. Option E is incorrect because a single Consul agent belongs to exactly one datacenter and cannot join multiple datacenters simultaneously.

Answer

They are strictly physical locations.

Answer

They must share the same Raft quorum.

Answer

They allow a single Consul agent to join multiple DCs.

Question 5

Which THREE network considerations are vital for Consul WAN federation?

Accepted Answer

Sufficient bandwidth for gossip heartbeat messages.. Option A is correct because Consul WAN federation relies on the gossip protocol (Serf) to exchange heartbeat messages between datacenter servers, and insufficient bandwidth can cause missed heartbeats, false failures, and instability in the federated cluster. Option D is correct because WAN gossip uses port 8302 over both TCP and UDP, so firewall rules must permit both protocols on that port for servers in different datacenters to communicate. Option E is correct because WAN federation fundamentally requires that server nodes in each datacenter can reach server nodes in the other datacenters, typically over the WAN gossip port and the server RPC port (8300), to join and maintain the federation. Option B is not required because each datacenter can use its own independent NAT or network egress; a shared NAT gateway is not a Consul WAN federation requirement. Option C is not required because while consistent MTU can help avoid fragmentation issues, Consul does not mandate uniform MTU settings across regions for WAN federation to function.

Answer

A shared NAT gateway for all datacenters.

Answer

Uniform MTU settings across all regions.

Question 6

Which TWO of the following are valid ways to troubleshoot inter-datacenter communication issues?

Accepted Answer

Inspect server logs for RPC errors between datacenters.. Option B is correct because inter-datacenter communication in Consul relies on the WAN gossip pool and RPC forwarding between servers, so inspecting server logs for RPC errors (such as failed RPCs to remote datacenters or WAN gossip issues) is a valid diagnostic step to identify connectivity or federation problems. Option D is correct because 'consul members -wan' lists the members of the WAN gossip pool, allowing you to verify that servers in remote datacenters are visible and participating in cross-datacenter communication. Option A is not a valid troubleshooting method because changing the datacenter name alters the identity of the cluster and would break existing federation rather than diagnose it. Option C is not appropriate because restarting all clients does not address server-to-server WAN communication and could cause unnecessary disruption. Option E is incorrect because 'consul kv export' only exports key/value data and does not test or repair inter-datacenter connectivity.

Answer

Change the datacenter name in the config.

Answer

Restart all clients in the datacenter.

Answer

Use 'consul kv export' to sync data.

Question 7

A platform team operates two Consul datacenters, dc1 (primary) and dc2 (secondary), with ACLs enabled. They have configured token replication using a replication token in dc2. After rotating the replication token in dc1, they update the configuration in dc2 and restart the Consul agents. However, ACL replication stops working and dc2 logs show 'Permission denied'. What is the most likely cause?

Accepted Answer

The new replication token must be created in the primary datacenter and have read permissions on ACLs, then configured in dc2.. ACL token replication in Consul allows secondary datacenters to mirror ACL data from the primary. The replication token must be created in the primary datacenter with read permissions on ACL resources. After rotating the token, the old token becomes invalid, leading to permission errors in the secondary. Updating the secondary's configuration with a valid token from the primary restores replication.

Answer

The replication token must be configured in both dc1 and dc2 under acl.tokens.replication.

Answer

The replication token must be a management token with acl:write permissions in the primary datacenter.

Answer

The replication token in dc2 must match the token used in dc1's acl.tokens.replication configuration.

Question 8

A platform team operates a Consul 1.15 cluster with a primary datacenter in us-east-1 and a secondary datacenter in eu-west-1. After configuring ACLs for replication, they update a token policy in the primary datacenter. A security engineer in the secondary datacenter immediately checks the ACL token and finds the old policy still in effect. What is the most likely reason the policy change has not propagated yet?

Accepted Answer

The secondary datacenter has not yet received the updated policy because ACL replication is asynchronous and may take time to propagate.. ACL replication between datacenters is asynchronous, so changes made in the primary datacenter are not instantly visible in secondary datacenters. The security engineer checked before the next replication cycle, which explains why the old policy was still in effect. The other options describe mechanisms that are not part of Consul's ACL replication model.

Answer

ACL replication only works in one direction from secondary to primary, so changes made in the primary are not replicated.

Answer

The secondary datacenter must be restarted to pick up the new ACL policy from the primary datacenter.

Answer

The updated policy must be manually copied to each secondary datacenter using the consul acl policy create command.

Question 9

A company runs Consul 1.15 in three datacenters: dc1 (primary), dc2, and dc3 (secondaries). The operations team wants to ensure that if dc1 becomes unavailable, the remaining datacenters can still authenticate services using existing ACL tokens. They have already configured ACL replication and WAN federation. Which statement best describes the expected behavior of ACL tokens in dc2 and dc3 during a primary datacenter outage?

Accepted Answer

Existing ACL tokens in dc2 and dc3 continue to work for authorization because the replicated ACL data is stored locally.. ACL replication stores a local copy of ACL data in each secondary datacenter. During a primary outage, secondary datacenters can continue to authorize requests using the replicated tokens and policies. New token creation in secondaries is not replicated back to the primary, but existing tokens remain valid for local authorization.

Answer

ACL tokens in dc2 and dc3 continue to work, but only for read operations, because write operations require primary approval.

Answer

New ACL tokens can still be created in dc2 and dc3 during the outage, and they will be automatically synchronized back to dc1 when it recovers.

Answer

ACL tokens in dc2 and dc3 immediately become invalid because the primary datacenter is the only place that can validate tokens.

Question 10

An operator is configuring a new Consul datacenter that must be able to resolve services in a remote datacenter using the DNS interface. The remote datacenter is already federated and reachable. Which query format should the operator use to resolve a service named 'web' in the remote datacenter 'dc2'?

Accepted Answer

web.service.dc2.consul. Consul DNS encodes the datacenter as a label positioned directly after the 'service' label. The canonical form is .service..consul. Other label orders or query parameters are not recognized by the DNS interface, so only the format with the datacenter immediately following 'service' will trigger a WAN-forwarded lookup to the remote catalog.

Answer

dc2.web.service.consul

Answer

web.service.consul?dc=dc2

Answer

web.dc2.service.consul

Question 11

A cloud engineer is setting up a new Consul 1.15 datacenter that will join an existing WAN federation. The existing datacenter uses a specific gossip encryption key for the WAN pool. Which configuration parameter must be set on the new datacenter's servers to ensure they can participate in WAN gossip?

Accepted Answer

encrypt. The encrypt parameter sets the gossip encryption key. For WAN gossip to function between datacenters, all servers in the WAN pool must use the same encryption key. Configuring encrypt on the new datacenter's servers with the existing key allows them to securely join the WAN gossip pool.

Answer

primary_datacenter

Answer

acl_replication_token

Answer

retry_join_wan

Question 12

You are configuring a new Consul datacenter named 'dc2' to join an existing WAN federation with primary datacenter 'dc1' that uses mesh gateways. The WAN is not directly routable between datacenters. Which configuration allows dc2's servers to establish WAN federation through the mesh gateways?

Accepted Answer

Set primary_gateways in dc2's server configuration to the addresses of dc1's mesh gateways and enable connect.enable_mesh_gateways on both datacenters.. WAN federation through mesh gateways requires setting primary_gateways on the secondary datacenter's servers to the primary's mesh gateway addresses, and enabling mesh gateways in both datacenters. This lets the secondary servers form the WAN gossip pool and perform RPCs over the gateways when direct WAN routing is unavailable.

Answer

Set retry_join_wan in dc2's servers to the private IPs of dc1's servers and enable connect.enable_mesh_gateways only on dc2.

Answer

Configure dc2's servers with retry_join_wan pointing to dc1's server LAN addresses and set acl.tokens.default to the replication token.

Answer

Enable connect.enable_mesh_gateways on dc2 and set primary_datacenter to dc1, then use the consul join -wan command with dc1's mesh gateway addresses.

Question 13

You are deploying a new Consul datacenter and need to configure the servers to join the existing WAN gossip pool. Which configuration parameter should you set on the new servers to specify the addresses of the existing WAN servers?

Accepted Answer

`retry_join_wan`. To join a new datacenter to an existing WAN gossip pool, you must configure `retry_join_wan` on the servers in the new datacenter. This parameter accepts a list of addresses of servers in other datacenters. The agent will continuously attempt to join the WAN pool using these addresses, providing resilience. This is the standard method for WAN federation in Consul 1.15.

Answer

`start_join_wan`

Answer

`join_wan`

Answer

`retry_join`

Question 14

A platform team operates two Consul datacenters, 'dc1' and 'dc2', and wants operators in dc2 to resolve service names registered in dc1 without a full mesh of local agents. They have already used 'consul join -wan' to link the server agents. Which feature should they rely on for DNS lookups of remote services?

Accepted Answer

The built-in remote datacenter query capability, where a lookup such as 'web.service.dc1.consul' is forwarded to dc1's servers over the WAN federation link.. Once server agents are joined over the WAN, Consul's DNS interface resolves remote services using the datacenter label in the query name, forwarding the request to the owning datacenter's servers. No recursor changes, address translation, or snapshot copying are needed. The federation link itself provides the cross-datacenter query path for both DNS and HTTP interfaces.

Answer

Deploying a second Consul cluster in dc2 that mirrors dc1 using the 'consul snapshot restore' command on a schedule.

Answer

Configuring 'recursors' on every dc2 client agent so that queries for dc1 services are sent to dc1's DNS port on 8600.

Answer

Enabling 'translate_wan_addrs' on dc1 servers so that dc2 agents can resolve remote service names locally.

Question 15

You are deploying Consul servers in a new datacenter that will be a secondary in a federated environment. The primary datacenter is already configured with ACLs enabled and replication is working. You need to ensure the new secondary datacenter can replicate ACLs from the primary. Which configuration must be set on the new secondary's servers?

Accepted Answer

primary_datacenter set to the name of the primary datacenter and acl_replication_token with acl:read privileges.. To enable ACL replication in a secondary datacenter, you must set primary_datacenter to the name of the primary datacenter and provide acl_replication_token with a token that has acl:read privileges in the primary. These two settings allow the secondary servers to authenticate to the primary and read ACL policies, roles, and tokens. Without primary_datacenter, the agent does not know where to replicate from.

Answer

acl_replication_token with a token that has acl:write privileges in the primary datacenter.

Answer

acl_datacenter set to the primary datacenter name and acl_replication_token with acl:read privileges.

Answer

acl_replication_enabled set to true and acl_replication_token with acl:write privileges.