Consul 1.15 Multi Datacenter Federation — Timed 25 Questions

Question 1

A cross-datacenter service discovery request is failing. You observe the local datacenter can resolve the service via DNS, but the remote datacenter cannot. Which configuration parameter must be checked?

25 minute time limit — choose an answer to begin.

Accepted Answer

primary_datacenter. In multi-datacenter Consul, the primary_datacenter parameter identifies which datacenter holds the authoritative catalog and ACL configuration. If it is misconfigured or points to the wrong DC, cross-DC service discovery and DNS resolution for remote services fail even though local resolution works.

Answer

enable_central_config

Answer

node_meta

Answer

check_ttl

Question 2

When configuring Mesh Gateways for WAN federation, what is the primary purpose of the 'wan' bind address?

Accepted Answer

To act as an entry point for cross-datacenter traffic in a mesh.. Mesh gateways use the wan bind address to facilitate cross-datacenter traffic routing when native WAN gossip cannot be used or is restricted.

Answer

To synchronize the local KV store.

Answer

To restrict gossip to the LAN only.

Answer

multiple_choice

Answer

To provide an API endpoint for remote users.

Question 3

A service in datacenter A needs to call a service in datacenter B. If 'prepared_queries' are not used, how does the service discovery query look?

Accepted Answer

.service..consul. In Consul DNS, the canonical fully-qualified name for a service in a remote datacenter is .service..consul. The datacenter label is inserted between the 'service' subdomain and the top-level 'consul' zone, so a query for 'web' in 'dc2' resolves to web.service.dc2.consul. This is the standard form used when prepared queries are not in play, because prepared queries allow failover and geo-routing via a single stable name.

Answer

<service>.service.consul

Answer

..service.consul

Answer

remote.<service>.service.consul

Question 4

Which file path is standard for storing the Consul server configuration, including WAN settings?

Accepted Answer

/etc/consul.d. Consul's conventional configuration directory on Linux is /etc/consul.d, where JSON or HCL files defining server, client, WAN, and other settings are placed. Consul automatically loads all *.json and *.hcl files from this directory when started with -config-dir=/etc/consul.d. This is the standard path used in documentation, systemd units, and production deployments.

Answer

/tmp/consul

Answer

/opt/consul/bin

Answer

/var/lib/consul

Question 5

What is the default port used for WAN gossip between Consul servers?

Accepted Answer

8302. Consul uses port 8302 for WAN gossip, which is the Serf gossip protocol used between servers across datacenters. This is distinct from LAN gossip on 8301 and the server RPC port on 8300.

Answer

8301

Answer

8500

Answer

8300

Question 6

If you are running Consul Enterprise, what feature simplifies the management of cross-datacenter secrets?

Accepted Answer

ACL Replication.. In Consul Enterprise, ACL replication is the feature that simplifies the management of cross-datacenter secrets by automatically replicating ACL tokens, policies, and roles from the primary datacenter to secondary datacenters. This ensures consistent access control across datacenters without manual intervention. Other options are not specific to cross-datacenter secret management.

Answer

KV Mirroring.

Answer

Automatic Secret Rotation.

Answer

Centralized Config.

Question 7

What is the function of the 'retry_join_wan' configuration?

Accepted Answer

To enable persistent WAN connections.. The 'retry_join_wan' configuration in Consul is used to specify a list of WAN addresses (typically the Serf WAN port 8302) of other Consul servers in remote datacenters. When set, a Consul agent will continuously attempt to join these addresses until it succeeds, thereby establishing and maintaining persistent WAN gossip connections between datacenters. This is essential for multi-datacenter federation, as it ensures that the WAN gossip pool remains connected even if a server restarts or a network partition occurs.

Answer

To sync secondary data.

Answer

To force a specific leader.

Answer

To rotate the encryption key.

Question 8

Which TWO of the following are prerequisites for successful WAN federation?

Accepted Answer

All datacenters must share the same 'primary_datacenter' setting.. WAN federation in Consul requires that every datacenter be configured with the same 'primary_datacenter' value (option A), because that setting identifies the authoritative datacenter for ACLs, intentions, and cross-datacenter operations, and a mismatch prevents proper federation. It also requires that Consul servers in each datacenter can reach the servers in other datacenters over the WAN gossip port 8302 (option E), since the WAN gossip pool is how servers exchange membership and routing information across datacenters. Option B is wrong because node names must be unique within a datacenter, not identical across datacenters. Option C is wrong because Consul clients only need to talk to servers in their own datacenter; cross-datacenter traffic is handled by the servers. Option D is wrong because WAN federation works across different subnets and networks as long as the required ports (8302 WAN gossip and 8300 server RPC) are reachable.

Answer

All datacenters must have identical node names.

Answer

Consul clients must be able to communicate directly with all remote servers.

Answer

All nodes must be in the same subnet.

Question 9

Which TWO statements are true regarding Consul Mesh Gateways?

Accepted Answer

They are required when direct WAN gossip is not possible between datacenters.. Option D is correct because a mesh gateway is the mechanism Consul uses to route service-to-service traffic between datacenters when the datacenters cannot communicate directly over WAN gossip, allowing cross-datacenter requests to be forwarded through a gateway rather than requiring a full mesh of WAN gossip connectivity. Option E is correct because Consul mesh gateways operate at Layer 7, proxying HTTP/gRPC (and other L7) traffic across datacenter boundaries and enabling features such as cross-datacenter intentions and traffic routing. Option A is not correct because mesh gateways do not replace Consul servers in a secondary datacenter; servers are still required to maintain the catalog and Raft state. Option B is not correct because mesh gateways do not increase LAN gossip latency; LAN gossip is a separate protocol used within a datacenter. Option C is not correct because mesh gateways are available in Consul open source and do not require a separate Consul Enterprise license.

Answer

They replace the need for Consul servers in the secondary datacenter.

Answer

They increase the latency of LAN gossip.

Answer

They require a separate Consul Enterprise license.

Question 10

Which command is used to check the health of the local agent?

Accepted Answer

consul info. The 'consul operator raft list-peers' or 'consul info' can provide information, but 'consul monitor' or checking the UI is more direct for health.

Answer

consul status

Answer

consul ping

Answer

consul get

Question 11

Which THREE configuration items are part of a complete WAN gossip setup?

Accepted Answer

The 'server' role flag set to true.. Option A is correct because a complete WAN gossip setup requires the 'server' role flag set to true so the agent participates as a server in the gossip protocol and can accept WAN federation traffic. Option B is correct because the 'join-wan' operation needs a list of remote server addresses (retry_join_wan or -join-wan) to establish the WAN gossip pool with other datacenters. Option D is correct because the 'encrypt' key (via encrypt or encrypt_verify_outgoing) secures gossip traffic with symmetric encryption, which is a standard part of a complete WAN gossip configuration. Option C is not required because restricting 'client_addr' to local only is a client interface binding choice, not a WAN gossip requirement. Option E is not required because enabling the 'ui' configuration only exposes the web UI and has no role in forming or securing the WAN gossip pool.

Answer

The 'client_addr' restricted to local only.

Answer

The 'ui' configuration set to true.

Question 12

When configuring an ACL policy for cross-datacenter access, what policy rule is necessary to read service information from a remote datacenter?

Accepted Answer

node_prefix "" { policy = "read" }. In Consul, cross-datacenter service discovery requires reading node information from the remote datacenter because services are registered to nodes. The node_prefix rule with read policy grants permission to read node data, which is necessary to resolve service instances in a remote datacenter. Without node read access, the catalog cannot return the nodes hosting the service, so service information remains inaccessible even if service read is allowed.

Answer

service_prefix "*" { policy = "write" }

Answer

agent_prefix "" { policy = "read" }

Answer

acl_prefix "" { policy = "read" }

Question 13

Which THREE factors influence cross-datacenter service discovery resolution?

Accepted Answer

The local server must have knowledge of the remote datacenter's server addresses.. Option A is correct because cross-datacenter service discovery requires the local server to know the addresses of servers in the remote datacenter, typically through a configured WAN federation or server-address list, so it can forward or resolve queries for remote services. Option C is correct because a valid WAN gossip link is the mechanism that propagates service and node information between datacenters; without an established WAN gossip pool, the local datacenter cannot learn about remote service registrations. Option E is correct because DNS queries must include the specific datacenter suffix (for example, service.service.dc1.consul or service.service.dc2.consul) to direct resolution to the intended remote datacenter rather than the local one. Option B is not required because services can be discovered across namespaces as long as the query and ACLs permit it, and namespace uniformity is not a prerequisite for cross-datacenter resolution. Option D is not required because service discovery queries are handled by the local agent and do not need superuser permissions; normal ACL tokens with read access are sufficient.

Answer

All services must be in the same namespace.

Answer

The local agent must have superuser permissions.

Question 14

Which THREE items are required when configuring ACL replication in Consul?

Accepted Answer

The 'acl_replication' configuration block enabled.. Option A is correct because ACL replication must be explicitly enabled in the Consul agent configuration via the acl_replication block (e.g., acl { enabled = true; default_policy = "deny"; enable_token_persistence = true } with replication configured), which activates the replication subsystem on secondary datacenters. Option C is correct because an acl_replication_token must be provided — this is a token with acl:write privileges in the primary datacenter that the secondary datacenter uses to authenticate and pull ACL data. Option E is correct because primary_datacenter must be set on the secondary datacenter's servers so they know which datacenter to replicate ACLs from. Option B is incorrect because a global root ACL token is not required on every client node; replication is a server-side operation and clients only need tokens to authenticate their own requests. Option D is incorrect because raft_protocol version 1 is unrelated to ACL replication and is not a valid requirement for configuring it.

Answer

A global root ACL token on every client node.

Answer

The 'raft_protocol' version set to 1.

Question 15

Which THREE items are included in the metadata shared via WAN gossip?

Accepted Answer

Datacenter identification.. In a WAN gossip pool (e.g., HashiCorp Consul's serf-based gossip), the metadata exchanged includes the datacenter identification (A), which lets nodes in different datacenters recognize which DC each member belongs to and is used for cross-DC awareness. It also includes the health status of participating server nodes (B), so failures and degraded members are detected cluster-wide via the gossip protocol's failure detector. Server node membership status (C) is likewise propagated, allowing nodes to join, leave, and be marked as failed or alive in the membership list. The full list of local service definitions (D) and the local KV store contents (E) are not gossiped over WAN; service registrations and KV data are replicated through the LAN gossip pool and the Raft-based catalog/KV replication mechanisms, not the WAN gossip layer.

Answer

The full list of local service definitions.

Answer

The local KV store contents.

Question 16

Which THREE features are critical for maintaining ACL consistency across datacenters?

Accepted Answer

Configuring an ACL replication token.. Option B is correct because configuring an ACL replication token (via acl.tokens.replication_token or the replication token in the ACL bootstrap) is required so secondary datacenters can authenticate and receive ACL updates from the primary. Option C is correct because enabling ACL replication on secondary servers (acl.enable_token_persistence and acl.replication enabled in the server configuration) allows those servers to actually pull and apply replicated ACL data. Option D is correct because designating a primary datacenter (primary_datacenter in the agent configuration) establishes the authoritative source from which ACLs are replicated to all other datacenters. Option A is wrong because disabling ACLs in the primary datacenter would break enforcement and prevent consistent replication, not maintain it. Option E is wrong because local KV store mirroring is unrelated to ACL replication and does not synchronize ACL policies, tokens, or roles across datacenters.

Answer

Disabling ACLs in the primary datacenter.

Answer

Configuring local KV store mirroring.

Question 17

Which TWO of the following are consequences of a primary datacenter outage in a federated environment?

Accepted Answer

Secondary datacenters cannot receive new ACL updates.. In a Consul federated environment, ACL updates are propagated from the primary datacenter to secondary datacenters, so when the primary datacenter suffers an outage, secondary datacenters can no longer receive new ACL updates (option A) and ACL policy updates cannot be performed at all (option C), since the primary datacenter is the authoritative source for ACL replication and token/policy changes. Service discovery does not stop immediately in all datacenters (option B) because secondary datacenters maintain their own local catalog and can continue resolving services for their local agents. Consul agents in the federation do not all crash (option D); agents continue running and serving local queries, only replication-dependent operations are affected. Existing cross-datacenter traffic routes do not automatically fail (option E) because established network paths and local service discovery remain functional; only new ACL-related updates are blocked.

Answer

Service discovery in all datacenters stops immediately.

Answer

All Consul agents in the federation crash.

Answer

Existing cross-datacenter traffic routes fail.

Question 18

A company is setting up a new secondary datacenter (dc2) to federate with an existing primary datacenter (dc1). They want to ensure that the WAN federation is secure and that services in dc2 can discover services in dc1. Which two configurations are required to enable WAN federation and cross-datacenter service discovery? (Choose two.)

Accepted Answer

Use retry_join_wan in the secondary datacenter's server agents to point to the primary datacenter's servers.. WAN federation requires the secondary datacenter's servers to join the primary's WAN gossip pool using retry_join_wan. Secure communication is ensured by enabling TLS verification (verify_outgoing and verify_server_hostname) on servers. These two configurations allow the datacenters to exchange catalog information, enabling cross-datacenter service discovery. Other options like Connect or primary_datacenter are not required for basic federation.

Answer

Configure the secondary datacenter's servers with the same encryption key for gossip as the primary datacenter.

Answer

Enable Connect in both datacenters and configure a mesh gateway in each datacenter to route cross-datacenter traffic.

Answer

Set the primary_datacenter configuration in the secondary datacenter's agents to the name of the primary datacenter.

Question 19

A Consul operator wants to join a new datacenter named 'dc2' to an existing datacenter 'dc1' using WAN federation. The servers in dc2 are started with retry_join_wan pointing to the LAN addresses of dc1's servers. However, the join fails and the logs show 'No installed keys could decrypt the message'. What is the most likely cause?

Accepted Answer

The gossip encryption key configured on dc2's servers does not match the key used by dc1's servers for WAN gossip.. WAN federation relies on a shared gossip encryption key across all datacenters. When the key on the joining datacenter's servers differs from the key used by the existing datacenter, the receiving servers cannot decrypt the gossip messages, leading to the 'No installed keys could decrypt the message' error. Verifying and synchronizing the gossip encryption key resolves the join failure.

Answer

The retry_join_wan addresses must use the Serf WAN port 8302 instead of the LAN port 8301.

Answer

The ACL replication token is missing from the dc2 server configuration, preventing secure communication.

Answer

The dc2 servers are not configured with a unique node name, causing conflicts during the join.

Question 20

A Consul operator is planning to federate three datacenters: dc1, dc2, and dc3. They want to ensure that the WAN gossip encryption key is consistent across all datacenters. Where should the WAN gossip encryption key be configured?

Accepted Answer

In the agent configuration of every server in each datacenter, using the encrypt_wan parameter.. The WAN gossip encryption key is set with the encrypt_wan parameter in the server agent configuration. All servers across federated datacenters must use the same key to securely communicate over the WAN gossip protocol. This ensures that only trusted servers can join the WAN pool. The LAN gossip key (encrypt) is separate and is used within each datacenter.

Answer

In the agent configuration of every client agent in each datacenter, using the encrypt parameter.

Answer

In the server's configuration using the primary_datacenter parameter, which propagates the key to all datacenters.

Answer

In the Consul KV store under the key 'wan/encrypt', which is automatically read by all servers.