HashiCorp Certified: Consul Associate (Consul 1.15) (Consul 1.15) (Consul 1.15) — Questions 1–75

The `-recurse` flag makes the get operation return every key sharing the given prefix, including nested paths, along with each key's value, flags, and modify index. This single command satisfies the requirement to enumerate the subtree and inspect metadata for each entry, which is why it is the standard way to audit a KV prefix.

Consul kills a script check that does not return before its timeout and marks it critical, so a 40-second script under the default 10-second timeout will be terminated and reported as failing. Setting timeout to a value above the observed worst-case runtime lets the script finish and report its real status, stopping the flap without touching the script or the host.

The secondary datacenter must know which datacenter is the primary by setting primary_datacenter. Additionally, it needs a token with acl:read privileges in the primary to read ACL data. This token is configured using acl_replication_token. Both settings are required for ACL replication to function in a secondary datacenter.

Consul's KV write API defaults the Flags field to 0 when the request omits it. Flags is an opaque 64-bit unsigned integer reserved for client-side use, so Consul stores zero rather than rejecting the write.

Consul's check-and-set parameter makes the write conditional on the key's current ModifyIndex. Supplying cas=0 means the operation succeeds only when the key does not yet exist, since a fresh key has ModifyIndex zero. Any existing key returns a conflict, satisfying the stem's requirement exactly.

The `consul watch` command supports the `keyprefix` watch type, which monitors all keys under a given prefix. When any key under `app/prod/` is added, modified, or deleted, the watch fires and returns the current state of the prefix. This avoids polling and efficiently notifies the team of any change.

The 'consul health service' command displays the health checks associated with a service, including the sidecar proxy if it is registered as a service. For a Connect-enabled service, the sidecar proxy is registered as a separate service named 'inventory-sidecar-proxy'. Running 'consul health service inventory' shows the health of the main service, and you can also check the sidecar proxy's health. This command is the standard way to verify service and proxy status.

The HTTP API exposes REST endpoints that accept service definitions via PUT requests, so standard tools like curl can register services without installing the Consul CLI or agents. This directly satisfies the stem's requirement for dynamic registration using generic HTTP clients rather than Consul-specific tooling.

The `passing` parameter in a DNS query explicitly filters results to only instances with passing health checks. For `payment-processor`, using `payment-processor.service.consul?passing` ensures that only healthy instances are returned. This is a direct way to enforce health-based filtering in DNS queries, which is exactly what the engineer needs.

The `-cas` flag performs a check-and-set using the supplied ModifyIndex. Passing `812`, the index observed from the prior read or write, tells Consul to apply the new value only if the key's current ModifyIndex still equals 812. If another client changed the key in the meantime, Consul returns HTTP 409 Conflict and the write is rejected, which is exactly the compare-and-swap behavior required here.

Cross-signing the new intermediate with the old root creates a chain of trust that both old and new proxies can validate. Updating the CA configuration with the bundle lets Consul distribute the new root while the old root remains trusted. Leaf certificates are rotated automatically by the CA provider, so existing connections are not forcibly broken and the transition is seamless.

The 'connect' stanza with 'enabled = true' in the Consul agent configuration enables the Connect feature on that agent. When enabled on servers, it allows the datacenter to issue and manage certificates for Connect. This is the correct setting to globally enable Connect and mTLS. Without it, Connect features are not active.

Acquire is atomic and succeeds only when the key is unheld or already held by the same session. Binding the key to a session means Consul releases it when the session is invalidated, whether by TTL expiry or a failed health check, giving automatic release on process death.

For a TTL check, the ttl field specifies the duration after which the check becomes critical if no successful update is received. Setting it to 1m ensures that if the application does not renew the TTL within one minute, Consul marks the check critical, exactly matching the requirement.

Consul's DNS interface by default returns only healthy instances of a service. If the health check on one node's service is failing, that instance is omitted from DNS responses. This is the most common reason for a service appearing on one node but not another when definitions are identical. The operator should verify the health check status using the HTTP API or Consul UI.

Intentions provide this.

A very large number of keys inflates the key space that Consul must track, replicate and index across servers, raising memory pressure and Raft log overhead. This directly bottlenecks KV performance, since every write must be consistently replicated to the cluster's followers.

The encrypt parameter specifies the gossip encryption key used for both LAN and WAN gossip. For a new datacenter to join the WAN federation, its servers must use the same gossip encryption key as the existing datacenter's WAN pool. Setting encrypt correctly is essential for secure and successful WAN gossip communication.

deregister_critical_service_after specifies the duration a service may remain critical before Consul automatically removes it from the catalog. Setting it to 24h satisfies the requirement, unlike checks or timeouts that only affect health status without deregistering the service.

Consul's compare-and-swap is based on the ModifyIndex, not the value. To ensure the value is as expected, the operator must first read the key to check its value and obtain its ModifyIndex, then use `-cas` with that index. If the key changes between the read and the write, the CAS operation fails, preventing race conditions.

A script check runs an external command on the node and evaluates its exit code, so a script reading memory usage can return non-zero when a threshold is exceeded. This suits alerting on high memory, unlike TCP or HTTP checks.

The TCP check attempts a connection to the specified address. If the database is bound only to a specific IP (e.g., 127.0.0.1 vs ::1) or the agent lacks permissions, the connection fails. The scenario says the database is accepting connections, but not necessarily on the exact address the check uses. This is the most likely cause.

Consul's DNS interface supports cross-datacenter lookups by including the datacenter as a label before the domain. The format is <service>.service.<datacenter>.consul. Querying web.service.dc2.consul asks the local Consul agent to resolve the 'web' service in dc2 via the WAN federation, returning healthy instances from that remote catalog.

`consul members -wan` queries the WAN gossip pool directly, listing every datacenter's server agents with their gossip status and round-trip latency. That satisfies the stem's need for insight into WAN gossip state under high latency, unlike LAN-scoped commands or RPC-based tooling that bypass the gossip layer entirely.

A session lock is released when its TTL elapses, so a TTL set too low expires the session prematurely and frees the lock without any explicit release call. This directly satisfies the stem's unexpected-release constraint: Consul's lock is tied to session lifetime, not to client intent.

`consul intention list` queries the intention endpoint directly, returning every active intention across the mesh with source, destination and action. It satisfies the stem's requirement to display all active intentions without filtering by service name, unlike `consul intention check`, which tests a single source-destination pair.

This endpoint registers a service with the local agent and allows including a check definition in the same payload. The check can be an external script that the agent executes periodically. If the script fails, the service is marked critical, and DNS queries will not return it. This is the correct way to atomically register a service and its health check.

The Behaviour field controls session invalidation semantics, determining whether locks held by the session are released or remain, directly answering what happens to locks when a session becomes invalid. This governs the release behaviour rather than lock acquisition.

The deregister_critical_service_after field specifies a duration after which a service in a critical state is automatically deregistered from the catalog. Setting it to 10m meets the requirement of removing the instance after 10 minutes of critical health. This is the exact field designed for this scenario and is valid in service check definitions.

Consul Connect enforces mutual TLS between services, issuing SPIFFE-based identities via its built-in CA, so every connection is authenticated and encrypted regardless of network location. That satisfies zero-trust networking, where trust derives from verified service identity rather than perimeter defences.

`consul kv delete` removes the specified key from the KV store. Given the exact path, it deletes only that key, which is precisely what the developer needs to stop the application from reading the obsolete timeout value. This is the direct, idiomatic way to remove a single key.

The acl_replication_token is configured on the secondary datacenter's server agents, which use it to authenticate to the primary datacenter and receive replicated ACL data. Defining it there satisfies the requirement that secondary servers can pull token-protected ACL updates.

The `-cas` flag performs a check-and-set operation. Passing `-cas=0` tells Consul to only write the key if its current ModifyIndex is 0, which is the case for a key that does not exist. If the key is already present, the write fails with a conflict, achieving the atomic create-if-absent behavior the developer needs.

Supplying the full key path without any recursion flag deletes only that exact entry. Consul treats the argument as a literal key, so sibling keys under `app/temp/` remain intact. This is the precise, least-destructive command for removing one entry while preserving the rest of the prefix.

retry_join_wan specifies a list of WAN addresses of servers in other datacenters that the agent should attempt to join. Setting this in dc3 ensures that on startup or after a restart, the server will automatically attempt to join the WAN gossip pool, maintaining federation without manual intervention. This is the correct parameter for automatic WAN rejoin.

The meta block stores arbitrary user-defined key/value pairs attached to a service, such as version, owner or environment labels. It is purely descriptive metadata, not configuration, and does not affect health checking, routing or service discovery behaviour.

For ACL replication to work, the replication token must have 'acl:read' permissions on the primary datacenter. Without this, the secondary servers cannot read the ACL policies, tokens, and intentions from the primary, causing replication to fail. This is a common misconfiguration.

Consul's health check states are passing, warning, and critical. A passing status means the check's defined script, HTTP, or TCP probe returned success within its interval, confirming the service instance is healthy and should remain in the load-balancing rotation.

The `consul kv get` subcommand retrieves the value of a single key from the Consul KV store. It returns the value, and optionally metadata such as flags and CreateIndex/ModifyIndex when using `-detailed`. This directly answers the developer's need to read the current value of `deploy/status` without blocking or watch behavior, making it the correct choice.

Consul treats a check whose HTTP request does not complete within the timeout field as a failure and sets the status to critical. The endpoint answering slowly with HTTP 200 does not override the timeout; the request is abandoned and the check goes critical until a subsequent probe completes inside the timeout window.

The 'DeregisterCriticalServiceAfter' field on the health check causes Consul to deregister the service instance if the check remains critical for the specified duration. Once the node becomes unreachable, the check will eventually be marked critical (after the check interval and timeout). After 1 hour of critical status, Consul will deregister the service instance, regardless of whether the node has rejoined. When the node rejoins, it will re-register the service if it is still configured to do so.

The `consul intention check` command evaluates the intention rules governing a connection between a specified source and destination service, returning whether that traffic is permitted or denied. It directly satisfies the stem's requirement to verify authorisation between two services, without modifying any configuration.

Upstreams are declared on the consuming service's sidecar proxy. Specifying destination_name (and optionally a local_bind_port) instructs the sidecar to open a local listener that forwards to the database through the mesh, so the application uses a stable local address rather than a hard-coded IP.

A TCP check opens a socket to the registered address and port, succeeding only if the connection completes. This satisfies the stem by being a genuine Consul check type, distinct from script-based checks that execute local commands and report status via exit codes.

The grpc check type implements the standard gRPC health checking protocol against the given address. The agent calls the health service and treats a SERVING response as passing. This avoids writing custom probe logic and matches the requirement to use the protocol the service already exposes on port 50051.

Connect uses a default-deny posture for inbound mesh traffic, so a service with a sidecar rejects any connection that is not explicitly authorized by an intention. Creating allow intentions for the specific callers grants exactly the required access. The sidecar also requires mTLS, so callers without a valid Connect certificate cannot complete the handshake in the first place.

The `consul kv get` command retrieves a single key and, by default, returns the value plus metadata fields like CreateIndex, ModifyIndex, LockIndex, Flags, and Session. Because the request targets one exact key path, the response includes that key's metadata without needing any extra flag such as `-detailed`, which is only required for listing operations.

Acquiring a KV key with a session creates a lock. If the session is invalidated—for example, because the node's health check fails—Consul automatically releases the lock and deletes the key. This directly ties the flag's lifetime to the node's health, matching the requirement.

The sidecar proxy for a service named 'inventory' is registered as 'inventory-sidecar-proxy'. The 'consul health service' command queries the health of a specific service, returning checks and node information. This directly verifies that the sidecar proxy is running and healthy, which is the required task.

Mesh gateways route server-to-server RPC traffic between datacenters over the WAN, so datacenters without direct network connectivity can still federate. Each gateway proxies traffic on behalf of its local servers, satisfying the stem's no-shared-network constraint without requiring VPN tunnels or routed peering.

Consul's KV store uses PUT to create or update a key, since the operation is idempotent and supplies the value in the request body. POST is not used for KV writes, satisfying the stem's create-or-update requirement.

The consul members command queries the gossip protocol on the local agent and returns every node the cluster currently recognises, along with its status and role. A node appearing in this output confirms it has successfully joined and is participating in service discovery.

The session is kept alive by the Consul agent's renewals. The application's pause does not impact the session because the agent operates independently. The lock remains held until the session is explicitly destroyed or the agent fails to renew. This is a common pitfall in distributed locking with Consul: the lock can outlive the application process.

The Consul Kubernetes controller watches Kubernetes Custom Resource Definitions such as ServiceDefaults and ServiceResolver, syncing them into Consul's catalog. This makes CRDs a supported registration path in Kubernetes environments, alongside agent config and the HTTP API.

Setting expose to true publishes the service-specific check's status through Consul's HTTP health endpoint, allowing external tooling to query it. Without it, the check runs but its result stays internal to the agent, so only the API interface reveals the state.

Non-primary datacenters do not originate ACL tokens or policies; they forward token writes to the primary and asynchronously replicate the resulting ACL state. This replication ensures consistent authorisation decisions locally, satisfying the requirement that servers in secondary datacenters enforce the same ACLs without holding the authoritative token store.

In a non-containerised, multi-process architecture, each process runs independently, so Consul cannot infer health from a single aggregate check. Defining one check per service ensures each process is monitored separately, satisfying the requirement to detect individual process failures.

The alias check directly inherits the status of the aliased check. Since the aliased check is in a warning state, the alias check will also report warning. This allows services to depend on the health of other services without duplicating check logic. The alias check does not modify the status in any way.

Consul aggregates all health checks attached to a service; if any single check reports critical, the service's overall status becomes critical. This aggregation means one failing check is sufficient to mark the whole service unhealthy, regardless of the other checks passing.

Consul Connect uses a default-deny model for intentions. When no intention explicitly allows a connection, it is denied. In this scenario, only 'web' is allowed to connect to 'api', so all other services are denied by default. This ensures a secure zero-trust network. The default behavior applies unless overridden by a higher-priority intention or a wildcard allow.

The `kind` field declares the service registration type, with `connect-proxy` marking a sidecar proxy instance rather than a standard service. This satisfies Consul's requirement to distinguish proxy registrations from application services, enabling Connect to route traffic through the correct proxy for mTLS enforcement.

Consul Connect native integration embeds the mTLS handshake directly into the application, which manages its own certificates and identity rather than delegating to a sidecar proxy. This app-managed handshake is the defining feature distinguishing native integration from proxy-based service mesh.

ModifyIndex is the raft index of the last modification to that key, returned alongside CreateIndex, LockIndex, Key, Flags and Value. It satisfies the stem's requirement by being a field the Consul KV API genuinely includes in its GET response.

The `-recurse` flag makes `consul kv get` walk every key beneath the given prefix and return them all in one response. This lets the team fetch the entire `payments` configuration set with a single call, which is exactly the prefix-retrieval behavior they need for loading structured config at startup.

A service's aggregate health is the worst state among all its checks, so adding a script check that fails on the registering node drags the service to critical even though the alias check still passes. Because DNS only returns healthy instances by default, the gateway drops out of resolution. Removing or fixing the failing script check restores the service to passing.

The identity certificate, issued by Consul's CA to the service, supplies the client or server leaf credential presented during the TLS exchange. Its embedded SPIFFE URI determines the peer identity verified against intentions, directly shaping the mTLS handshake outcome.

The `-cas` flag performs a check-and-set operation: the write succeeds only if the key's current ModifyIndex matches the supplied value. Passing 0 asserts that the key does not yet exist, so the first process to write wins and the second receives a failure. This gives the atomic create-if-absent behavior needed to elect a single leader without a race.

The consul intention list command queries the intention endpoint and prints every intention in the current datacenter, including source, destination, action, and precedence metadata. It is the direct, read-only way to audit mesh authorization rules. Operators use it to confirm that expected allow or deny rules exist before troubleshooting connectivity.

WAN federation relies on the gossip protocol, which exchanges lightweight heartbeat messages between servers in each datacentre. Sufficient bandwidth ensures these periodic probes and suspicion messages propagate reliably across the WAN, preventing false failure detection and maintaining a healthy federated membership.

A key watch monitors a single KV pair path and fires its handler whenever that key's value changes, matching the requirement to trigger a script on one specific key. Other watch types cover prefixes, services, nodes or checks, not individual key modification.

The consul kv put command writes a key-value pair into the Consul KV store, taking the key path and value as arguments. Other kv subcommands such as get, delete or export read or remove entries, so put is the correct write operation.

Intentions enforce service-to-service authorisation by evaluating allow or deny rules against the source and destination service identities in a mutual TLS session. This directly satisfies the stem's requirement for service authorization, since Consul Connect uses intentions as its mechanism for permitting or refusing connections between services.

Tag override decouples tags from the service definition's configuration file, permitting registration or catalog updates to alter them through the API. Without it, any tag change requires editing and reloading the config, so this setting enables API-driven tag modification.

Consul DNS suppresses unhealthy instances from service lookups, so when every instance fails its health check, the query yields no records — NXDOMAIN or an empty answer set — rather than stale addresses. This satisfies the stem's requirement by preventing clients from receiving unreachable endpoints, letting them fail fast instead of timing out.

Intentions enforce service-to-service authorization based on service identity, and mTLS ensures that only services with valid certificates from the Consul CA can establish connections. This combination restricts incoming traffic to 'checkout' while requiring certificate validation, meeting both requirements.