Consul 1.15 · domain
Key Value Store
The Key Value Store domain covers Consul's distributed KV store: reading and writing keys via the HTTP API and the `consul kv` CLI, blocking queries and watches, check-and-set semantics using ModifyIndex, and ACL enforcement. Questions test API parameters, status codes, and how KV interacts with Consul's consistency and permissions model.
Focused practice
Practice Key Value Store questions
Scored sessions drawing only from this domain — pick a length below.
Start 20-question practice test →What this domain covers
What to know about Key Value Store
Be able to read and write KV entries with the CLI and HTTP API, apply check-and-set using the `cas` parameter (cas=0 creates only if absent), and diagnose 403s as ACL policy failures. The single most important thing: know that `cas` enforces atomic conditional writes based on ModifyIndex.
Using `consul kv put`, `get`, `delete`, and `export`/`import` CLI subcommands correctly
HTTP API endpoints like `/v1/kv/:key` with `?cas=`, `?recurse=`, and `?index=` parameters
Blocking queries and watches that fire scripts when a watched key changes
ACL token policies granting `key` and `key_prefix` read/write permissions in Consul
Watch out for
Common Key Value Store exam traps
- ▸Confusing `cas` check-and-set with `acquire`/`release` session locks; `cas=0` only succeeds when the key does not yet exist
- ▸Assuming a 403 Forbidden means the key is missing; it almost always indicates an ACL token lacking the required policy
- ▸Forgetting that blocking queries use `index` and return `X-Consul-Index`, and that watches need a valid token to read protected keys
Question index
All Key Value Store questions (57)
Click any question to see the full explanation, or start a practice session above.
An operator wants to list every key beneath the `services/web/` prefix, including nested paths, and see each key's associated flags and modify index. Which command returns that information?
Medium2What is the default value for the Consul KV flags field if not provided during a write?
Easy3You need to perform a write operation to the Consul KV store that only succeeds if the current ModifyIndex of the key is zero. Which parameter should you include in your API call?
Medium4A security team stores application secrets under the Consul KV prefix `app/prod/`. They want to be notified whenever any key under that prefix changes, without repeatedly polling the entire prefix. They have access to the Consul HTTP API and the `consul watch` command. Which approach should they use?
Medium5A platform team stores service configuration under the Consul KV prefix `config/web/`. An operator runs `consul kv put config/web/timeout 30` at a time when the key already exists with value `45` and ModifyIndex `812`. The operator later needs to update the value only if no one else has changed the key since that write. Which Consul CLI invocation correctly performs this compare-and-swap using the index returned by the prior write?
Hard6A team stores rolling deployment state under `deploy/current`. To avoid a race where two operators both believe they own the release, the application must acquire the key only if it is not already held, and it must automatically release the key if the holding process dies. Which combination of Consul primitives achieves this?
Hard7Which THREE of the following represent potential bottlenecks for Consul KV performance?
Hard8An operator needs to update the value of `config/database/url` in Consul KV, but only if the current value is exactly `postgres://old:5432`. They want to use the Consul CLI to perform a compare-and-swap operation. Which command should they use?
Hard9You observe that a session lock is being released unexpectedly. What is the most likely cause?
Hard10What is the purpose of the 'Behavior' field when creating a Consul session?
Medium11A developer needs to remove an obsolete configuration key `app/legacy/timeout` from Consul's KV store so the application no longer reads it. Which command deletes this single key?
Easy12A developer stores a feature flag at the key `config/features/new-ui` in Consul KV and wants to atomically create it only if it does not already exist, failing the write if the key is present. Which Consul CLI command accomplishes this?
Medium13An operator needs to delete the single KV entry `app/temp/cache-ttl` but must leave every other key under `app/temp/` untouched. Which command performs exactly that deletion?
Easy14A developer uses the Consul KV store to coordinate a rolling deployment. They write a key `deploy/status` with the value `in-progress` using `consul kv put deploy/status in-progress`. Later, they want to check the current value of that key without any blocking or long-polling behavior. Which command should they run?
Medium15A platform team stores feature-flag values under the prefix `config/features/`. They need to read the single key `config/features/checkout` and receive its value along with metadata such as `CreateIndex` and `ModifyIndex` in the response. Which Consul CLI command accomplishes this?
Medium16You are using a Consul KV entry to store a feature flag. You want the flag to be automatically deleted if the node that owns it becomes unhealthy. Which Consul API operation should you use?
Medium17Which HTTP method is used to create or update a key in the Consul KV store?
Easy18You are implementing a distributed semaphore using Consul KV and sessions. You create a session with a TTL of 60 seconds and use the 'acquire' parameter to lock a key. After acquiring the lock, the application holding the session experiences a 90-second pause due to a garbage collection stop-the-world event. The Consul agent on the node is healthy and continues to renew the session. What happens to the lock?
Hard19Which THREE of the following fields are returned in a typical Consul KV API GET response?
Medium20A team wants to store structured configuration for several microservices in Consul's KV store and retrieve an entire service's configuration with a single CLI call. They plan to keep all keys for `payments` under `services/payments/`. Which command retrieves every key under that prefix in one invocation?
Medium21An operator wants to atomically create a key `locks/leader` only if it does not already exist, so that two competing processes cannot both become leader. Which Consul KV operation should be used?
Hard22You are configuring a Consul Watch to trigger a script whenever a specific KV key changes. Which type of watch should you define in your configuration file?
Medium23Which command-line interface command is used to set a value in the Consul KV store?
Easy24Which THREE of the following are true about Consul KV keys?
Easy25You want to delete a key and all its children in the KV store using the CLI. Which flag should you use?
Medium26Which Consul API endpoint is used to create a new session that can be used for locking KV keys?
Medium27You are deploying a blue/green release where the active environment is selected by the value of the Consul KV key `deploy/active-color`, currently set to `blue`. Your CI pipeline must atomically switch the value to `green` but only if the current value is still `blue`, and must fail if another pipeline already changed it. Which API operation should the pipeline use?
Medium28When using the Consul KV store, what is the maximum size allowed for a single value in a key?
Easy29When providing a session TTL, what is the minimum duration allowed?
Medium30You are designing a distributed leader election system using Consul. A service instance must hold a lock on the KV key 'service/leader' to become the leader. You need to ensure that if the instance crashes or loses network connectivity, the lock is automatically released so another instance can acquire it. Which Consul feature should you use to achieve this?
Medium31A developer has stored the database connection string under the Consul KV path `config/db/primary`. A configuration management script needs to fetch this value as raw text so it can be exported directly into an environment variable. Which Consul CLI command retrieves only the value of that key?
Easy32You need to ensure that a read operation from the KV store is strongly consistent. Which consistency mode should you specify?
Hard33You are deploying a service that must store a critical configuration value in Consul KV. The value must only be visible to services with a token that has read access to that specific key. You also need to ensure that any write to the key can only be performed by a token with write access. Which Consul feature should you use?
Medium34Which TWO of the following are true regarding Consul KV watches?
Hard35You are using a Consul Watch to monitor KV changes. What does the 'handler' field specify?
Medium36An operator wants to create a distributed lock using the Consul KV store and sessions. They create a session with `consul session create` and obtain a session ID. They then attempt to acquire a lock on the key `locks/primary` by running `consul kv put -acquire locks/primary leader1`. The command fails with an error indicating the lock is already held. Which of the following best explains why the lock acquisition failed?
Hard37When a session is associated with a lock, what happens to the lock if the session is deleted?
Medium38Which TWO of the following are true about the 'cas' parameter in KV writes?
Medium39A system administrator needs to delete a single key named `temp/config` from the Consul KV store. They want to ensure that only that key is removed and no other keys are affected. Which command should they use?
Easy40You are using Consul KV to coordinate a distributed job scheduler. A worker acquires a lock on a key to ensure only one worker runs a job at a time. The lock is tied to a session. The worker crashes and the session expires after its TTL. What happens to the lock on the key?
Medium41You want to perform a blocking query on a KV key to watch for updates. Which parameter must you provide in your request based on the last observed index?
Medium42You need to store a value in Consul KV that will be read by a service. The value should be retrievable by a simple HTTP GET request to the Consul API. Which HTTP endpoint should you use to read the value of a key named 'app/config/db_host'?
Easy43When using Consul KV for distributed locking, why is it recommended to use a session?
Hard44An engineer is designing a service that must coordinate access to a shared resource using Consul KV sessions and needs to understand the guarantees the lock provides. Which TWO statements accurately describe how Consul's KV locking with sessions behaves? (Choose two.)
Hard45A team is using the Consul KV store to store application configuration. They want to implement a watch that runs a script whenever the value of the key `config/app` changes. Which two of the following statements are true regarding Consul KV watches? (Choose two.)
Medium46If a KV operation returns a 403 Forbidden status, what is the most common cause?
Hard47You have implemented a leader election mechanism using Consul KV sessions. The session has a TTL of 15 seconds. If the application crashes, how long will it take for the lock to be automatically released?
Hard48If a Consul agent is configured with 'disable_remote_exec = true', how does this affect the KV store?
Hard49You are deploying a service that requires distributed locking with automatic release if the service instance fails. You have created a session named 'lock-session' and acquired a lock on the KV key 'locks/db'. After a few minutes, the lock is unexpectedly released even though the service instance is still running. Which action should you take to diagnose the most likely cause?
Medium50An operator writes a feature flag to `app/features/new-ui` using `consul kv put app/features/new-ui true`. Later, a health-check script reads that key and receives an error instead of the value. The operator confirms the key exists with `consul kv get app/features/new-ui`. Which command should the operator run to inspect the metadata that would reveal a problem such as a missing or expired session on the key?
Medium51You need to retrieve the session information for a specific session ID. Which endpoint should you query?
Medium52An operator runs `consul kv put config/app/timeout 30s` and then `consul kv get config/app/timeout`. The second command prints only `30s` with no metadata. The operator wants to see the key's `CreateIndex`, `ModifyIndex`, and `Flags` from the command line without writing code against the HTTP API. Which command should be used?
Easy53You want to perform a list operation on a KV prefix to see all keys, but you don't want the values returned. Which API parameter helps reduce payload size?
Medium54Which Consul feature allows you to observe the KV store for changes and run a command in response?
Easy55Which TWO of the following are common use cases for the Consul KV store?
Easy56A microservice uses a Consul session with a 30-second TTL and holds a lock on `locks/leader` via `acquire`. The service process is alive and healthy but its network link to the Consul servers is severed for several minutes. When connectivity is restored, the service finds it no longer owns the lock. Which behavior explains this outcome?
Hard57You are designing a configuration system where multiple instances of a service must coordinate to elect a single leader using Consul KV. Which two statements accurately describe how to implement leader election with sessions? (Choose two.)
HardOther domains
All Consul 1.15 exam domains
Frequently asked questions
- What does the Key Value Store domain cover on the Consul 1.15 exam?
- Be able to read and write KV entries with the CLI and HTTP API, apply check-and-set using the `cas` parameter (cas=0 creates only if absent), and diagnose 403s as ACL policy failures. The single most important thing: know that `cas` enforces atomic conditional writes based on ModifyIndex.
- How many questions are in this domain?
- This page lists all 57 Key Value Store questions in the Consul 1.15 question bank. The actual exam draws from this domain proportionally to its weighting in the official exam blueprint.
- What is the best way to practise this domain?
- Start with a short focused session (10 questions) to identify gaps, then work through explanations. Repeat with a longer session once the weak areas feel solid.
- Can I practise only Key Value Store questions?
- Yes — the session launcher on this page filters questions to this domain only. Choose any session length for inline explanations and scoring.