CCNA Multi Datacenter Federation Questions

Multi-Selectmedium

Which TWO of the following are consequences of a primary datacenter outage in a federated environment?

Select 2 answers

A.Secondary datacenters cannot receive new ACL updates.

B.Service discovery in all datacenters stops immediately.

C.ACL policy updates cannot be performed.

D.All Consul agents in the federation crash.

E.Existing cross-datacenter traffic routes fail.

AnswersA, C

Replication relies on the primary.

Why this answer

ACL replication stops and management changes cannot be made, but existing traffic and local discovery continue.

Practice this question →

MCQhard

A cross-datacenter service discovery request is failing. You observe the local datacenter can resolve the service via DNS, but the remote datacenter cannot. Which configuration parameter must be checked?

A.enable_central_config

B.node_meta

C.primary_datacenter

D.check_ttl

AnswerC

The primary_datacenter must be correctly defined for ACL and gossip coordination across the federation.

Why this answer

The 'primary_datacenter' and 'allow_stale' settings are crucial, but cross-DC discovery often fails if the 'enable_local_script_checks' or specific WAN gossip configurations prevent cross-link visibility.

Practice this question →

MCQhard

You are troubleshooting a partition between two datacenters. The WAN gossip shows high latency. Which Consul CLI tool provides the best insight into the WAN gossip state?

A.consul operator raft list-peers

B.consul members -wan

C.consul monitor

D.consul kv get

AnswerB

This command specifically shows members across the WAN gossip pool.

Why this answer

The 'consul members -wan' command provides a view of the nodes known to the local server in the WAN pool.

Practice this question →

MCQmedium

When configuring ACL replication, where must the 'acl_replication_token' be defined?

A.In the secondary datacenter's server agents.

B.In the primary datacenter's client agents.

C.In the Consul Enterprise license file.

D.On all nodes in both datacenters.

AnswerA

Secondary servers need the token to authenticate with the primary.

Why this answer

The replication token is configured on the secondary datacenter's Consul servers to allow them to read from the primary.

Practice this question →

MCQeasy

How do you enable WAN federation between two Consul datacenters that do not share a network?

A.By disabling ACLs.

B.By increasing the gossip interval.

C.By using a load balancer in front of the servers.

D.By deploying Mesh Gateways.

AnswerD

Mesh gateways are the designated way to connect isolated datacenters.

Why this answer

Mesh gateways allow cross-datacenter communication in environments where direct WAN gossip is not possible.

Practice this question →

MCQmedium

What is the role of a Consul server in a non-primary datacenter regarding ACLs?

A.They ignore all ACLs.

B.They can write new ACL policies independently.

C.They become the primary if the original primary fails.

D.They replicate the ACL state from the primary.

AnswerD

This is the function of ACL replication.

Why this answer

Secondary servers in an ACL-replicated setup act as a read-only mirror of the primary's ACL policy set.

Practice this question →

Multi-Selecthard

Which THREE network considerations are vital for Consul WAN federation?

Select 3 answers

A.Sufficient bandwidth for gossip heartbeat messages.

B.A shared NAT gateway for all datacenters.

C.Uniform MTU settings across all regions.

D.TCP and UDP traffic on the WAN gossip port (8302).

E.Connectivity between server nodes across datacenters.

AnswersA, D, E

Required for cluster stability.

Why this answer

WAN federation requires specific port accessibility, bandwidth for gossip, and routing between servers.

Practice this question →

MCQmedium

In a multi-datacenter environment, what happens if the 'primary_datacenter' server cluster becomes unavailable?

A.Secondary datacenters elect a new primary.

B.Secondary datacenters continue to operate, but ACL updates are blocked.

C.All secondary datacenters immediately shut down.

D.The entire WAN federation is dismantled.

AnswerB

ACL replication requires the primary, but local operations are unaffected.

Why this answer

While ACL replication will stall, the secondary datacenters continue to function using their own local raft states.

Practice this question →

MCQeasy

To verify if two datacenters are connected via WAN, which command shows the remote datacenter's server nodes?

A.consul members

B.consul info

C.consul members -wan

D.consul operator raft list-peers

AnswerC

This command shows WAN participants.

Why this answer

The 'consul members -wan' command lists all nodes participating in the WAN gossip pool, regardless of their local datacenter.

Practice this question →

MCQmedium

What is the benefit of using a Mesh Gateway in a multi-datacenter deployment with overlapping IP space?

A.It allows cross-datacenter traffic without routing overlapping networks.

B.It reduces the server memory usage.

C.It eliminates the need for ACLs.

D.It increases the gossip speed.

AnswerA

Mesh gateways proxy traffic at Layer 7, bypassing IP routing issues.

Why this answer

Mesh gateways allow communication between datacenters with overlapping IP ranges by acting as an SNI-based proxy that terminates and re-originates the mTLS connection.

Practice this question →

MCQmedium

You want to ensure that specific services in a remote datacenter are only accessible to certain local services. How can you achieve this?

A.Use Consul Intentions.

B.Use firewall rules on all nodes.

C.Modify DNS resolution.

D.Use ACL tokens.

AnswerA

Intentions are the correct tool for traffic authorization.

Why this answer

Intentions are the native Consul mechanism to control service-to-service communication, and they work across datacenters when correctly configured.

Practice this question →

MCQhard

A service in datacenter A needs to call a service in datacenter B. If 'prepared_queries' are not used, how does the service discovery query look?

A.<service>.service.consul

B.<datacenter>.<service>.service.consul

C.remote.<service>.service.consul

D.<service>.service.<datacenter>.consul

AnswerD

Adding the datacenter name is the standard way to cross-DC query.

Why this answer

When not using prepared queries, standard DNS discovery across DCs follows the pattern <service>.service.<datacenter>.consul.

Practice this question →

MCQmedium

What is the default port used for WAN gossip between Consul servers?

A.8301

B.8302

C.8500

D.8300

AnswerB

8302 is the correct port for WAN gossip.

Why this answer

The default port for WAN gossip is 8302, distinct from the LAN gossip port 8301.

Practice this question →

MCQhard

When configuring an ACL policy for cross-datacenter access, what policy rule is necessary to read service information from a remote datacenter?

A.service_prefix "*" { policy = "write" }

B.agent_prefix "" { policy = "read" }

C.acl_prefix "" { policy = "read" }

D.node_prefix "" { policy = "read" }

AnswerD

Reading node/service info requires read access to the namespace.

Why this answer

You need 'service_prefix' or 'node_prefix' policies that explicitly allow reading in the target datacenter.

Practice this question →

Multi-Selectmedium

Which TWO of the following are prerequisites for successful WAN federation?

Select 2 answers

A.All datacenters must share the same 'primary_datacenter' setting.

B.All datacenters must have identical node names.

C.Consul clients must be able to communicate directly with all remote servers.

D.All nodes must be in the same subnet.

E.Consul servers must be able to communicate on the WAN gossip port (8302).

AnswersA, E

This is essential for ACL/federation consistency.

Why this answer

WAN gossip ports must be open between server nodes, and the primary datacenter must be correctly identified.

Practice this question →

Multi-Selecthard

Which THREE configuration items are part of a complete WAN gossip setup?

Select 3 answers

A.The 'server' role flag set to true.

B.A list of remote server addresses for the 'join-wan' operation.

C.The 'client_addr' restricted to local only.

D.The 'encrypt' key for securing gossip traffic.

E.The 'ui' configuration set to true.

AnswersA, B, D

Only servers participate in WAN gossip.

Why this answer

WAN setup requires joining the WAN pool, defining the server role, and potentially setting encryption.

Practice this question →

MCQeasy

What happens to the gossip protocol if the 'encrypt' key is mismatched between two datacenters trying to join via WAN?

A.The join proceeds with warnings.

B.The join fails.

C.The connection defaults to unencrypted.

D.Only metadata is encrypted.

AnswerB

Encryption key mismatch prevents gossip communication.

Why this answer

If the encryption keys do not match, the agents will be unable to decrypt the gossip packets and the join will fail.

Practice this question →

MCQeasy

When joining a new datacenter to an existing WAN pool, what is the best practice for server versions?

A.The new DC must run a newer version.

B.The new DC must run an older version.

C.Versions should be consistent across all datacenters.

D.Version doesn't matter at all.

AnswerC

Consistency is a best practice for operational stability.

Why this answer

Running different versions of Consul is supported during upgrades, but maintaining consistent versions across the federation is recommended for stability.

Practice this question →

Multi-Selectmedium

Which TWO of the following are valid ways to troubleshoot inter-datacenter communication issues?

Select 2 answers

A.Change the datacenter name in the config.

B.Inspect server logs for RPC errors between datacenters.

C.Restart all clients in the datacenter.

D.Use 'consul members -wan' to verify remote server visibility.

E.Use 'consul kv export' to sync data.

AnswersB, D

RPC logs reveal cross-DC connectivity issues.

Why this answer

Verifying WAN gossip members and checking server logs for RPC errors are standard troubleshooting steps.

Practice this question →

MCQhard

What is the function of the 'retry_join_wan' configuration?

A.To sync secondary data.

B.To force a specific leader.

C.To enable persistent WAN connections.

D.To rotate the encryption key.

AnswerC

It ensures the WAN join succeeds over time.

Why this answer

The 'retry_join_wan' configuration allows the agent to repeatedly attempt to join the WAN gossip pool at startup if the initial attempt fails, improving robustness.

Practice this question →

MCQmedium

What is the purpose of the 'datacenter' field in the Consul agent configuration?

A.To limit the number of clients.

B.To segment the cluster into logical datacenters.

C.To enable encryption.

D.To identify the node for metrics.

AnswerB

Consul uses this to organize agents into functional groups.

Why this answer

The datacenter field defines the name of the datacenter the agent belongs to, which is used for service registration and routing.

Practice this question →

Multi-Selecthard

Which THREE items are required when configuring ACL replication in Consul?

Select 3 answers

A.The 'acl_replication' configuration block enabled.

B.A global root ACL token on every client node.

C.An 'acl_replication_token'.

D.The 'raft_protocol' version set to 1.

E.The 'primary_datacenter' parameter.

AnswersA, C, E

The mechanism must be turned on.

Why this answer

ACL replication needs a defined primary, a valid token for reading, and the enabled replication flag.

Practice this question →

MCQeasy

You are joining two Consul datacenters via WAN gossip. Which command must be executed on a Consul server in the secondary datacenter to initiate the federation?

A.consul members -wan

B.consul join -wan <remote-server-address>

C.consul reload -wan

D.consul agent -join-wan

AnswerB

The -wan flag is required for cross-datacenter gossip.

Why this answer

The consul join command with the -wan flag is the standard mechanism to introduce a node from one datacenter into the WAN gossip pool of another.

Practice this question →

Multi-Selecthard

Which THREE items are included in the metadata shared via WAN gossip?

Select 3 answers

A.Datacenter identification.

B.The health status of the participating server nodes.

C.Server node membership status.

D.The full list of local service definitions.

E.The local KV store contents.

AnswersA, B, C

Needed for cross-DC routing.

Why this answer

WAN gossip shares node membership, datacenter association, and health status for the server nodes.

Practice this question →

Multi-Selectmedium

Which THREE features are critical for maintaining ACL consistency across datacenters?

Select 3 answers

A.Disabling ACLs in the primary datacenter.

B.Configuring an ACL replication token.

C.Enabling ACL replication on secondary servers.

D.Designating a primary datacenter.

E.Configuring local KV store mirroring.

AnswersB, C, D

Required for replication.

Why this answer

Consistent ACLs require a primary source, replication tokens, and correctly configured secondary datacenters.

Practice this question →

MCQmedium

You have enabled ACL replication between a primary and secondary datacenter. What is the effect of changing an ACL policy in the primary datacenter?

A.The changes only propagate if the secondary is in maintenance mode.

B.The changes require a manual trigger on secondary servers.

C.The changes are ignored by secondary datacenters.

D.The changes are asynchronously replicated to all secondary datacenters.

AnswerD

ACL replication is an asynchronous process that pushes updates from primary to secondaries.

Why this answer

ACL replication automatically propagates changes from the primary to secondary datacenters to maintain consistency.

Practice this question →

Multi-Selecthard

Which TWO statements are true regarding Consul Mesh Gateways?

Select 2 answers

A.They replace the need for Consul servers in the secondary datacenter.

B.They increase the latency of LAN gossip.

C.They require a separate Consul Enterprise license.

D.They are required when direct WAN gossip is not possible between datacenters.

E.They operate as L7 proxies for cross-datacenter traffic.

AnswersD, E

This is their primary use case.

Why this answer

Mesh gateways function at Layer 7 and are essential for connectivity between isolated datacenters.

Practice this question →

MCQmedium

Which file format is used for Consul configuration?

A.HCL or JSON

B.INI

C.YAML

D.XML

AnswerA

Consul accepts both formats.

Why this answer

Consul supports both HCL (HashiCorp Configuration Language) and JSON for its configuration files.

Practice this question →

Multi-Selectmedium

Which TWO of the following are true about Consul datacenters?

Select 2 answers

A.Each datacenter must have at least one server node.

B.They are strictly physical locations.

C.They represent a group of nodes with low latency to each other.

D.They must share the same Raft quorum.

E.They allow a single Consul agent to join multiple DCs.

AnswersA, C

Servers are required for consensus.

Why this answer

Datacenters are logical groupings and require independent server quorums.

Practice this question →

Multi-Selectmedium

Which THREE factors influence cross-datacenter service discovery resolution?

Select 3 answers

A.The local server must have knowledge of the remote datacenter's server addresses.

B.All services must be in the same namespace.

C.The existence of a valid WAN gossip link.

D.The local agent must have superuser permissions.

E.The use of the specific datacenter suffix in the DNS query.

AnswersA, C, E

Required for cross-DC communication.

Why this answer

Resolution depends on the ability to query the remote DC, the health status of the remote instances, and the configuration of the local discovery agent.

Practice this question →

MCQhard

When using 'prepared_queries' for cross-datacenter failover, what does the 'failover' block allow you to specify?

A.The timeout for the WAN gossip.

B.A list of datacenters to attempt for service resolution.

C.The encryption algorithm for failover traffic.

D.The number of retries per node.

AnswerB

This is the primary function of the failover block.

Why this answer

The 'failover' block in a prepared query allows you to define a list of datacenters to try if the local datacenter lookup returns no healthy instances.

Practice this question →

MCQhard

You notice that the KV store is not consistent across datacenters. What is the cause?

A.The Raft protocol is broken.

B.The ACL token lacks the 'write' permission.

C.KV store is datacenter-local by design.

D.The WAN gossip is disabled.

AnswerC

Consul's KV store is not replicated globally between DCs automatically.

Why this answer

Consul does not natively replicate the entire KV store across datacenters by default; it requires separate configuration or manual syncing for state consistency.

Practice this question →

MCQmedium

When using multiple datacenters, what is the primary role of the 'consul-template' tool?

A.To generate configuration files based on Consul data.

B.To provision infrastructure.

C.To replicate KV stores.

D.To manage the Consul cluster nodes.

AnswerA

This is the primary function of consul-template.

Why this answer

Consul-template is often used to watch for changes in the Consul catalog and update application configurations, which can be useful when reflecting cross-DC service information.

Practice this question →

MCQhard

If you are running Consul Enterprise, what feature simplifies the management of cross-datacenter secrets?

A.KV Mirroring.

B.Automatic Secret Rotation.

C.Centralized Config.

D.ACL Replication.

AnswerD

ACL replication is a core Enterprise feature for secrets consistency.

Why this answer

Consul Enterprise supports cross-datacenter secret replication for specific ACL tokens and KV pairs, often utilized with the 'enterprise_license_path' features.

Practice this question →

MCQmedium

What is the recommended number of Consul servers per datacenter to ensure high availability?

A.3

B.2

C.1

D.10

AnswerA

3 is the minimum recommended for quorum and HA.

Why this answer

The recommended number for a consensus-based system like Consul is 3 or 5, to tolerate n/2-1 failures.

Practice this question →

MCQeasy

Which protocol do Consul servers use to maintain the WAN gossip pool?

A.gRPC

B.DNS

C.Serf (SWIM)

D.HTTP

AnswerC

Consul uses Serf/SWIM for membership and gossip.

Why this answer

Consul uses the Serf library, which implements the SWIM-based gossip protocol for both LAN and WAN communication.

Practice this question →

MCQeasy

Which file path is standard for storing the Consul server configuration, including WAN settings?

A./etc/consul.d

B./tmp/consul

C./opt/consul/bin

D./var/lib/consul

AnswerA

This is the conventional location for configs.

Why this answer

The '/etc/consul.d' directory is the standard location for Consul configuration files on Linux systems.

Practice this question →

Multi-Selecthard

Which TWO of the following accurately describe Consul's WAN gossip protocol behavior?

Select 2 answers

A.It involves only the server nodes of each datacenter.

B.It relies on a central hub-and-spoke architecture.

C.It is optimized to handle higher latency than LAN gossip.

D.It includes all client nodes in the gossip pool.

E.It is mandatory for service discovery.

AnswersA, C

Only servers participate.

Why this answer

WAN gossip is designed for high latency links and involves only server nodes, not all cluster nodes.

Practice this question →