HashiCorp Certified: Consul Associate

What is the primary purpose of service discovery in Consul?

• ATo encrypt all application payloads at rest
• BTo let clients find service instances by logical name instead of hardcoded IP addresses
• CTo elect a Raft leader among client agents
• DTo generate TLS certificates automatically for every workload

In Consul service networking, what provides service-to-service encryption without requiring the application itself to implement mutual TLS?

• APrepared queries
• BSidecar proxies in the service mesh
• CWAN gossip
• DSnapshot restores

Which Consul component is designed to provide a controlled entry point from external clients into services in the mesh?

• AIngress gateway
• BClient agent
• CPrepared query
• DLAN gossip pool

What problem is Consul-Terraform-Sync (CTS) primarily used to solve?

• AKeeping network infrastructure configuration synchronized with service changes in Consul
• BEncrypting Raft logs on Consul servers
• CReplacing sidecar proxies with static routes
• DCreating backups of the service catalog

Why does Consul combine service discovery with health checks?

• ASo only instances with passing checks are typically returned for healthy lookups
• BBecause health checks are required to enable ACLs
• CBecause services cannot be registered until TLS is disabled
• DTo allow servers to avoid using Raft

A team wants developers to call services by name, enforce which services may connect to `payments`, and expose one controlled edge entry for outside traffic. Which combination of Consul capabilities best fits?

• AService discovery, intentions, and an ingress gateway
• BSnapshots, WAN federation, and gossip encryption
• CPrepared queries, server autopilot, and a terminating gateway
• DACL bootstrap, DNS recursors, and Raft snapshots

Which Consul agents participate in Raft and store authoritative cluster state?

• AServer agents
• BClient agents
• CSidecar proxies
• DIngress gateways

What is the main role of a Consul client agent?

• AIt joins the Raft quorum and elects leaders
• BIt provides a local Consul interface on a node and forwards requests to servers
• CIt terminates all external HTTPS traffic for the datacenter
• DIt replaces Envoy as the data plane

Why are Consul server clusters typically sized as 3 or 5 nodes rather than 4?

• AEven numbers disable DNS responses
• BOdd numbers maximize fault tolerance per server while still preserving quorum efficiently
• COnly three-node and five-node clusters support ACLs
• DConsul requires one server per availability zone exactly

Within a single datacenter, which mechanism do Consul agents use to share membership information?

• ALAN gossip
• BPrepared queries
• CDNS recursion
• DSnapshot replication

In Consul architecture, what is the data plane most closely associated with?

• ASidecar proxies that handle service-to-service traffic
• BServer agents that persist the catalog
• CCLI commands that manage ACLs
• DWAN gossip between datacenters

Which statement best describes how Consul can support applications running on virtual machines and Kubernetes at the same time?

• AIt requires separate, unrelated service catalogs for each platform
• BIt provides a common control plane so services across different runtimes can share discov…
• CIt supports service discovery on virtual machines but service mesh only on Kubernetes
• DIt can connect platforms only through terminating gateways

In a new production Consul datacenter, what is the most common number of server agents to start with?

• A1
• B2
• C3
• D6

Which setting lets an agent keep trying to join known Consul peers automatically on startup?

• A`bootstrap_expect`
• B`retry_join`
• C`recursor`
• D`node_meta`

Why do operators often run a Consul client agent on each application node?

• ATo add every application node to the Raft quorum
• BTo give local workloads a nearby DNS or API endpoint and avoid direct server dependence
• CTo replace service health checks with static catalog entries
• DTo make gossip encryption unnecessary

In a cloud environment where server IP addresses may change, which join approach is usually best?

• AHardcode a single leader IP with no retries
• BUse cloud auto-join or `retry_join` against provider-discovered instances
• CDisable gossip until all nodes are present
• DManually restore a snapshot on every client

When deploying Consul servers on Kubernetes, why is a StatefulSet a common choice?

• AIt gives pods stable network identities and persistent storage semantics
• BIt automatically configures ingress gateways
• CIt disables the need for TLS certificates
• DIt converts client agents into server agents

In a fresh deployment with `bootstrap_expect = 3`, what should you expect before the third server joins?

• AThe first server becomes leader immediately and accepts writes
• BThe cluster will not finish bootstrapping a stable server quorum yet
• CClient agents automatically promote themselves to servers
• DACLs are permanently disabled

An application wants to resolve a service name through its local Consul agent instead of calling the HTTP API. Which Consul interface should it use?

• ADNS
• BRaft
• CWAN gossip
• DSnapshot API

Which is a valid way to register a service with Consul?

• ADefine the service in an agent configuration file or register it through the agent API
• BAppend the service name to the server Raft log by hand
• CEnable DNS recursors on the client agent
• DPlace the service behind a mesh gateway only

In Consul, what does a service ID represent?

• AThe Raft leader node name
• BA specific registered instance of a service
• CThe name of the datacenter
• DThe gossip encryption key version

Why is registering a service through its local agent preferred over writing directly to servers?

• ALocal agents manage node-scoped registration and health information on behalf of the work…
• BServers reject all service data from clients
• COnly local agents can use DNS
• DDirect server registration is required only for Kubernetes

What is a prepared query primarily used for in Consul?

• ATo define reusable service lookup logic such as failover or filtering
• BTo rotate ACL tokens in bulk
• CTo encrypt gossip traffic with multiple keys
• DTo elect a new leader manually

If one instance of `api` has a failing health check while two others are passing, what is the expected effect on healthy lookups?

• AAll `api` instances are removed from discovery
• BOnly the failing instance is excluded from passing results
• CThe failing instance becomes the preferred result for troubleshooting
• DConsul deletes the service definition from every node

Which registration pattern best fits a service that exposes two distinct endpoints on different ports for different consumers?

• ARegister one service instance with multiple check intervals and no other distinction
• BRegister separate service definitions or instances so each endpoint can be discovered cle…
• CUse a snapshot restore whenever ports change
• DConvert the service into a server agent

A team wants clients to use one stable lookup name while Consul handles selecting healthy instances and failing over to another datacenter if needed. Which feature best matches that requirement?

• APrepared queries
• BLAN gossip encryption
• CServer autopilot
• DNode metadata

What is a key benefit of using Consul service mesh for service-to-service traffic?

• AIt adds mutual TLS and service identity without requiring each application to build those…
• BIt stores all application logs in the service catalog
• CIt removes the need for health checks
• DIt makes every service a Raft voter

What do Consul intentions control?

• AWhich services are allowed or denied when initiating connections to other services
• BWhich servers may participate in leader election
• CWhich DNS recursors forward external queries
• DWhich snapshots are kept after restore

In a sidecar proxy deployment, what is the sidecar proxy responsible for?

• APersisting cluster state to Raft
• BHandling connection proxying for its service instance, including mesh security features
• CBootstrapping the ACL system
• DReplacing the need for local agents

Why does the sidecar proxy model help teams adopt service mesh incrementally?

• AIt moves traffic encryption and policy enforcement into the proxy so many applications ne…
• BIt requires every application team to rewrite network calls for Envoy APIs
• CIt eliminates the need for any service registration
• DIt allows only Kubernetes workloads to use the mesh

What does gossip encryption protect in Consul?

• AMembership and coordination messages exchanged over gossip
• BHTTP responses returned by prepared queries
• CSnapshot files stored on disk
• DDNS queries forwarded to recursors

Why is enabling TLS still important even when gossip encryption is already enabled?

• ABecause gossip encryption does not secure Consul HTTP or RPC traffic or provide certifica…
• BBecause TLS is required before a datacenter can use DNS
• CBecause gossip encryption works only on Kubernetes
• DBecause TLS replaces the Raft protocol

What is the purpose of the Consul certificate authority (CA) in a TLS-enabled deployment?

• ATo sign and validate certificates used to establish trusted agent communication
• BTo store service health check results
• CTo generate prepared queries
• DTo replace ACL tokens

Which type of setting is used to require agents to verify certificates on incoming or outgoing TLS connections?

• ATLS verification settings such as `verify_incoming` and `verify_outgoing`
• BRaft snapshot thresholds
• CDNS recursor settings
• DPrepared query templates

An operator wants to protect both gossip membership traffic and the RPC or API traffic between agents. Which security combination is most appropriate?

• AGossip encryption plus TLS for agent communication
• BPrepared queries plus DNS recursors
• CClient agents plus snapshots
• DNode metadata plus mesh gateways

A Consul deployment gossip key remains secret, but the TLS CA private key is believed to be compromised. Which action is most directly required?

• AReissue trusted TLS certificates from a new or rotated CA
• BDo nothing if gossip encryption still works
• COnly restart client agents because server agents are unaffected
• DDisable ACLs until a new leader is elected

What is the primary purpose of an ACL token in Consul?

• ATo carry permissions for requests made to Consul resources
• BTo replace the need for TLS certificates
• CTo propagate gossip membership information
• DTo store service definitions on disk

Which statement best describes the relationship between ACL policies and tokens?

• APolicies authenticate servers, while tokens elect leaders
• BPolicies define allowed actions, and tokens are the credentials that carry those permissi…
• CPolicies replace service registrations, and tokens replace health checks
• DPolicies are only for DNS, while tokens are only for HTTP

After ACLs are enabled, why do operators usually bootstrap the ACL system?

• ATo obtain the initial management token needed to create policies and additional tokens
• BTo force all services to use ingress gateways
• CTo reset the gossip encryption key
• DTo promote client agents into the quorum

A service instance can register locally, but its requests to read from the Consul catalog are denied after ACLs are enforced. What is the most likely missing piece?

• AA token with permissions appropriate for the requested catalog access
• BA new gossip encryption key
• CA snapshot restore from the leader
• DA prepared query bound to the node name

Which gateway type is used to accept inbound traffic from outside the mesh and route it to internal services?

• AIngress gateway
• BMesh gateway
• CTerminating gateway
• DClient agent

Which gateway type is primarily used to carry service mesh traffic between Consul datacenters?

• AMesh gateway
• BAPI gateway
• CClient agent
• DPrepared query gateway

Why do mesh gateways simplify many multi-datacenter service mesh deployments?

• AThey centralize cross-datacenter traffic paths so every service instance does not need di…
• BThey replace the need for servers in remote datacenters
• CThey convert WAN gossip into DNS lookups
• DThey store remote snapshots automatically

Which operational signal is especially useful for detecting whether a Consul server cluster is healthy and stable?

• ALeader status and Raft peer health
• BThe number of DNS recursors configured
• CThe size of every application container image
• DThe operating system wallpaper on each node

In a Consul service mesh, which component commonly emits request metrics such as latency and error counts?

• ASidecar proxies such as Envoy
• BRaft snapshots
• CGossip encryption keys
• DACL bootstrap tokens

What is the main reason to monitor health check status and catalog state over time?

• ATo spot failing services or registration drift before clients experience widespread disco…
• BTo automatically rotate TLS certificates every minute
• CTo reduce the number of servers needed for quorum
• DTo disable DNS lookups when latency rises

Which command is used to create a snapshot backup of Consul server state?

• A`consul snapshot save`
• B`consul members save`
• C`consul acl snapshot`
• D`consul catalog export`