HashiCorp Certified: Consul Operations Professional

Which command saves a snapshot of the current Consul state to a file named backup.snap?

• Aconsul snapshot save backup.snap
• Bconsul backup create backup.snap
• Cconsul state export --file backup.snap
• Dconsul agent --snapshot backup.snap

What does the `consul members` command display by default?

• AThe WAN gossip pool members across all datacenters
• BThe LAN gossip pool members of the local datacenter agent
• CAll registered services in the catalog
• DAll ACL tokens currently active in the cluster

Which command creates an ACL token with a specific policy named 'web-policy'?

• Aconsul acl token create --policy-name web-policy
• Bconsul acl policy create --token web-policy
• Cconsul acl token new -policy=web-policy
• Dconsul token create --attach-policy web-policy

Which command creates a service intention allowing 'web' to call 'db' at Layer 4?

• Aconsul intention create -allow web db
• Bconsul acl intention allow web db
• Cconsul connect intention create web db --allow
• Dconsul intention add --source web --destination db --action allow

In Consul's Raft consensus protocol, how many server nodes are required to tolerate one server failure while still achieving quorum?

• A2
• B3
• C4
• D5

What port does Consul use by default for the Serf LAN gossip protocol?

• A8300
• B8301
• C8302
• D8500

Which Consul agent mode runs with all features enabled but does NOT persist any state, making it suitable only for development?

• Aclient mode
• Bserver mode
• Cdev mode
• Dbootstrap mode

Which Consul configuration parameter defines the key-value path prefix an ACL policy grants access to?

• Akey_prefix
• Bkv_path
• Cpath_prefix
• Dkey_segment

What is the primary role of a Consul ingress gateway?

• ATo encrypt all service-to-service traffic using mTLS within the mesh
• BTo allow external clients outside the service mesh to reach mesh services
• CTo connect services across different Consul datacenters via WAN federation
• DTo route traffic from mesh services to external services not registered in Consul

Which Consul command restores a previously saved snapshot?

• Aconsul snapshot restore backup.snap
• Bconsul restore --snapshot backup.snap
• Cconsul agent --restore backup.snap
• Dconsul state import backup.snap

In Consul's ACL system, what is the relationship between a role and a token?

• AA role is a superset of a token and replaces it in Consul 1.5+
• BA token can be linked to one or more roles, and a role bundles one or more policies
• CA role is created from multiple tokens to aggregate permissions
• DA token and a role are interchangeable terms for the same ACL concept

Which Consul ACL policy rule grants a service the ability to register itself and read its own health checks?

• Aservice "web" { policy = "write" }
• Bservice "web" { policy = "read" }
• Cnode "web" { policy = "write" }
• Dservice_prefix "" { policy = "write" }

What happens to traffic between two services in a Consul service mesh when no intention exists for that pair?

• ATraffic is allowed by default
• BTraffic is denied by default
• CTraffic is allowed but logged as a warning
• DTraffic falls back to the default ACL policy setting

In Consul federation, which component allows service-mesh traffic to traverse between primary and secondary datacenters?

• AIngress gateway
• BTerminating gateway
• CMesh gateway
• DAPI gateway

Which Consul configuration block enables Connect (service mesh) on the agent?

• Aconnect { enabled = true }
• Bmesh { enable = true }
• Cservice_mesh { active = true }
• Dproxy { enabled = true }

What is the purpose of the `bootstrap_expect` configuration parameter in a Consul server agent?

• AIt sets the number of servers needed before ACL bootstrapping can begin
• BIt defines the number of server agents that must join before the cluster elects a leader
• CIt specifies the expected number of client agents in the datacenter
• DIt limits the number of Raft log entries retained on disk

Which Consul CLI flag restricts `consul members` output to only show WAN pool members?

• A-wan
• B--datacenter=all
• C-federated
• D-global

In a Consul on Kubernetes deployment using the official Helm chart, which annotation enables automatic sidecar proxy injection for a pod?

• Aconsul.hashicorp.com/connect-inject: 'true'
• Bconsul.hashicorp.com/sidecar: 'enabled'
• Cproxy.consul.io/inject: 'true'
• Dmesh.consul.io/enabled: 'true'

What is the function of the Consul `autopilot` feature?

• AAutomatically rotate mTLS certificates for all mesh services
• BAutomatically manage server health, dead server cleanup, and stable leader promotion
• CAutomatically generate ACL tokens for newly registered services
• DAutomatically sync Kubernetes service registrations to Consul catalog

Which Consul config entry type defines Layer-7 traffic routing rules such as path-based routing or header matching?

• Aservice-router
• Bservice-splitter
• Cservice-resolver
• Dproxy-defaults

In the Consul Raft protocol, what occurs when a follower node does not receive a heartbeat from the leader within the election timeout?

• AThe follower immediately becomes the new leader
• BThe follower transitions to the candidate state and starts a new election
• CThe follower sends an alert to the operator and waits
• DThe follower demotes itself to a client agent

Which Consul KV operation atomically reads a value and returns a ModifyIndex for use in a Check-And-Set (CAS) write?

• Aconsul kv get -detailed key
• Bconsul kv cas get key
• Cconsul kv get --atomic key
• Dconsul kv watch key

What is the Consul Serf protocol primarily responsible for?

• AStoring and replicating key-value data across the cluster
• BMembership, failure detection, and event broadcasting among agents
• CEncrypting all RPC communications between Consul servers
• DManaging mTLS leaf certificate issuance for Connect-enabled services

Which command lists all ACL tokens currently in a Consul datacenter?

• Aconsul acl token list
• Bconsul acl list --tokens
• Cconsul token list --all
• Dconsul acl show tokens

In Consul Connect, which proxy is deployed by default as a sidecar to handle mTLS and intentions enforcement?

• AHAProxy
• BNGINX
• CEnvoy
• DLinkerd

Which Consul ACL namespace feature allows different teams to manage their own services and policies without interfering with each other?

• AACL partitions
• BACL namespaces
• CACL segments
• DACL scopes

What does the `consul debug` command collect?

• AReal-time streaming metrics from all registered services
• BA bundle of diagnostic data including logs, metrics, profiles, and cluster state
• CA list of all failed Raft log entries
• DA diff of the current Consul state against the last snapshot

In Consul's primary/secondary datacenter model, which datacenter holds the global ACL token source of truth?

• AThe secondary datacenter, because it handles most read traffic
• BThe primary datacenter
• CBoth datacenters share a distributed token store
• DThe datacenter closest to the majority of services

Which Consul HTTP API endpoint uses a blocking query that waits until a service health state changes?

• AGET /v1/health/service/{service}?wait=60s&index={modifyIndex}
• BPOST /v1/health/service/{service}/watch
• CGET /v1/catalog/service/{service}?blocking=true
• DGET /v1/health/watch/{service}

A Consul server cluster has 5 nodes. How many server failures can the cluster sustain while maintaining quorum?

• A1
• B2
• C3
• D4

Which Consul Connect configuration entry type defines percentage-based traffic splitting between two service versions?

• Aservice-router
• Bservice-splitter
• Cservice-resolver
• Dservice-defaults

What does the `consul kv put` command do when the key already exists?

• AIt fails and returns an error
• BIt overwrites the existing value
• CIt appends the new value to the existing value
• DIt creates a new version while keeping the old value

In Consul's mutual TLS implementation for Connect, which entity signs the leaf certificates presented by sidecar proxies?

• AThe Consul server leader directly
• BThe Connect CA configured on the cluster
• CEach individual Consul agent generates its own self-signed certificate
• DAn external PKI system must always be used; Consul cannot issue leaf certs

Which Consul configuration file parameter sets the symmetric encryption key for gossip traffic?

• Aencrypt
• Bgossip_key
• Cserf_encrypt
• Dtls_key

Which Consul-K8s component is responsible for syncing Kubernetes services into the Consul catalog?

• Aconsul-connect-injector
• Bconsul-sync-catalog
• Cconsul-k8s-controller
• Dconsul-agent-daemonset

What is the purpose of a Consul terminating gateway?

• ATo terminate TLS connections from external clients entering the mesh
• BTo allow mesh services to reach external services not registered in Consul
• CTo terminate a mesh gateway connection when a datacenter is removed from federation
• DTo provide load balancing for services with multiple healthy instances

Which Consul agent configuration option specifies the directory from which the agent loads all .json and .hcl configuration files?

• Aconfig_dir
• Bconfig_path
• Cconf.d
• Ddata_dir

How does Consul's built-in Prometheus metrics endpoint get enabled?

• ABy setting `telemetry { prometheus_retention_time = "60s" }` in the agent config
• BBy installing the Prometheus Consul exporter sidecar on every server
• CBy setting `metrics { provider = "prometheus" }` in the agent config
• DBy enabling `enable_prometheus = true` in the telemetry block

In Consul's L7 intentions, which config entry type is used to define per-path HTTP permissions between services?

• Aservice-intentions
• Bservice-router
• Cproxy-defaults
• Dservice-defaults

What is the `consul operator raft list-peers` command used for?

• AListing all Consul client agents registered in the datacenter
• BShowing the current Raft peer set including node roles and commit indexes
• CListing all federation peers across WAN-connected datacenters
• DDisplaying active mTLS peer certificates in the Connect CA

When deploying Consul on Kubernetes with the Helm chart, what does setting `server.replicas=3` configure?

• AThe number of Consul client agent pods per node
• BThe number of Consul server pods forming the Raft cluster
• CThe number of Envoy sidecar proxies deployed per service
• DThe number of mesh gateway replicas for cross-DC traffic

Which Consul configuration option defines the datacenter name that agents use for routing and federation?

• Aregion
• Bdatacenter
• Cdc_name
• Dsite

Which Consul Connect feature allows defining failover behavior when the primary service instances are unhealthy?

• Aservice-splitter
• Bservice-router
• Cservice-resolver
• Dproxy-defaults

What is the default TTL for Connect-issued leaf certificates in Consul's built-in CA?

• A8 hours
• B24 hours
• C72 hours
• D30 days

In a WAN-federated Consul deployment, which port must be open between datacenters for cross-DC RPC?

• A8300
• B8301
• C8302
• D8500

What does the `-stale` flag do when passed to a Consul CLI query?

• AForces the request to go only to the leader for guaranteed consistency
• BAllows any server to respond, potentially returning slightly outdated data
• CDisables caching so every request fetches fresh data
• DReturns data from the local agent cache without contacting any server

Which Consul ACL policy resource type controls access to Consul's KV store?

• Aservice
• Bnode
• Ckey
• Dagent