Free HashiCorp Consul-Associate Exam Questions

Question 1

You have two Consul datacenters and you want to enable federation so services in dc1 can discover services in dc2. You run the consul join wan node2.example.com.

However, servers in dc1 can not communicate with servers in dc2 and vice versa. Based on the snippets of the server configuration files can be found below, why would

this be assuming network connectivity is working as expected?

dc1 configuration

1. "datacenter": "dc1",

2. "server": true,

3. "key_file": "/etc/consul.d/cert.key",

4. "cert_file": "/etc/consul.d/client.pem",

5. "ca_file": "/etc/consul.d/chain.pem",

6. "verify_incoming": true,

7. "verify_outgoing": true,

8. "verify_server_hostname": true,

9. "ui": true,

10. "encrypt": "XIUEktl3YjG9KPJfaBU1xE69IZ0XhsNCSH423FyknJE=",

11. "bootstrap_expect": 5,

12. "enable_syslog": true,

dc2 configuration

1. "datacenter": "dc2",

2. "server": true,

3. "key_file": "/etc/consul.d/cert.key",

4. "cert_file": "/etc/consul.d/client.pem",

5. "ca_file": "/etc/consul.d/chain.pem",

6. "verify_incoming": true,

7. "verify_outgoing": true,

8. "verify_server_hostname": true,

9. "ui": true,

10. "encrypt": "LSBSOZI5+9EX/kdY8u27mX50rk1ywcprfUCoSZjnpUg=",

11. "bootstrap_expect": 5,

12. "enable_syslog": false,

A : gossip keys need to match between federated datacenters

B : verify_incoming setting should be set to false before WAN federation can be configured

C : client certificates are issued from different CAs

D : syslog configurations do not match

Answer: A

Question 2

Scenario: You have an application that uses Consul service discovery to connect to backend services in order to process data submitted by end-users. The front-end web

service consists of 3 containers, while the backend service consists of 5 static virtual machines. All of the front-end web servers and the backend servers are registered

with Consul.

During normal operations, a user complains that the data processing is taking too long. To troubleshoot, you run a DNS query against the DNS name for the backend

service, but discover that the response only contains three of the virtual machines. Why would Consul only respond with three servers rather than all five?

A : the response only included the three underutilized nodes

B : the DNS query must specify how many nodes to return in the response

C : health check is failing for the other two servers

D : nsul has a maximum response of three nodes in a given DNS query

Answer: C

Question 3

You need to deny communication between the customer-db service and the payment service using an intention. You open the command line and issue the following

command:

$ consul intention create customer-db payment

However, the two services can still initiate new connections even after the intention is created. What would explain this?

A : default behavior of the command issued is allow

B : the mTLS certificates are both signed by the same CA, therefore the connectivity is permitted regardless of an intention

C : services are communicating over HTTP rather than HTTPS

D : ere is an identical intention that is permitting the connectivity

Answer: A

Question 4

Which of the following is responsible for managing membership and broadcasting messages to the cluster?

A : ft (Paxos)

B : covery chain

C : rf (SWIM)

D : epared Queries

Answer: C

Question 5

You have a Consul cluster running production workloads in your environment. However, you've discovered that the cluster was initially deployed without gossip

encryption configured, which means that traffic is being sent in cleartext. The security team has requested this to be updated ASAP. However, you can't take an outage on

the Consul service right now, knowing the server nodes will stop communicating once you start editing the configuration files one by one.

How can you enable gossip encryption on the existing cluster without affecting the services it is currently providing the business?

A : Generate the new encryption key using consul keygen. Update all the Consul server agent configuration files with the new encryption key. Using a scheduling tool,execute the consul reload command for all nodes at the same time. This will ensure that there is minimal downtime for the Consul service.

B : Generate the new encryption key using consul keygen. Update each Consul agent configuration file with the new configuration and set additional parameters toverify incoming and outgoing encryption to false. Use rolling updates to walk through the steps of ultimately setting the parameters to true.

C : Generate the new encryption key using consul keygen. Use the command consul keyring -install and push the new encryption key out to all participatingnodes in the cluster. Finally, use the command consul keyring -use to instruct Consul to use the key for encryption

D : Generate the new encryption key using consul keygen. Update the Consul server agent configuration files with the new encryption key and issue a kill -HUP command so the Consul service reloads and picks up the new gossip configuration. Update and restart as a rolling update across the cluster so only asingle node is offline at a time.

Answer: B