Hashicorp HASHICORP CONSUL Practice Questions

The latest changes and updates from the administration for this exam.

verified

Latest Update: Jun 09 2026

All questions are working fine.

All Questions (170)bookmarkBookmarked (0)

All170Show all accessible questions in this exam.Missed170Questions you haven't attempted yet.Incorrect0Questions you answered incorrectly on your last attempt.

Question 11

Which of the following are benefits of using Consul for service discovery? (select 3)

Select all that apply

simplified communication between microservices

single point of contact for a service where the underlying containers may be dynamic or frequently change

reduction or elimination of load balancers for east/west traffic

scheduling of services and containers for application redundancy

Question 12

True or False? Using the / character, Consul organizes the data in a directory structure, similar to a file system.

false

true

Question 13

While all of the TLS encryption settings are recommended, only some satisfy the security/threat model. When you set verify_server_hostname to true, what is true about the TLS certificate for this to work properly? (select three)

Select all that apply

the certificate hostname should match server.<datacenter>.<domain> format

verify_server_hostname prevents a client from modifying its configuration and becoming a Consul server

it verifies the hostname for all requesting clients against the DNS records found in Consul or an authoritative DNS server for the specified domain

it is used to ensure outgoing connections perform hostname verification

Question 14

You have a Consul cluster running production workloads in your environment. However, you've discovered that the cluster was initially deployed without gossip encryption configured, which means that traffic is being sent in cleartext. The security team has requested this to be updated ASAP. However, you can't take an outage on the Consul service right now, knowing the server nodes will stop communicating once you start editing the configuration files one by one.

How can you enable gossip encryption on the existing cluster without affecting the services it is currently providing the business?

Generate the new encryption key using consul keygen. Update each Consul agent configuration file with the new configuration and set additional parameters to verify incoming and outgoing encryption to false. Use rolling updates to walk through the steps of ultimately setting the parameters to true.

Generate the new encryption key using consul keygen. Use the command consul keyring -install <key> and push the new encryption key out to all participating nodes in the cluster. Finally, use the command consul keyring -use <key> to instruct Consul to use the key for encryption

Generate the new encryption key using consul keygen. Update the Consul server agent configuration files with the new encryption key and issue a kill -HUP <process ID> command so the Consul service reloads and picks up the new gossip configuration. Update and restart as a rolling update across the cluster so only a single node is offline at a time.

Generate the new encryption key using consul keygen. Update all the Consul server agent configuration files with the new encryption key. Using a scheduling tool, execute the consul reload command for all nodes at the same time. This will ensure that there is minimal downtime for the Consul service.

check_circle

Correct AnswerA

Gossip encryption can be enabled on existing datacenters but requires several extra steps. The additional configuration of the agent configuration parameters, encrypt_verify_incoming and encrypt_verify_outgoing is necessary.

1) Generate an encryption key using consul keygen.

2) Set the encrypt key, and set encrypt_verify_incoming and encrypt_verify_outgoing to false in the agent configuration file. Then initiate a rolling update of all the agents with these new values. After this step, the agents will be able to decrypt gossip but will not yet be able to send encrypted traffic.

3) A rolling update can be made by restarting the Consul agents (clients and servers) in turn. consul reload or kill -HUP <process_id> is not sufficient to change the gossip configuration.

4) Update the encrypt_verify_outgoing setting to true and perform another rolling update of all the agents by restarting Consul on each agent. The agents will now be sending encrypted gossip but will still allow incoming unencrypted traffic.

5) The previous step, enabling verify outgoing, must be completed on all agents before continuing. Update the setting to true and perform a final rolling update on all the agents.

---------------------------------------------------------------------------

Incorrect Answers:

1) Using the consul keyring -install and -use won't work since encryption was never enabled on the cluster in the configuration file. You'll get an error like this (I tried to see if this would work...for science - ya know...but got the error below):

2) consul reload command won't work, since consul reload isn't sufficient to pick up the gossip configuration changes as mentioned in step 3 above. Also, the answer specifically says to update the server configuration files. While this is needed, you also need to update all client configuration files to include the new encryption key as well. Tricky.

3) using kill -HUP <process ID> isn't sufficient to pick up the gossip configuration changes. Also, I mentioned only server configurations here as well. Another tricky one.

https://developer.hashicorp.com/consul/tutorials/security/gossip-encryption-secure#enable-on-an-existing-consul-datacenter

Question 15

What ports does Consul use as the default for the incoming DNS listener, where clients can send DNS queries for service discovery? (select two)

Select all that apply

udp/53

tcp/8600

udp/8600

tcp/53

Question 16

You have successfully configured a service and a related sidecar proxy in Consul. You have started the web service and verified that it is running but the traffic is not being passed through the local proxy to reach the destination service. What could be a reason for this? (select two)

Select all that apply

an intention is blocking the communication

the built-in proxy was not bootstrapped

the Consul KV store has not been configured correctly

the sidecar service is not running

Question 17

You've logged into the Consul UI and want to modify the policy that is used by a token assigned to an application. However, you see this screen when clicking the ACL tab. What must you provide in order to access the ACL configuration page?

reconfirm your password used to log into Consul

the policy ID that you want to modify

the accessor ID of the master token

provide the master token or another token with sufficient privileges

Question 18

Your security team has established company policies that require encryption keys to be rotated at least once a year for all applicable systems. Consul has been identified as an affected system, and the encryption key for gossip must be rotated across the entire environment. However, you have multiple Consul clusters, each consisting of five Consul nodes and hundreds of services registered with Consul, each of which has the gossip key explicitly written to the configuration file.

What built-in Consul feature allows you to distribute a new encryption key to all the servers and nodes and remove the old one?

use consul exec command

use consul maint command

use the consul keyring command

use the consul keygen command

Question 19

There are two methods for creating and distributing client certificates for Consul. What are the two? (select two)

Question 20

Based on the Consul agent configuration below, what parameter will determine which interface Consul will use for internal cluster communications?

"bind_addr": "10.0.30.186"

"node_name": "node-a.example.com"

"client_addr": "0.0.0.0"

"verify_outgoing": true

Update History

Update History