HashiCorp Certified: Consul Associate (003) Practice Test

Identify Consul datacenter components including agents and communication protocols options

• Understand that the number of servers affects quorum, network speed, and high availability
• Explain the process of leader election among servers, including the communication protocol that supports the process

• Differentiate between Consul agent roles and the different responsibilities that come with them
• Differentiate between Consul control plane and Consul data plane components, including the differences between client agents for VMs and dataplanes for Kubernetes and ECS

Understand that Consul can run on multiple platforms, including VMs, Kubernetes, and HCP

• Understand the process to deploy Consul on VMs
• Understand that the Consul service should run as a daemon

Be aware of the different ways to configure Consul, such as configuration files, the CLI, and the HTTP API, including required parameters for the configuration methods

Understand the process to deploy Consul on Kubernetes

Understand the benefits of each cluster joining method and their use cases

Recognize basic service definition parameters

• Understand how services and health checks can be registered with Consul clients
• Be aware that service definitions in the configuration directory require reloading the Consul agent for new files and updates to take effect

Understand service health check configuration options and behaviors

• Summarize the function of the Consul catalog and how it enables service discovery using the DNS or HTTP interfaces
• Understand how Consul DNS load balances healthy services

Know the different options for failover offered by prepared queries

• Be able to understand the different components of a Consul service mesh and how they interact with each other
• Understand that Consul contributes to the zero trust security model by securing service-to-service communication

Understand the principles of intentions, how to use them to simplify traffic permissions, and ways to manage them

• Understand that each service will need a proxy registration to be part of the mesh and that the operator must start the proxy with the Consul CLI
• Be able to identify upstream and local services in an example proxy configuration
• Use the Consul CLI to start a built-in proxy
• Identify that Consul has L4 and L7 traffic management capabilities

Understand the communication channels between Consul nodes, the communication channels between Consul and external nodes, and associated risks as well as their countermeasures

• Recognize that the servers should all have unique certificates
• Identify that Consul has a built-in certificate authority and that all certificates need to be signed by the same CA

Understand that all agents need to be configured to be secure

• Understand that gossip encryption is a network traffic security feature of Consul
• Know how to configure agents with gossip encryption and that all agents in the datacenter must share the same key
• Identify the data that can be accessed with the encryption key
• Understand that keys need to be rotated
• Identify the key generation Consul CLI command

Know how to set up and configure a basic ACL system including rules, policies, and tokens

• Understand that agent ACL tokens are not persisted by default unless the Consul agent configuration option acl.enable_token_persistence is set to true
• Understand how to create a token with multiple policies
• Understand that ACL token management for Consul components can be automated with Consul on Kubernetes

• Practice performing Consul operations using tokens with the CLI and API
• Know how to set CONSUL_HTTP_TOKEN as an environment variable so that the CLI has the correct permissions to perform Consul operations
• Identify that all agents must use ACLs to ensure secure service-to-service communication
• Be able to perform CLI and API requests using a token

Differentiate between the gateways that provide connectivity into, out of, and between Consul service meshes

• Understand the similarities and differences between WAN federation and cluster peering
• Understand that federation enables communication between multiple Consul datacenters
• Understand that federation is possible between Consul datacenters of any type (Kubernetes, VM, HCP)
• Understand that services can communicate between Kubernetes and VM Consul clusters by using mesh gateways

• Understand the scope of observability for the Consul data plane
• Identify the source of metrics and logs for the Consul data plane
• Understand how Consul contributes to observability capabilities by monitoring individual service health

• Recognize how Consul server metrics and logs provide insight into the health and performance of Consul clusters
• Understand the benefit of audit logs
• Understand that Consul can stream data for ingestion into existing monitoring systems such as Grafana

• Understand the process for adding new servers to an existing Consul cluster
• Understand the process for upgrading Consul

Be familiar with the maintenance activities required to ensure Consul communication security

• Understand the components of Consul state and data stored inside the agents at a high level
• Be aware of the sensitive data stored in a backup
• Identify the best practices and operations involved with consul snapshot
• Recall that Enterprise backups can be automated and scheduled

Be aware of the various Consul troubleshooting options and the functionality that each provides