Question 1

You have created a new gossip encryption key using consul keygen and installed it using the command consul keyring -install

TX/1dsj67x/4XdTeSG1Cb5RdC/cbAbv9Hch4H8cL8nk=.

However, when you try and delete the original gossip encryption key, you receive an error. Based on the error message below, what steps need to be taken in order to be

able to remove the old gossip encryption key?

1. $ consul keyring -remove /d+jMNoQWICjMvddXJXzyGPDWiEOFgApvUJcuPRcves=

2.

3. ==> Removing gossip encryption key...

4. error: Unexpected response code: 500 (12 errors occurred:

5. * WAN error: 5/5 nodes reported failure

6. * CONSUL-NODE-A.dc-1: Removing the primary key is not allowed

7. * CONSUL-NODE-C.dc-1: Removing the primary key is not allowed

8. * CONSUL-NODE-B.dc-1: Removing the primary key is not allowed

9. * CONSUL-NODE-D.dc-1: Removing the primary key is not allowed

10. * CONSUL-NODE-E.dc-1: Removing the primary key is not allowed

11. * dc-1 (LAN) error: 5/5 nodes reported failure

12. * CONSUL-NODE-E: Removing the primary key is not allowed

13. * CONSUL-NODE-A: Removing the primary key is not allowed

14. * CONSUL-NODE-D: Removing the primary key is not allowed

15. * CONSUL-NODE-B: Removing the primary key is not allowed

16. * CONSUL-NODE-C: Removing the primary key is not allowed

Options :

A :

wait until the old key is invalidated by Consul based upon the configured validity date

B : configure Consul to use the new key using the consul keyring -use command

C :

the original gossip key on a Consul cluster cannot be deleted

D : wait for Raft to replicate the new key across all cluster nodes before you can remove it

Answer: A

Question 2

What are two ways that a client or service can programmatically discover healthy nodes for a service registered in a local Consul cluster? (select two)

Options :

A : DNS

B : User Interface (UI)

C : HTTP API

D : federation

Answer: A,C

Question 3

Scenario: You are storing configuration settings for your application in Consul's K/V store, and each setting is critical to the successful implementation of the application.

A developer recently updated the value for app1, causing the deployment to fail.

What Consul feature can be used to monitor the K/V store for updates and automatically take action to remediate the issue?

Options :

A : set up an ACL to automatically restart the Consul service when a value is changed

B :

configure a watch and execute a script to update the application

C : set up health checks to monitor for changes to the K/V store

D : use the raft consensus protocol to replicate the changes from the other nodes when a value is changed

Answer: A

Question 4

True or False? A prepared query can be used to assist with service failover between multiple federated Consul datacenters.

Options :

A : false

B : true

Answer: B

Question 5

You have two Consul datacenters and you want to enable federation so services in dc1 can discover services in dc2. You run the consul join wan node2.example.com.

However, servers in dc1 can not communicate with servers in dc2 and vice versa. Based on the snippets of the server configuration files can be found below, why would

this be assuming network connectivity is working as expected?

dc1 configuration

1. "datacenter": "dc1",

2. "server": true,

3. "key_file": "/etc/consul.d/cert.key",

4. "cert_file": "/etc/consul.d/client.pem",

5. "ca_file": "/etc/consul.d/chain.pem",

6. "verify_incoming": true,

7. "verify_outgoing": true,

8. "verify_server_hostname": true,

9. "ui": true,

10. "encrypt": "XIUEktl3YjG9KPJfaBU1xE69IZ0XhsNCSH423FyknJE=",

11. "bootstrap_expect": 5,

12. "enable_syslog": true,

dc2 configuration

1. "datacenter": "dc2",

2. "server": true,

3. "key_file": "/etc/consul.d/cert.key",

4. "cert_file": "/etc/consul.d/client.pem",

5. "ca_file": "/etc/consul.d/chain.pem",

6. "verify_incoming": true,

7. "verify_outgoing": true,

8. "verify_server_hostname": true,

9. "ui": true,

10. "encrypt": "LSBSOZI5+9EX/kdY8u27mX50rk1ywcprfUCoSZjnpUg=",

11. "bootstrap_expect": 5,

12. "enable_syslog": false,

Options :

A : the gossip keys need to match between federated datacenters

B : the verify_incoming setting should be set to false before WAN federation can be configured

C : the client certificates are issued from different CAs

D : the syslog configurations do not match

Answer: A

Smartly Prepare Exam with Free Online Consul-Associate Practice Test

Buying Options: