HashiCorp · Consul-Associate
HashiCorp Certified: Consul Associate Practice Tests
Validates knowledge of HashiCorp Consul for service networking, covering Consul architecture and deployment, service registration and discovery, health checking, service mesh with intentions and traffic management, and the key/value store for configuration management.
Exam Details
Practice Questions
629
≈ 11 practice exams
Duration
60 minutes
Passing Score
70%
Difficulty
AssociateLast Updated
Feb 2026
HashiCorp Certified: Consul Associate Practice Exam Preparation
Use this Consul-Associate practice exam to prepare for HashiCorp Certified: Consul Associate with realistic questions, detailed explanations, and focused study modes. The practice bank includes 629 questions for HashiCorp Consul-Associate, so you can review the exam steadily instead of relying on one long cram session.
As you practice, pay extra attention to patterns in your missed answers. Start with short sessions to identify weak areas, then move into timed quizzes once your accuracy is consistent.
The explanations are especially useful when you want to connect exam wording to the responsibilities and scenarios described in the official certification guidance. Use the free preview first, then unlock the full question bank when you are ready to build a complete study routine.
Exam Overview
The HashiCorp Certified: Consul Associate (003) validates foundational knowledge and practical skills with HashiCorp Consul, an open-source service networking platform. The certification covers the full spectrum of Consul capabilities, including service discovery, health monitoring, service mesh with sidecar proxies, access control lists (ACLs), gossip and TLS encryption, and key/value store usage for configuration management. Candidates are expected to understand Consul's architecture across single and multi-datacenter deployments, as well as its deployment on both virtual machines and Kubernetes environments.
The exam tests against Consul version 1.15 and includes objectives spanning 10 domains with 35 specific objectives. It distinguishes between Consul Community Edition and Consul Enterprise features, ensuring certified professionals can identify the boundaries of open-source capabilities versus commercial offerings. The certification is valid for two years, with recertification available starting six months before expiration by passing the current 003 version of the exam.
Who Should Take This Exam
The Consul Associate certification targets cloud engineers who specialize in security, development, networking, or operations. Typical candidates include site reliability engineers (SREs), solutions architects, DevOps engineers, and platform engineers who work with service networking infrastructure in production environments.
Candidates should have foundational familiarity with Consul concepts and basic hands-on experience. While professional production experience with Consul is the ideal preparation baseline, HashiCorp acknowledges that candidates who have practiced all exam objectives in a personal lab or demo environment may also be sufficiently prepared. The exam is not suited for complete beginners to networking or distributed systems.
Prerequisites
There are no formal prerequisites or required prior certifications to sit for the Consul Associate exam. However, HashiCorp recommends that candidates possess practical knowledge of containerization, basic terminal and CLI skills, networking fundamentals (TCP/IP, DNS, load balancing), an understanding of access control lists (ACLs), and familiarity with the TLS certificate lifecycle including certificate issuance, rotation, and revocation.
Candidates benefit most from hands-on experience deploying and operating Consul in real environments, including configuring Consul agents, registering services, setting up intentions in the service mesh, and managing gossip and RPC encryption. Prior exposure to Kubernetes is also advantageous given the exam covers Consul deployment on Kubernetes clusters.
Exam Format
The Consul Associate (003) exam consists of approximately 57 questions to be completed within 60 minutes. Question types include true/false, multiple choice (single answer), and multiple answer (select all that apply) formats. The exam is delivered online through a proctored testing environment and can be taken remotely. The passing score is 70%, and the exam fee is $70.50 USD. Retake policies allow one free retake if the candidate does not pass on the first attempt.
The exam is computer-based and does not include hands-on or lab components — it is a knowledge assessment only. Upon passing, candidates receive a digital badge via Credly and a downloadable certificate. Certifications are valid for two years from the date of passing.
Skills Measured
- 1.Understand the pillars of service networking: Covers service discovery, health monitoring, service mesh security with intentions, gateway access control (mesh, ingress, terminating, API gateways), and network infrastructure automation — foundational concepts for understanding Consul's value proposition.
- 2.Describe Consul architecture: Covers datacenter components (servers, clients, agents), server high availability and scalability via Raft consensus, differences between server and client agents, and multi-platform deployment models including VMs and Kubernetes.
- 3.Deploy a single datacenter: Covers configuring Consul server and client agents, deploying Consul on Kubernetes using Helm, and methods for agents to join a datacenter (auto-join, manual join).
- 4.Register services and use service discovery: Covers service registration via configuration files and API, configuring health checks (HTTP, TCP, script, TTL), querying the service catalog using DNS and HTTP API, and using prepared queries.
- 5.Use Consul service mesh: Covers service mesh architecture and sidecar proxy configuration, creating and managing service intentions for traffic authorization, and configuring proxies for service-to-service communication.
- 6.Secure agent communication: Covers Consul's security model addressing eavesdropping, tampering, and spoofing threats, configuring TLS for RPC encryption, managing CA and certificates, and enabling gossip encryption with keyrings.
- 7.Secure services with basic ACLs: Covers ACL system components (bootstrap token, policies, roles, tokens), creating and applying ACL policies and tokens, and using tokens to authorize agent and service operations.
- 8.Secure and connect service mesh applications: Covers configuring gateways (ingress, terminating, mesh) for multi-datacenter and external service connectivity, and enabling cross-datacenter service mesh communication.
- 9.Monitor Consul: Covers enabling observability features in the service mesh (metrics, tracing, access logging), and monitoring datacenter health including server status, raft metrics, and log analysis.
- 10.Operate and maintain Consul: Covers server management tasks (adding/removing servers), security maintenance (certificate and gossip key rotation), backup and restore procedures using snapshots, and troubleshooting common issues.
Study Tips
- Work through the official HashiCorp Developer learning path at developer.hashicorp.com/consul/tutorials/certification-003/associate-study-003 — it maps every exam objective to specific tutorials and documentation pages, making it the most targeted study resource available.
- Review the official Exam Content List (developer.hashicorp.com/consul/tutorials/certification-003/associate-review-003) and self-assess against each of the 35 objectives across 10 domains. Use it as a checklist to identify weak areas before the exam.
- Practice deploying Consul in a local lab using Docker or Vagrant, and separately in a Kubernetes cluster using the official Helm chart. Hands-on configuration of agents, ACLs, intentions, TLS, and gossip encryption solidifies the concepts tested most heavily.
- Study the differences between Consul Community Edition and Consul Enterprise features — the exam specifically tests your ability to distinguish between the two. Review the Enterprise feature list in the official Consul documentation.
- Complete the official sample questions at developer.hashicorp.com/consul/tutorials/certification-003/associate-questions-003 to familiarize yourself with question phrasing and the multiple-answer format, which requires selecting all correct answers without partial credit.
- Focus dedicated study time on Consul's security model: understand how gossip encryption, TLS for RPC, ACL tokens/policies, and service intentions each address different threat vectors (eavesdropping, tampering, spoofing, unauthorized access).
- Use the HashiCorp Consul documentation on the service mesh gateway types (ingress, terminating, mesh, API) and practice configuring each one — these are commonly tested and easy to confuse without hands-on experience.
Career Benefits
The Consul Associate certification is valued by organizations adopting service mesh architectures, microservices, and zero-trust networking on cloud-native and hybrid infrastructure. Certified professionals are well-positioned for roles such as platform engineer, cloud infrastructure engineer, site reliability engineer, DevOps engineer, and solutions architect at companies standardizing on HashiCorp's product stack. Consul expertise is particularly sought after in enterprises running large-scale Kubernetes or multi-cloud deployments where service discovery and secure east-west traffic management are critical.
HashiCorp certifications are recognized across the industry as a signal of practical tool knowledge, and the Consul Associate complements adjacent certifications such as the Terraform Associate and Vault Associate for professionals building a broad HashiCorp credential portfolio. While specific salary premiums for Consul alone are not independently published, DevOps and cloud infrastructure engineers with HashiCorp certifications and service mesh expertise typically command salaries in the $110,000–$160,000+ USD range in North American markets, reflecting strong demand for professionals who can design and operate secure, scalable service networking platforms.
Sample Questions
5 sample questions with answers and explanations. The full bank has 629 questions, enough for 11 full-length practice exams.
Preview — answers shown1. A security team implements L7 service intentions for an HTTP-based microservices application. They create an intention from web to api with permissions allowing GET requests to PathPrefix /public and denying all requests to PathExact /admin/secrets. A developer sends a GET request to /admin/secrets/keys from the web service. What happens to this request? (Select one!)
AThe request is denied because /admin/secrets/keys matches PathPrefix /admin
BThe request is allowed because PathPrefix /public is evaluated first
CThe request evaluation depends on the acl_default_policy configuration
DThe request is denied because PathExact /admin/secrets takes precedence over PathPrefix matches
Explanation
Consul applies L7 permissions in the order specified in the configuration entry. Since the request to /admin/secrets/keys does not match PathExact /admin/secrets exactly, and does not match PathPrefix /public, it does not match any defined permissions. For requests that do not match any defined permissions, Consul applies the intention behavior defined in the acl_default_policy configuration. PathExact requires an exact URI match, so /admin/secrets/keys does not match /admin/secrets exactly. The order of evaluation follows the configuration file order, not automatic precedence.
2. A platform team configures cloud auto-join for their Consul cluster running on AWS. They need to tag EC2 instances so Consul servers can automatically discover each other. Which command format should they use in the retry_join configuration? (Select one!)
Aretry_join = ["provider=aws config=consul-server"]
Bretry_join = ["aws://tag:consul-server=true?region=us-east-1"]
Cretry_join = ["auto-join=aws tags=consul-server region=us-east-1"]
Dretry_join = ["provider=aws tag_key=consul-server tag_value=true region=us-east-1"]
Explanation
The correct cloud auto-join format uses provider=aws with tag_key and tag_value parameters to specify which EC2 instances to join, along with the region. The command follows the pattern retry_join with provider and configuration key-value pairs. The aws:// URL format is not the correct Consul cloud auto-join syntax. The config parameter does not accept tag names directly. The auto-join keyword is not part of the valid syntax.
3. A company needs to connect two Consul datacenters for service discovery across regions. They want to enable cross-datacenter queries while keeping ACL tokens and KV store data synchronized from the primary datacenter. Which approach should they use? (Select one!)
AService mesh with intentions replication
BMesh gateway in local mode
CWAN federation with primary_datacenter configuration
DCluster peering with exported-services configuration
Explanation
WAN federation with primary_datacenter configuration enables cross-datacenter service discovery, ACL token replication, and KV store sharing. Secondary datacenters configure primary_datacenter pointing to the primary, enabling automatic replication of ACLs and shared access to the KV store. Cluster peering does not replicate ACL tokens or KV data, only exported services between independent clusters. Mesh gateways route service mesh traffic but do not replicate ACLs or KV stores. Intentions replication is a subset of federation capabilities and does not address the full requirements.
4. An operations team executes consul keyring -install <new-key> to begin rotating gossip encryption keys. What is the next command they must run to complete the rotation and make the new key the primary encryption key? (Select one!)
Aconsul keyring -switch <new-key>
Bconsul keyring -use <new-key>
Cconsul keyring -activate <new-key>
Dconsul keyring -promote <new-key>
Explanation
The correct gossip encryption key rotation sequence is: first install the new key on all nodes using consul keyring -install, then switch to using the new key as the primary encryption key with consul keyring -use, and finally remove the old key with consul keyring -remove. The -use command changes which key is actively used for encrypting new gossip messages while still allowing decryption with the old key. This ensures zero-downtime rotation. The -promote, -activate, and -switch subcommands do not exist in the consul keyring command. The complete command set includes -install, -use, -remove, and -list.
5. A development team configures a service-splitter for the web service with two splits: 85% weight to ServiceSubset v1 and 15% weight to ServiceSubset v2. After deploying the configuration, they discover the splits are not being applied and all traffic routes to v1. What is the most likely cause? (Select one!)
AService splitters only work with mesh gateways in transparent proxy mode
BService splitters require a service-defaults entry with protocol set to http
CThe weights must sum to exactly 100 and the configuration has a validation error
DThe ServiceSubset values must be defined in a separate service-resolver configuration entry
Explanation
Service splitters reference ServiceSubset values that must be defined in a service-resolver configuration entry. Without a corresponding service-resolver defining what v1 and v2 mean (typically through filters), the splitter cannot function and traffic falls back to default routing. The weights of 85 and 15 do sum to 100, meeting the requirement. While setting protocol to http in service-defaults is required for L7 features like service-router, service-splitter works at L4 and does not require this. Service splitters work independently of mesh gateways and transparent proxy mode.
$17.99
One-time access to this exam
629 questions (11 practice exams' worth)
Unlimited timed exam simulations
Yours forever — no subscription
Detailed explanations
Free preview stays available