I85PREP
⌘ K
Consul Associate study materials
Consul Associate study resources

Consul Associate practice questions

One question at a time. Build your Consul Associate understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Consul Architecture and Core Concepts

Which statement describes the role of a Consul agent running in client mode?

  1. It forwards RPCs to the servers and runs local health checks Correct answer.
  2. It stores the authoritative service catalog for the datacenter
  3. It proxies all inbound traffic to registered service instances
  4. It participates in the Raft quorum and replicates the catalog to peers

Explanation

A client agent is a lightweight daemon on every node that owns the local service and check definitions, performs the health checks, and forwards RPCs to the servers. It does not vote in Raft or hold the authoritative catalog, which live on server agents.

Question 2Consul Architecture and Core Concepts

By default, on which port does a Consul agent answer DNS queries?

  1. 8500
  2. 8301
  3. 8300
  4. 8600 Correct answer.

Explanation

The DNS interface listens on port 8600 and resolves names such as web.service.dc1.consul. The other ports carry RPC, HTTP API, and gossip traffic respectively.

Question 3Consul Architecture and Core Concepts

Which mechanism does Consul use for cluster membership and failure detection within a datacenter?

  1. HTTP long polling
  2. Serf gossip Correct answer.
  3. Raft
  4. gRPC

Explanation

Consul embeds Serf, which uses a gossip protocol to maintain membership and detect failures quickly and with low overhead. Raft is used only for consensus among servers.

Question 4Consul Architecture and Core Concepts

Which protocol does Consul use to reach consensus on state changes among its servers?

  1. Serf
  2. Raft Correct answer.
  3. SWIM
  4. Paxos

Explanation

Consul servers use Raft to agree on log entries and to elect a leader; the leader applies writes and replicates them to followers. Consensus is what makes the catalog and key/value data consistent.

Question 5Consul Architecture and Core Concepts

A datacenter runs exactly three Consul servers. How many server failures can it sustain and still have quorum?

  1. It tolerates the loss of three servers, since client agents keep quorum
  2. It tolerates the loss of two servers
  3. It tolerates the loss of one server Correct answer.
  4. It tolerates no server loss, since all three must be online

Explanation

Quorum for three servers is two, calculated as a majority of the voting servers. Losing one server leaves two, which is still a majority, so writes can continue.

Question 6Consul Architecture and Core Concepts

What does a datacenter represent in Consul's architecture?

  1. An AWS region that is bound to exactly one VPC
  2. A low-latency network domain with its own servers and gossip pool Correct answer.
  3. A single Consul server process and its local state directory
  4. A logical namespace that partitions key/value data inside one cluster

Explanation

Consul defines a datacenter as a low-latency network environment that has its own set of servers, its own LAN gossip pool, and its own Raft replication. Multiple Consul datacenters can even share one physical facility as long as the network latency is low.

Question 7Consul Architecture and Core Concepts

Which Consul feature stores arbitrary configuration data under indexed keys?

  1. Prepared queries
  2. Intentions
  3. Sessions
  4. The key/value store Correct answer.

Explanation

The key/value store holds arbitrary data at a path hierarchy, and every entry carries a modify index used for blocking queries and CAS operations. It is commonly used for dynamic configuration and feature flags.

Question 8Consul Architecture and Core Concepts

How does a service typically make itself discoverable in a Consul datacenter?

  1. By registering with the DNS server it discovers over mDNS
  2. By writing its address into a Raft log entry directly
  3. By registering with the local Consul agent Correct answer.
  4. By publishing its address to the WAN gossip pool

Explanation

A service registers through its local agent, either through a service definition file or the agent's HTTP API. The agent then syncs that definition to the servers so other clients can discover it.

Question 9Consul Architecture and Core Concepts

What happens when a Consul agent is started with the -dev flag?

  1. It runs a single in-memory server with persistence disabled, for testing Correct answer.
  2. It runs as a client agent and refuses all writes
  3. It enables production defaults including TLS and ACLs
  4. It joins an existing datacenter as a read-only replica

Explanation

Dev mode starts a server that keeps all state in memory and makes no attempt to persist it, which makes it convenient for experiments and unsuitable for production. It does not configure security features for you.

Question 10Consul Architecture and Core Concepts

What is the anti-entropy mechanism in a Consul agent responsible for?

  1. Reconciling local service and check state with the catalog Correct answer.
  2. Removing expired entries from the key/value store
  3. Electing a new Raft leader when the current leader fails
  4. Encrypting traffic between the agent and the servers

Explanation

Each agent periodically compares its locally configured services and checks against what the catalog holds and pushes any differences. This reconciliation repairs drift caused by missed registrations or agent restarts.

Question 11Consul Architecture and Core Concepts

A service registers a TTL health check with a 30-second TTL and then never calls the pass endpoint. What does the agent report?

  1. The check is marked critical once the TTL expires Correct answer.
  2. The check is deleted and no health status is reported
  3. The check stays passing until the service is deregistered
  4. The agent deregisters the service after 30 seconds

Explanation

A TTL check succeeds only while the service keeps resetting it with pass, warn, or fail calls. Silence past the TTL is treated as failure, so the check becomes critical.

Question 12Consul Architecture and Core Concepts

A key/value pair is acquired with a session that is later invalidated. What is the result by default?

  1. The lock is released and the key can be acquired again Correct answer.
  2. The key is deleted permanently
  3. The key keeps its value but stays locked forever
  4. The lock is transferred to the next waiting session automatically

Explanation

Sessions provide leases, and invalidation releases every lock the session held after the configured lock delay. The key itself survives with its value intact, so another session can acquire it.

Question 13Consul Architecture and Core Concepts

What does the near parameter of a prepared query use to order the returned service instances?

  1. The alphabetical order of node names
  2. Network coordinates that estimate round-trip latency Correct answer.
  3. The Raft index at which each service was registered
  4. The number of passing health checks on each node

Explanation

Consul computes network coordinates for nodes and uses them to estimate latency between the caller and each candidate instance. The near parameter then sorts results so the closest healthy instances are returned first.

Question 14Consul Architecture and Core Concepts

In Consul service mesh, what do intentions define?

  1. The order in which servers join the Raft cluster
  2. The retry policy used when a health check fails
  3. Which services may connect to which other services Correct answer.
  4. How key/value entries are replicated across datacenters

Explanation

Intentions are the authorization layer for service-to-service traffic, evaluated against the identities presented in mutual TLS certificates. They allow or deny connections based on source and destination service.

Question 15Consul Architecture and Core Concepts

What does starting a Consul server with -bootstrap-expect=3 accomplish?

  1. It requires three client agents to join before the server starts
  2. It immediately makes that server the Raft leader
  3. It sets the number of replicas for every key/value write
  4. It waits for three servers to join before bootstrapping the cluster Correct answer.

Explanation

The flag declares how many servers should form the initial cluster, and each server waits until that many peers have joined before triggering bootstrap. This avoids the split-brain risk of bootstrapping too early.

Question 16Consul Architecture and Core Concepts

Which port carries WAN gossip traffic between Consul servers in different datacenters?

  1. 8301
  2. 8500
  3. 8302 Correct answer.
  4. 8300

Explanation

Servers join a WAN gossip pool on port 8302 so datacenters can discover each other and federate. The LAN pool on 8301 is scoped to a single datacenter.

Question 17Consul Architecture and Core Concepts

How does a client perform a blocking query against the Consul HTTP API?

  1. It polls on a fixed two-second interval until the value changes
  2. It opens a WebSocket and waits for server push events
  3. It sets a wait header and the server streams every update
  4. It passes the last index and blocks until the data changes Correct answer.

Explanation

A blocking query supplies an index from a previous response along with a wait timeout, and the server holds the request open until the index advances or the timeout expires. This avoids the cost and delay of fixed-interval polling.

Question 18Consul Architecture and Core Concepts

Which query parameter requests a read that any server may answer without contacting the leader?

  1. ?index
  2. ?stale Correct answer.
  3. ?consistent
  4. ?leader

Explanation

The stale mode allows a follower to answer from its local replicated state, trading freshness for lower latency and availability during leader elections. The default mode and consistent mode both involve the leader.

Question 19Consul Architecture and Core Concepts

What does the consul snapshot save command capture?

  1. Only the contents of the key/value store
  2. The configuration files of every agent in the datacenter
  3. Only the ACL token database and policies
  4. The full Raft state, including catalog, KV, and ACL data Correct answer.

Explanation

A snapshot is a point-in-time copy of the server's Raft state, which includes services, checks, key/value entries, sessions, prepared queries, and ACL data. Restoring it requires a quorum of servers and overwrites current state.

Question 20Consul Architecture and Core Concepts

Which component holds the authoritative service catalog that clients query?

  1. The DNS server embedded in every client
  2. The WAN gossip pool
  3. Each client agent, in its local state directory
  4. The Consul servers, replicated through Raft Correct answer.

Explanation

Servers maintain the catalog as replicated Raft state, and every registration eventually reaches them. Client agents keep local definitions and caches, but their view is not authoritative.

Question 21Consul Architecture and Core Concepts

A five-server datacenter loses contact with three of its servers. What is the effect on write operations?

  1. The cluster shrinks its Raft peer set automatically to two servers
  2. Clients are redirected to another datacenter by the gossip layer
  3. The remaining two servers elect a leader and continue accepting writes
  4. Writes fail because the remaining servers cannot form a quorum Correct answer.

Explanation

Five servers require a quorum of three, and the two survivors cannot elect a leader or commit log entries. Once enough servers return, Raft re-establishes a leader and writes resume.

Question 22Consul Architecture and Core Concepts

Which statement correctly contrasts gossip encryption with TLS in Consul?

  1. Gossip uses a shared key, while TLS uses certificates for RPC and HTTP Correct answer.
  2. Gossip encryption is asymmetric and removes the need for a Connect CA
  3. Both protect the same traffic, so enabling either one makes the other unnecessary
  4. Gossip encryption secures RPC calls, while TLS secures only DNS traffic

Explanation

Gossip encryption is a symmetric key applied to Serf member traffic on the LAN and WAN pools. TLS is certificate-based and protects client-to-server RPC and HTTP API traffic, so the two cover different planes and are typically used together.

Question 23Consul Architecture and Core Concepts

In a multi-datacenter deployment using ACLs, what role does the primary datacenter play?

  1. It must contain a majority of all servers across every datacenter
  2. It handles all key/value writes for every datacenter
  3. It is the only datacenter permitted to run client agents
  4. It is the source of ACL data that secondary datacenters replicate Correct answer.

Explanation

The primary datacenter owns the ACL bootstrap and is where token and policy changes are made, and secondary datacenters replicate that data from it. Key/value data and Raft quorum remain independent per datacenter.

Question 24Consul Architecture and Core Concepts

What does Consul autopilot do with a server that has been unhealthy beyond the configured threshold?

  1. It adds a replacement server automatically from a pool of spares
  2. It removes the dead server from the Raft peer set Correct answer.
  3. It restarts the server process through the RPC endpoint
  4. It promotes the dead server to leader to speed recovery

Explanation

Autopilot monitors server health and, with dead server cleanup enabled, removes servers that stay unhealthy past the stabilization period. This keeps the peer set accurate so quorum math reflects only viable members.

Question 25Consul Architecture and Core Concepts

In Consul service mesh, what identity is encoded in the certificate that the Connect CA issues to a sidecar proxy?

  1. The IP address of the proxy's listener
  2. The name of the service the proxy represents Correct answer.
  3. The datacenter name paired with the current Raft index
  4. The node name of the host running the proxy

Explanation

Connect certificates carry a SPIFFE-style identity built from the service name together with its namespace and datacenter. Intentions are evaluated against that identity, which is why authorization follows the service rather than the host.

Question 26Consul Architecture and Core Concepts

Which mechanism does Consul use for gossip communication between agents, such as tracking cluster membership and detecting failed nodes?

  1. Mutual TLS authentication over TCP
  2. gRPC streaming between proxies
  3. SWIM-based gossip via Serf Correct answer.
  4. Raft consensus

Explanation

Every Consul agent runs a Serf instance, which implements the SWIM protocol to maintain LAN and WAN gossip pools for membership and failure detection. Raft is a separate protocol used only by servers to reach consensus on replicated state such as the catalog.

Question 27Consul Architecture and Core Concepts

A deployment runs Consul servers in two datacenters. A DNS lookup for a service in the remote datacenter is sent to a server in the local datacenter, and the answer is returned successfully. What makes this possible?

  1. Replication of the remote catalog into every local server
  2. A reverse proxy deployed in front of each server
  3. A Raft leader election across both datacenters
  4. WAN gossip federation between the datacenters' servers Correct answer.

Explanation

Servers in different datacenters join a shared WAN gossip pool, so each server learns about servers in remote datacenters. A local server receiving a query for another datacenter forwards it to a server there and relays the reply. Catalogs are not replicated across datacenters, and each datacenter has its own independent Raft group.

Question 28Consul Architecture and Core Concepts

An ACL token is linked to two policies. Policy A grants write on the service "web", and Policy B grants read on the same service. How does Consul evaluate this token's permissions on the web service?

  1. The token is rejected as invalid because the policies conflict.
  2. Rules are merged and the most permissive grant wins, allowing writes. Correct answer.
  3. Only the first policy created for the token is evaluated; any others are ignored entirely.
  4. The most restrictive grant wins, so the token can only read.

Explanation

Policies attached to a token are additive: their rules are merged, and where two policies grant different levels for the same resource the most permissive level applies. A single write grant in any attached policy therefore allows writes for that service. Conflicting grants are not errors and do not cause the token to be rejected.

Question 29Deploying a Consul Datacenter (agents, server configuration, cluster join/bootstrap)

Which server agent setting tells Raft to wait for a defined number of servers to join before bootstrapping and electing a leader?

  1. bootstrap_expect Correct answer.
  2. retry_join
  3. autopilot
  4. server

Explanation

bootstrap_expect declares how many server agents should eventually exist in the datacenter. Once that many servers have joined, Raft bootstraps and elects a leader, so you do not need to run a server with -bootstrap. Only server agents honor this setting.

Question 30Deploying a Consul Datacenter (agents, server configuration, cluster join/bootstrap)

A datacenter runs five Consul server agents. How many server failures can the cluster tolerate while still maintaining quorum?

  1. 4
  2. 1
  3. 3
  4. 2 Correct answer.

Explanation

Quorum for a Raft cluster of N servers is (N/2)+1, so five servers require three to be available. That means at most two servers can fail before the cluster loses quorum and stops electing a leader.

Question 31Deploying a Consul Datacenter (agents, server configuration, cluster join/bootstrap)

Which agent configuration option keeps retrying until the agent successfully contacts a server, and also accepts cloud auto-join discovery strings?

  1. retry_join Correct answer.
  2. join_addr
  3. start_join
  4. rejoin

Explanation

retry_join lists addresses or cloud auto-join configurations the agent should contact, retrying indefinitely until a join succeeds. It replaced the old start_join option, which only attempted a join once at startup.

Question 32Deploying a Consul Datacenter (agents, server configuration, cluster join/bootstrap)

Which default port do Consul servers use for server RPC traffic such as Raft and server-to-server requests?

  1. 8300 Correct answer.
  2. 8301
  3. 8302
  4. 8500

Explanation

Consul servers listen on TCP 8300 for server RPC, which carries Raft and server-to-server requests. Port 8301 is Serf LAN gossip, 8302 is Serf WAN gossip, and 8500 is the HTTP API.

Question 33Deploying a Consul Datacenter (agents, server configuration, cluster join/bootstrap)

What does running consul agent -dev do?

  1. Starts a client agent that joins an existing datacenter
  2. Runs an in-memory single-node datacenter Correct answer.
  3. Starts an agent with gossip encryption enabled by default
  4. Starts a server that persists state to the data directory

Explanation

Dev mode starts a single agent that acts as both server and client, bootstraps a datacenter, and keeps all state in memory. Because nothing is persisted and no encryption is configured, it is intended for local testing rather than production deployment.

Question 34Deploying a Consul Datacenter (agents, server configuration, cluster join/bootstrap)

A server in dc2 must join the WAN gossip pool of dc1. Which command accomplishes this?

  1. consul join -lan 10.0.0.5
  2. consul members -wan 10.0.0.5
  3. consul join -wan 10.0.0.5 Correct answer.
  4. consul join 10.0.0.5

Explanation

The -wan flag makes consul join add the target to the WAN gossip pool, which connects servers across datacenters. Without the flag, the join applies to the local LAN pool of the agent's own datacenter.

Question 35Deploying a Consul Datacenter (agents, server configuration, cluster join/bootstrap)

What is the effect of running consul leave on a node?

  1. It pauses the node so it can resume with its previous state
  2. It gracefully departs the cluster so the node must explicitly rejoin Correct answer.
  3. It evicts a failed node from the gossip pool and catalog
  4. It forces a new Raft election on the local server

Explanation

consul leave performs a graceful departure: the agent announces it is leaving so it is removed from gossip and the catalog instead of appearing as failed. The node will not come back automatically unless retry_join or an explicit join is used after it restarts.

Question 36Deploying a Consul Datacenter (agents, server configuration, cluster join/bootstrap)

What does enabling autopilot's cleanup_dead_servers option do?

  1. It promotes non-voting servers to voters after they stabilize
  2. It removes unhealthy servers from Raft after last_contact_threshold Correct answer.
  3. It triggers a rolling upgrade when a new version is detected
  4. It rebalances service instances across healthy nodes

Explanation

When cleanup_dead_servers is enabled, Autopilot removes server agents from the Raft peer set once they have been unreachable longer than last_contact_threshold. This keeps the voting membership from being filled with long-dead servers.

Question 37Deploying a Consul Datacenter (agents, server configuration, cluster join/bootstrap)

Which statement about the gossip encryption key set with encrypt is correct?

  1. The same key must be configured on every agent Correct answer.
  2. Only server agents need the key because clients never gossip
  3. Each agent generates its own key and shares it with servers
  4. The key is stored in Raft and pushed automatically to new clients

Explanation

Gossip encryption uses a symmetric key produced by consul keygen, and every agent that participates in the gossip pool must be configured with the identical key. An agent with a different or missing key cannot exchange gossip and will fail to join.

Question 38Deploying a Consul Datacenter (agents, server configuration, cluster join/bootstrap)

What does the consul validate command do?

  1. It starts the agent in dry-run mode and reports health checks
  2. It validates config files without starting the agent Correct answer.
  3. It confirms that all TLS certificates have not expired
  4. It verifies Raft consensus and reports the current leader

Explanation

consul validate parses the given configuration files, including every file in a config directory, and reports syntax or semantic problems without launching the agent. It is typically used in automation to catch bad configuration before a restart.

Question 39Deploying a Consul Datacenter (agents, server configuration, cluster join/bootstrap)

Which configuration change takes effect when an operator runs consul reload, without restarting the agent?

  1. Raising the log_level to debug Correct answer.
  2. Changing bootstrap_expect
  3. Changing the agent's data directory
  4. Changing the server RPC port

Explanation

consul reload re-reads configuration files and applies a limited subset of settings, including log_level and enable_debug. Structural settings such as ports, data_dir, server mode, and bootstrap_expect are only read during startup and therefore require a full agent restart.

Question 40Deploying a Consul Datacenter (agents, server configuration, cluster join/bootstrap)

Which retry_join value lets server agents discover each other dynamically by tags in AWS?

  1. A file path such as "/etc/consul/join.json" listing peers
  2. "10.0.0.1 10.0.0.2 10.0.0.3 10.0.0.4"
  3. "consul-servers.prod.example.com:8301"
  4. "provider=aws tag_key=Role tag_value=server" Correct answer.

Explanation

Consul supports cloud auto-join inside retry_join, where a provider string plus tag or filter parameters is resolved at runtime into a list of addresses. This allows servers to find each other without hard-coding static IPs, which is essential in auto-scaling environments.

Question 41Deploying a Consul Datacenter (agents, server configuration, cluster join/bootstrap)

Which value does Consul use for the datacenter when the datacenter option is omitted from an agent's configuration?

  1. dc0
  2. default
  3. global
  4. dc1 Correct answer.

Explanation

If datacenter is not specified, the agent uses dc1. All agents that should participate in the same LAN gossip pool must be configured with matching datacenter values, so changing this on only some agents splits the cluster.

Question 42Deploying a Consul Datacenter (agents, server configuration, cluster join/bootstrap)

When consul agent is started with no role-related flags or configuration, which role does the agent assume?

  1. Client, because server defaults to false Correct answer.
  2. Server, but only when bootstrap_expect is set
  3. Client, but only when data_dir is not set
  4. Server, because server = true is the default

Explanation

The server option defaults to false, so an agent started without -server or server = true runs in client mode. Client agents run the DNS and HTTP interfaces and host service registrations but do not participate in Raft or store cluster state.

Question 43Deploying a Consul Datacenter (agents, server configuration, cluster join/bootstrap)

On which port does a Consul agent serve DNS queries by default?

  1. 8600 Correct answer.
  2. 53
  3. 8500
  4. 8301

Explanation

Consul's DNS interface listens on port 8600 by default, which avoids conflicting with a system resolver on port 53. Operators typically forward queries for the consul domain from the host resolver to 8600.

Question 44Deploying a Consul Datacenter (agents, server configuration, cluster join/bootstrap)

What does the command consul members -wan display?

  1. All agents in every datacenter, including clients
  2. The server agents in the WAN gossip pool Correct answer.
  3. Only client agents in the local datacenter
  4. All agents in the local LAN pool, excluding servers

Explanation

The -wan flag switches the query to the WAN gossip pool, which only contains server agents from every datacenter that has been joined over the WAN. Client agents never participate in WAN gossip, so they cannot appear in this output.

Question 45Deploying a Consul Datacenter (agents, server configuration, cluster join/bootstrap)

A former server was removed from gossip with force-leave but still appears in the Raft configuration. Which command removes it from the Raft peer set?

  1. consul catalog deregister <server-id>
  2. consul force-leave <server-id>
  3. consul operator raft remove-peer <server-id> Correct answer.
  4. consul operator autopilot set-config -cleanup-dead-servers

Explanation

Gossip membership and Raft membership are managed separately, so removing a node from Serf does not change the Raft peer set. consul operator raft remove-peer deletes a specific peer from the Raft configuration, which is needed when a dead server still counts toward quorum.

Question 46Deploying a Consul Datacenter (agents, server configuration, cluster join/bootstrap)

Which statement about the data_dir agent option is correct?

  1. It must be unique per agent and survive restarts Correct answer.
  2. It may be shared by multiple agents to reduce disk usage
  3. It is optional when the agent runs as a server
  4. It is used only by client agents to cache services

Explanation

Every agent needs its own data_dir, and the contents must persist across restarts so that Raft logs, snapshots, and agent state are not lost. Two agents sharing a directory will corrupt each other's state.

Question 47Deploying a Consul Datacenter (agents, server configuration, cluster join/bootstrap)

A server is configured with both bootstrap_expect = 3 and bootstrap = true. What is the result?

  1. The agent elects itself leader and then waits for two peers
  2. The agent refuses to start because the options conflict Correct answer.
  3. The agent ignores bootstrap and applies bootstrap_expect
  4. The agent starts and Autopilot disables dead-server cleanup

Explanation

bootstrap_expect provides automatic bootstrap and cannot be combined with the manual bootstrap option, because the two describe contradictory startup behavior. Consul rejects the configuration instead of guessing which one to honor.

Question 48Deploying a Consul Datacenter (agents, server configuration, cluster join/bootstrap)

Which TLS option makes an agent verify that a server's certificate is valid for server.<dc>.consul?

  1. auto_encrypt
  2. verify_server_hostname Correct answer.
  3. verify_incoming
  4. verify_outgoing

Explanation

verify_server_hostname enforces that the certificate presented by a server matches the expected server.<datacenter>.consul hostname during the TLS handshake. This prevents a certificate issued for another purpose from being accepted as a server identity.

Question 49Deploying a Consul Datacenter (agents, server configuration, cluster join/bootstrap)

Which Autopilot setting controls how long a newly added server must be healthy before it becomes a voting member?

  1. max_trailing_logs
  2. last_contact_threshold
  3. cleanup_dead_servers
  4. server_stabilization_time Correct answer.

Explanation

server_stabilization_time defines the window during which a new server's health must remain steady before Autopilot promotes it to a voting member. This prevents a flapping server from destabilizing quorum calculations.

Question 50Deploying a Consul Datacenter (agents, server configuration, cluster join/bootstrap)

A server binds to 0.0.0.0 behind NAT, and other agents must reach it at 203.0.113.10. Which option should be set?

  1. client_addr = "203.0.113.10"
  2. bind_addr = "0.0.0.0"
  3. translate_wan_addrs = true
  4. advertise_addr = "203.0.113.10" Correct answer.

Explanation

advertise_addr is the address the agent publishes to other cluster members, so peers behind the NAT boundary can reach it. bind_addr only controls the local interface the agent listens on and does not change what is advertised.