Consul Ops Pro study guide
Consul Ops Pro · Work through your exam, one topic at a time.
Consul Ops Pro is an independent study track for engineers who run HashiCorp Consul in production rather than merely consuming it. It targets platform, SRE, and infrastructure engineers responsible for cluster design, server lifecycle, service mesh rollout, ACL and TLS posture, monitoring, and recovery. The Consul Ops Pro study guide has 8 sections and about 3,633 words.
01Consul Architecture and Deployment Topologies
Domain 1 tests whether you can describe how a Consul cluster is actually built: which agents do which work, how datacenters federate, how many servers you need to survive failures, and which ports must be reachable between them. Expect scenario questions where a stated topology (three datacenters, two availability zones, Kubernetes plus VMs) must be matched to a correct design.
444 words, about 2 min02Cluster Bootstrapping, Server Management, and Upgrades
Domain 2 covers the lifecycle of server agents: forming the initial Raft cluster safely, managing membership afterwards, and upgrading servers without losing quorum. Questions here are usually "what happens next" scenarios - a second server is added to a cluster configured with bootstrap expect = 3 , or an operator restarts all three servers at once to apply new configuration.
455 words, about 2 min03Service Registration, Health Checks, and Service Mesh (Connect)
Domain 3 tests registration mechanics and health checking in detail, plus the Connect data path. Expect questions about which agent runs a check, why a TTL check went critical, how a sidecar is registered, and what an intention does when a connection is refused while the service looks healthy.
446 words, about 2 min04KV Store, Intentions, and Access Control Lists (ACLs)
Domain 4 combines three topics that all answer "who may read or do what". The KV store holds configuration; intentions decide which services may talk to which; ACLs decide which humans, agents and services may call the API at all.
484 words, about 2 min05Security: TLS, Gossip Encryption, and Secrets Management
Domain 5 covers the three cryptographic layers Consul exposes: gossip encryption for Serf traffic on 8301/8302, mutual TLS for RPC and HTTP, and Connect certificates for service-to-service traffic. Questions test ordering - what must exist before you enable verification - and what fails when a certificate is missing a SAN.
482 words, about 2 min06Observability, Monitoring, and Logging
Domain 6 asks how you know a Consul cluster is unhealthy before users tell you it is. Expect questions on which endpoint exposes which signal, how telemetry is configured, how log levels behave, and what is worth alerting on.
430 words, about 2 min07Troubleshooting, Failure Recovery, and Backup/Restore
Domain 7 covers the failure modes Consul actually produces and the recovery procedures that work. The exam tests whether you can tell a membership problem from a quorum problem from an ACL problem, and whether you know exactly what a snapshot does and does not restore.
427 words, about 2 min08Automation, Infrastructure as Code, and Enterprise Features
Domain 8 covers repeatable operations: expressing Consul configuration as code, automating cluster lifecycle, and knowing which capabilities require an Enterprise licence. Questions typically ask which resource or config entry implements a requirement, and which features silently vanish in the community binary.
465 words, about 2 min