Consul Ops Pro study plan

Diagram a three-server Consul cluster from memory, labeling the LAN and WAN gossip pools, the Raft layer, and the client agent path for a single service lookup.

Explain in writing why a cluster must keep a Raft quorum of (N/2)+1 servers and calculate the failure tolerance for 3, 5, and 7 server deployments.

Compare the single-datacenter, multi-datacenter with mesh gateways, and federation-via-WAN topologies, listing one operational cost and one failure mode for each.

Trace a DNS and an HTTP request for a registered service from client agent through the catalog and back, noting which component answers from cache versus from the servers.

Write out the exact bootstrap sequence for a fresh cluster: server config, expected peers, Raft bootstrap, and the point at which the cluster becomes leader-elected.

Demonstrate graceful server removal and rejoin, including the leave command, Raft peer removal, and how to verify quorum after each step.

Plan a rolling upgrade of a five-server cluster from an older minor version to the current one, ordering servers so quorum is never lost and stating the version-skew limit between servers and clients.

List the configuration keys that must be identical across servers versus those that are per-node, and identify which ones cannot be changed without a restart.

Register services using both a service definition file and the HTTP API, then verify catalog entries through DNS, HTTP, and the UI.

Configure one TTL check and one script or HTTP check per service, tune interval and timeout, and observe how critical status propagates to DNS and to the health API.

Enable Connect on a two-service local mesh, register a sidecar proxy, and confirm mTLS traffic flows while an unproxied call is rejected.

Explain how intentions, service defaults, and proxy upstreams interact when a caller reaches a callee through the mesh, and identify which layer denies traffic first.

Bootstrap ACLs with a master token, then create policies for node, service, and KV scopes and attach them to tokens with the least privilege needed for each role.

Model a KV layout for application config and demonstrate reading it with a token that has read-only access to a single prefix.

Write intentions at the service and namespace level and verify denial and allow behavior with real requests.

Diagnose a permission-denied error by reading the audit trail of which policy was missing, then correct the token rather than widening the default policy.

Generate a private CA and server certificates, enable mutual TLS for RPC, HTTPS for the API and UI, and verify a client agent connects with verify_outgoing and verify_server_hostname.

Enable gossip encryption with a shared key, rotate the key through the staged primary and secondary key process, and confirm all members hold the new key.

Configure Connect certificate authority settings, including the built-in CA versus Vault, and describe what happens when the CA provider is unavailable at leaf issuance.

Harden a server config by disabling the UI on servers, restricting the HTTP bind address, and setting verify_incoming where appropriate.

Scrape the metrics endpoint and identify the key Raft, member health, and request latency series; build a dashboard panel for leader changes and for failed RPCs.

Set up log capture at debug level for a single agent, then correlate a failed service registration across agent logs and server logs.

Simulate a leader failure and a full-cluster outage, then recover using the snapshot restore path and confirm the catalog and KV data match the snapshot.

Document the snapshot and restore procedure, including where snapshots are stored, how often to take them, and how to verify integrity before relying on one.

Diagnose three injected faults: a server that cannot rejoin due to a stale Raft peer entry, a service stuck critical from a misconfigured check, and a mesh call failing because the proxy upstream is missing.

Use the operator and debug endpoints to inspect Raft peers, autopilot health, and proxy configuration without restarting the cluster.

Reproduce a split-brain scenario in a lab and explain how autopilot and Raft quorum prevent or detect it, and what manual steps remain.

Write a post-incident summary for one fault that names the symptom, the root cause, the detection signal, and the permanent fix.

Express a cluster deployment as infrastructure-as-code, parameterizing server count, TLS material, and ACL bootstrap, and apply it to a disposable environment.

Automate ACL policy and intention creation through the API in a repeatable script or pipeline step, including idempotent updates.

Review the enterprise feature set relevant to operations, such as namespaces, admin partitions, and redundancy zones, and state where each changes the topology or ACL model.

Take two timed practice sets covering all domains, then re-study the two weakest domains identified by the results.