Hashicorp Certified Consul Associate 002 · Free Practice Question Medium
Question 9
Consul has been running in your organization for a year now, and the configuration meets all the requirements of the Consul security model (ACLs, Gossip encryption, TLS, etc). Company security policies demand that all static encryption keys be rotated once a year, at a minimum. How can you quickly rotate the gossip encryption key without negatively impacting the Consul service or any of the hundreds of applications registered or using Consul?
-
A
use
consul keygento generate the new key -
B
set the
auto-rotateconfiguration to 1 year in the gossip configuration stanza -
C
use the
consul keyringcommand to distribute and install a new key -
D
generate a new key and reconfigure all of the agent configuration files across all servers and agents
Reveal correct answer
Correct answer: C
Explanation
The keyring command is used to examine and modify the encryption keys used in Consul's Gossip Pools. It is capable of distributing new encryption keys to the cluster, retiring old encryption keys, and changing the keys used by the cluster to encrypt messages.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
