Practice HCCAO-003 Exam Online

Question 1

You need to deny communication between the customer-db service and the payment service using an intention. You open the command line and issue the following

command:

$ consul intention create customer-db payment

However, the two services can still initiate new connections even after the intention is created. What would explain this?

A : the default behavior of the command issued is allow

B :

the mTLS certificates are both signed by the same CA, therefore the connectivity is permitted regardless of an intention

C : the services are communicating over HTTP rather than HTTPS

D : there is an identical intention that is permitting the connectivity

Answer: A

Question 2

The Consul KV store can be accessed by the following methods: (select three)

A : CLI

B :

federated cluster

C : API

D : UI

Answer: A,C,D

Question 3

Given the following ACL policy, what actions below would be permitted by a token assigned to this policy? (select three)

1. service "app1" {

2. policy = "write"

3. }

4.

5. service_prefix "" {

6. policy = "read"

7. }

8.

9. node_prefix "" {

10. policy = "read"

11. }

A :

query any service registered to Consul to list the active clients for the service

B : run the consul members command to view server and client nodes in the cluster

C :

create a new Consul service call app1

D : register any service on Consul

Answer: A,B,C

Question 4

You have deployed a new Consul cluster to be used for service discovery between your microservices for a new application. In the configuration file, as shown below, you

have enabled ACLs and bootstrapped the ACL system. However, clients are still being permitted to read and write to the ACL system or register services without a valid

token.

Based on the policy, what change needs to be made to finish securing Consul?

1. {

2. "server": true,

3. "node_name": "CONSUL-NODE-A",

4. "datacenter": "DC-1",

5. "data_dir": "/var/consul/data",

6. "bind_addr": "0.0.0.0",

7. "client_addr": "0.0.0.0",

8. "advertise_addr": "10.0.10.208",

9. "bootstrap_expect": 5,

10. "retry_join": ["provider=aws tag_key=consul tag_value=true"],

11. "ui": true,

12. "log_level": "INFO",

13. "acl": {

14. "enabled": true,

15. "default_policy": "allow",

16. "down_policy": "extend-cache"

17. }

18. }

A : configure the ACL policy for the anonymous token to deny all client requests

B : reload the configuration on all the nodes after the bootstrap token was created

C : update the default_policy across all of the Consul nodes

D : apply the bootstrap token to the other nodes

Answer: C

Question 5

When running the Consul agent in dev (development) mode, where does Consul write its data?

A : in the directory where the Consul agent was started

B : the temp directory that the underlying operating system uses

C :

the default application data directory, which is different based on the underlying operating system

D : stores all data and configuration in non-persistent memory

Answer: D

Name:	HashiCorp Certified: Consul Associate (003)
Exam Code:	HCCAO-003
Certification:	Consul Associate
Vendor:	HashiCorp
Total Questions:	174
Last Updated:	Sep 04, 2026

HashiCorp HCCAO-003 Answers