Update — the Consul Associate (003) exam was retired in July 2026. HashiCorp has pulled the 003 exam; credentials earned before the retirement stay valid until their stated expiration date. If you already hold it, nothing changes right now. If you were planning to sit it, read what the retirement means for your plans first. The study material below is still solid for learning Consul, but you can no longer book this exam.
If you search “consul certification,” you get a lot of pages that describe the badge and very few that tell you what the exam actually asks of you. This is the second kind of page.
The credential is the HashiCorp Certified: Consul Associate (003). The 003 matters, because older study material for 002 still floats around and the exam moved on. Here is what it is, what it tests, and how to prepare without wasting evenings.
The format, in numbers
- 57 questions in 60 minutes, just over a minute per question.
- Passing score: HashiCorp doesn’t publish an official passing score.
- Online proctored, multiple choice and multiple select.
- No labs in the exam itself, but the questions assume you have done the labs. More on that below.
One minute per question sounds tight. It mostly isn’t, because Associate-level questions are short. Where people lose time is second-guessing ACL and TLS configuration details they only ever read about and never typed.
The ten domains, and where the real weight is
Officially, the 003 blueprint spreads across ten domains at roughly equal weight: service networking pillars, Consul architecture, single-datacenter deployment, service registration and discovery, service mesh, agent communication security, basic ACLs, mesh application connectivity, monitoring, and operations.
In practice, the domains cluster into three blocks worth unequal attention:
1. Architecture and agents (the foundation). Server agents versus client agents versus Consul Dataplane, what gossip does, how servers reach consensus, what happens when a server drops. If you can draw a datacenter on a whiteboard (servers, clients, the protocols between them), a quarter of the exam becomes free points.
2. Security: TLS, gossip encryption, and ACLs (the differentiator). Three separate domains touch security, which tells you where HashiCorp wants the bar. Know the difference between TLS certificate types, what gossip encryption protects (and what it doesn’t), and how an ACL token actually flows from policy to agent. These questions punish pure readers.
3. Service discovery and mesh (the daily-work block). Registering services, health checks, querying the catalog via DNS versus API, intentions, and gateways. If you’ve operated Consul at work, this block is familiar; if not, it’s the one to lab through.
How to prepare, concretely
Spin up a real datacenter. One consul agent -dev is not enough. Run three server agents and a client or two, locally or in containers, and go through: bootstrap, join, register a service with a health check, query it over DNS, break a node, watch what happens. The deploy and operations domains come almost entirely from this exercise.
Turn security on. Most tutorials run Consul wide open. The exam assumes the opposite. Enable TLS, configure gossip encryption, bootstrap the ACL system, and write one policy and one token by hand. The first time you lock yourself out is worth twenty flashcards.
Touch Consul on Kubernetes once. The blueprint names it explicitly. You don’t need to be a Kubernetes expert. Deploy the Helm chart, see how the pieces map to what you built by hand.
Then measure, don’t guess. The most common failure mode is booking blind. After the material feels familiar, you want per-domain evidence: which of the ten areas are solid, which are luck. That is exactly the gap our Consul Associate practice set was built for: adaptive questions across all ten domains, every answer explained against the official docs, and a readiness score. With the exam retired it’s no longer a booking decision, but it remains a solid way to learn the material.
Is it worth it?
The honest answer: the Consul Associate is a focused credential. It won’t carry a resume by itself the way a cloud-provider Associate might. It shines in two situations: you work somewhere that runs Consul (or HashiCorp stack broadly) and want the knowledge validated, or you’re building a service-networking profile where Consul sits next to Vault and Terraform certs.
If either is you, the material is genuinely useful at work, and a few focused weeks are enough to learn it well. Prepare hands-on and verify readiness per domain. The 003 exam is no longer bookable, but the knowledge it validated still holds up on the job.
