CASSANDRA Security 1 — Questions and Answers
Question 1: Which authenticator is enabled by default in Apache Cassandra and allows all client connections without requiring credentials?
- AllowAllAuthenticator (Correct answer)
- PasswordAuthenticator
- KerberosAuthenticator
- LDAPAuthenticator
Correct answer: AllowAllAuthenticator
AllowAllAuthenticator is the default authenticator in Cassandra, permitting all connections without credential checks, which is suitable only for development environments.
Question 2: Which authenticator must be configured in cassandra.yaml to require clients to provide a username and password?
- AllowAllAuthenticator
- PasswordAuthenticator (Correct answer)
- CassandraAuthenticator
- SecureAuthenticator
Correct answer: PasswordAuthenticator
PasswordAuthenticator stores credentials in the system_auth keyspace and requires clients to supply a username and password during connection.
Question 3: What are the default superuser credentials in a freshly installed Apache Cassandra cluster?
- admin / admin
- root / cassandra
- cassandra / cassandra (Correct answer)
- user / password
Correct answer: cassandra / cassandra
Cassandra ships with a default superuser account where both the username and password are 'cassandra', which must be changed immediately in production.
Question 4: In which keyspace does PasswordAuthenticator store user roles and credentials in Apache Cassandra?
- system
- system_auth (Correct answer)
- system_distributed
- system_schema
Correct answer: system_auth
PasswordAuthenticator persists role and credential data in the system_auth keyspace, which is why its replication factor matters for authentication availability.
Question 5: Which authorizer must be set in cassandra.yaml to enable GRANT and REVOKE permission management?
- AllowAllAuthorizer
- CassandraAuthorizer (Correct answer)
- RoleBasedAuthorizer
- PermissionAuthorizer
Correct answer: CassandraAuthorizer
CassandraAuthorizer stores and enforces permission grants in the system_auth keyspace, enabling fine-grained access control via GRANT and REVOKE statements.
Question 6: Which cassandra.yaml configuration section controls SSL/TLS encryption for connections between clients and Cassandra nodes?
- server_encryption_options
- client_encryption_options (Correct answer)
- ssl_options
- tls_encryption_options
Correct answer: client_encryption_options
client_encryption_options in cassandra.yaml governs TLS settings for the native CQL protocol used by client drivers connecting to Cassandra.
Question 7: Which cassandra.yaml configuration section enables SSL/TLS encryption for internode (node-to-node) communication within a Cassandra cluster?
- client_encryption_options
- internode_ssl_options
- server_encryption_options (Correct answer)
- cluster_encryption_options
Correct answer: server_encryption_options
server_encryption_options controls internode SSL, supporting modes such as none, rack, dc, and all to selectively encrypt intra-cluster traffic.
CASSANDRA Security 1
Which authenticator is enabled by default in Apache Cassandra and allows all client connections without requiring credentials?