Threat Detection & Incident Response Flashcards

Since Jenkins 2.326, what is true of agent-to-controller security?

Answer: It is always enabled and cannot be disabled

Agent-to-controller access control is always on, blocking compromised agents from abusing the controller.

Where are in-process scripts awaiting admin review listed?

Answer: Manage Jenkins > In-process Script Approval

Script Security queues unapproved scripts and signatures in the In-process Script Approval page.

An admin wants to find which threads are stuck while the controller seems compromised or overloaded. Which URL provides this?

Answer: /threadDump

/threadDump shows the stack traces of all controller threads for diagnosis.

Which URL helps confirm the authentication and authorities that Jenkins assigns to the current session during an access investigation?

Answer: /whoAmI

/whoAmI displays the current user's name, authentication status, and granted authorities.

A plugin has a critical, unfixed vulnerability being actively exploited. What is the quickest containment step if the plugin is not essential?

Answer: Disable or uninstall the plugin and restart Jenkins

Disabling or removing the vulnerable plugin removes the attack surface until a fix is released.

Where does the Jenkins project publish official vulnerability details and fixed versions for core and plugins?

Answer: Jenkins security advisories at jenkins.io/security/advisories

The Jenkins security team publishes advisories that list affected versions, severity, and fixes.

After a compromise, which steps are most important for credentials that were stored in Jenkins?

Answer: Rotate the secrets at their source systems and update the Jenkins credentials

Exposed secrets must be revoked and reissued at their origin, then updated in Jenkins.