Cribl Cribl Security & Access Control 2 — Questions and Answers
Question 1: Which Cribl feature allows administrators to audit which users made configuration changes and when?
- Audit Logs (Correct answer)
- System Metrics
- Pipeline Profiler
- Event Breaker
Correct answer: Audit Logs
Cribl's Audit Logs record user actions such as configuration changes, logins, and deletions with timestamps for accountability.
Question 2: What is the recommended practice for managing Cribl API tokens securely?
- Store tokens in a secrets manager and rotate them regularly (Correct answer)
- Hardcode them in pipeline functions for convenience
- Share tokens across all pipeline configurations
- Store them in plaintext in the Cribl config files
Correct answer: Store tokens in a secrets manager and rotate them regularly
API tokens should be stored in a secrets manager and rotated regularly to minimize the risk of unauthorized access.
Question 3: How can Cribl Stream be configured to prevent unauthorized access to the Leader node's web UI?
- Enabling authentication and restricting network access with firewall rules (Correct answer)
- Disabling all pipeline outputs
- Setting all sources to internal-only
- Using the Cribl Sandbox mode
Correct answer: Enabling authentication and restricting network access with firewall rules
Combining authentication enforcement with network-level firewall restrictions to the Leader's management port prevents unauthorized UI access.
Question 4: Which Cribl permission scope allows a user to view pipeline configurations but not modify them?
- read (Correct answer)
- write
- execute
- deploy
Correct answer: read
The 'read' permission scope in Cribl grants view-only access to configurations without the ability to make changes.
Question 5: When configuring Cribl to forward data to a SIEM, which security practice ensures the destination credentials are not exposed in the config?
- Using Cribl's Secrets Store to reference credentials by name (Correct answer)
- Embedding credentials directly in the destination URL
- Storing credentials in a pipeline comment
- Logging credentials to an internal source
Correct answer: Using Cribl's Secrets Store to reference credentials by name
Cribl's Secrets Store allows credentials to be referenced by name in destination configurations, keeping them out of plaintext config files.
Question 6: What happens in Cribl when a user without sufficient RBAC permissions attempts to commit a configuration change?
- The action is blocked and an error is returned (Correct answer)
- The change is saved but not deployed
- The change is silently discarded
- An automated rollback is triggered
Correct answer: The action is blocked and an error is returned
Cribl enforces RBAC at the API and UI level, blocking unauthorized actions and returning an error to the user.
Cribl Cribl Security & Access Control 2
Which Cribl feature allows administrators to audit which users made configuration changes and when?