Cribl Cribl Security & Access Control 2

Question 1

Which Cribl feature allows administrators to audit which users made configuration changes and when?

Accepted Answer

Audit Logs

Answer

Cribl's Audit Logs record user actions such as configuration changes, logins, and deletions with timestamps for accountability.

Question 2

What is the recommended practice for managing Cribl API tokens securely?

Accepted Answer

Store tokens in a secrets manager and rotate them regularly

Answer

API tokens should be stored in a secrets manager and rotated regularly to minimize the risk of unauthorized access.

Question 3

How can Cribl Stream be configured to prevent unauthorized access to the Leader node's web UI?

Accepted Answer

Enabling authentication and restricting network access with firewall rules

Answer

Combining authentication enforcement with network-level firewall restrictions to the Leader's management port prevents unauthorized UI access.

Question 4

Which Cribl permission scope allows a user to view pipeline configurations but not modify them?

Accepted Answer

read

Answer

The 'read' permission scope in Cribl grants view-only access to configurations without the ability to make changes.

Question 5

When configuring Cribl to forward data to a SIEM, which security practice ensures the destination credentials are not exposed in the config?

Accepted Answer

Using Cribl's Secrets Store to reference credentials by name

Answer

Cribl's Secrets Store allows credentials to be referenced by name in destination configurations, keeping them out of plaintext config files.

(Cribl) Cribl Observability Pipeline Certification Practice Test