Cribl Cribl Security & Access Control 1 — Questions and Answers
Question 1: Which authentication method does Cribl Stream support for integrating with enterprise identity providers?
- SAML 2.0 (Correct answer)
- RADIUS
- Kerberos
- NTLM
Correct answer: SAML 2.0
Cribl Stream supports SAML 2.0 for SSO integration with enterprise identity providers like Okta and Azure AD.
Question 2: In Cribl, what is the purpose of Role-Based Access Control (RBAC)?
- Restricting user permissions to specific actions and resources (Correct answer)
- Encrypting data in transit
- Compressing log data
- Routing events to destinations
Correct answer: Restricting user permissions to specific actions and resources
RBAC in Cribl allows administrators to assign roles that restrict what actions users can perform and which resources they can access.
Question 3: Which built-in Cribl role grants full administrative access to all features and configurations?
- admin (Correct answer)
- superuser
- operator
- devops
Correct answer: admin
The built-in 'admin' role in Cribl provides full access to all system features, settings, and configurations.
Question 4: How does Cribl Stream protect sensitive data fields such as credentials or PII within pipelines?
- Using the Mask or Eval functions to redact or encrypt field values (Correct answer)
- Storing them in a separate encrypted database
- Compressing the entire event
- Routing sensitive events to a quarantine destination
Correct answer: Using the Mask or Eval functions to redact or encrypt field values
Cribl Stream can use the Mask function or Eval expressions to redact, hash, or encrypt sensitive field values before forwarding.
Question 5: What TLS configuration option in Cribl ensures that data in transit between sources and Cribl is encrypted?
- Enabling TLS on the input listener (Correct answer)
- Setting compression level to maximum
- Using the Serialize function
- Configuring WAL mode in the database
Correct answer: Enabling TLS on the input listener
Enabling TLS on Cribl input listeners encrypts data in transit from sources to the Cribl deployment.
Question 6: In Cribl's multi-tenant environment, what feature ensures one tenant's data is isolated from another?
- Worker Groups with separate configurations and credentials (Correct answer)
- Shared pipelines with event tagging
- A single global admin role
- Merged destination outputs
Correct answer: Worker Groups with separate configurations and credentials
Worker Groups in Cribl allow separate configurations, credentials, and pipelines per tenant, ensuring data isolation in multi-tenant deployments.
Cribl Cribl Security & Access Control 1
Which authentication method does Cribl Stream support for integrating with enterprise identity providers?