ElasticSearch Professional Standards & Competencies 2 — Questions and Answers
Question 1: Which Elasticsearch role-based access control (RBAC) privilege allows a user to read index data but not modify mappings?
- manage
- read (Correct answer)
- write
- monitor
Correct answer: read
The 'read' privilege grants access to read operations like search and get, without allowing mapping or index configuration changes.
Question 2: When documenting an Elasticsearch cluster architecture for a client handoff, which detail is MOST critical to include?
- The color theme of Kibana dashboards
- Node roles, shard allocation settings, and ILM policies (Correct answer)
- The personal email of the Elasticsearch engineer
- The number of Kibana browser tabs used during setup
Correct answer: Node roles, shard allocation settings, and ILM policies
Node roles, shard allocation, and ILM policies are the operational details a successor needs to maintain and troubleshoot the cluster.
Question 3: A colleague proposes storing raw PII in a plaintext Elasticsearch field for easier searching. What is the professionally appropriate response?
- Agree, since search performance justifies it
- Recommend field-level encryption or tokenization and document the risk (Correct answer)
- Ignore it since Elasticsearch security is handled at the network layer only
- Store PII only in the _source field to hide it
Correct answer: Recommend field-level encryption or tokenization and document the risk
Professional standards require advocating for data protection controls such as encryption or tokenization and formally documenting any accepted risks.
Question 4: An Elasticsearch engineer discovers a critical vulnerability in a third-party plugin used in production. What is the FIRST professional step?
- Immediately delete the plugin without notifying anyone
- Assess the severity, notify stakeholders, and follow the organization's vulnerability management process (Correct answer)
- Wait for the vendor to release a patch before acting
- Post details publicly to pressure the vendor
Correct answer: Assess the severity, notify stakeholders, and follow the organization's vulnerability management process
Professional practice requires assessing impact, notifying the appropriate stakeholders, and following established vulnerability management procedures.
Question 5: Which Elasticsearch feature should a professional configure to meet a compliance requirement for audit logging of all access attempts?
- Index lifecycle management (ILM)
- Elasticsearch audit logging via the xpack.security.audit settings (Correct answer)
- Snapshot and restore
- Cross-cluster replication (CCR)
Correct answer: Elasticsearch audit logging via the xpack.security.audit settings
Elasticsearch's built-in audit logging (enabled via xpack.security.audit) records authentication attempts, authorization decisions, and data access events.
Question 6: When sizing an Elasticsearch cluster for a new project, which professional practice ensures the design is defensible?
- Choose the smallest possible nodes to minimize cost with no testing
- Base sizing on measured data volume, query load benchmarks, and growth projections (Correct answer)
- Copy the configuration from a public blog post without validation
- Let Elasticsearch auto-configure all settings at runtime
Correct answer: Base sizing on measured data volume, query load benchmarks, and growth projections
Defensible cluster sizing requires empirical benchmarking against realistic data volumes and query patterns combined with documented growth assumptions.
Question 7: A team member bypasses index template validation to speed up deployment. What professional concern does this raise?
- It improves cluster resilience by reducing overhead
- It risks mapping conflicts and data quality issues that become costly to fix later (Correct answer)
- It is acceptable as long as the data volume is small
- It only matters for keyword fields, not text fields
Correct answer: It risks mapping conflicts and data quality issues that become costly to fix later
Skipping template validation can cause mapping explosions, incorrect field types, and data loss that are difficult and expensive to remediate in production.
ElasticSearch Professional Standards & Competencies 2
Which Elasticsearch role-based access control (RBAC) privilege allows a user to read index data but not modify mappings?