ElasticSearch Professional Standards & Competencies 3 — Questions and Answers
Question 1: Which Elasticsearch practice demonstrates competency in maintaining cluster health proactively?
- Waiting for red cluster status before investigating
- Setting up Watcher alerts or Kibana alerting rules on key health metrics (Correct answer)
- Disabling shard allocation to prevent changes
- Increasing heap size to 100% of RAM
Correct answer: Setting up Watcher alerts or Kibana alerting rules on key health metrics
Proactive monitoring with automated alerting on metrics like disk usage, JVM heap, and shard counts is a mark of operational competency.
Question 2: What is the professional standard for managing Elasticsearch credentials used by application services?
- Hardcode credentials in application source code for reliability
- Store credentials in a secrets manager and rotate them on a defined schedule (Correct answer)
- Share one superuser account across all services
- Use anonymous access for internal services to simplify management
Correct answer: Store credentials in a secrets manager and rotate them on a defined schedule
Industry-standard credential hygiene requires using a secrets manager and scheduled rotation to limit the blast radius of a credential compromise.
Question 3: An Elasticsearch professional is asked to reduce search latency. Which competency-driven approach should be used FIRST?
- Immediately add more nodes to the cluster
- Profile queries with the Profile API to identify bottlenecks before making changes (Correct answer)
- Disable all security features to eliminate overhead
- Reduce the number of shards to zero
Correct answer: Profile queries with the Profile API to identify bottlenecks before making changes
The Profile API reveals query execution details at the shard level, enabling data-driven optimization rather than speculative hardware spending.
Question 4: When performing a major Elasticsearch version upgrade in a professional environment, what is the recommended rollback strategy?
- Accept data loss as inevitable during upgrades
- Take a full snapshot before the upgrade so the cluster can be restored if needed (Correct answer)
- Upgrade all nodes simultaneously to minimize downtime
- Delete all indices before upgrading to avoid compatibility issues
Correct answer: Take a full snapshot before the upgrade so the cluster can be restored if needed
A verified snapshot taken before upgrading provides a restore point, satisfying change management and business continuity requirements.
Question 5: A junior engineer asks why replica shards are required in a production Elasticsearch cluster. What is the professional explanation?
- Replicas improve write throughput by distributing writes
- Replicas provide high availability and increase read throughput by serving parallel search requests (Correct answer)
- Replicas are only needed for cold data tiers
- Replicas reduce disk usage by compressing primary shard data
Correct answer: Replicas provide high availability and increase read throughput by serving parallel search requests
Replica shards provide fault tolerance (the cluster remains green if a node fails) and scale read throughput by allowing searches to be served from any shard copy.
Question 6: Which approach reflects professional competency when onboarding a new data stream into Elasticsearch?
- Ingest data without a template and let Elasticsearch infer all mappings
- Define an explicit index template with appropriate field types and ILM policy before ingesting data (Correct answer)
- Use dynamic mapping with no review and fix issues after data is live
- Set all fields to 'object' type to simplify the schema
Correct answer: Define an explicit index template with appropriate field types and ILM policy before ingesting data
Defining explicit templates before ingestion prevents mapping conflicts, ensures correct field types, and enforces lifecycle policies from day one.
Question 7: What does professional knowledge of Elasticsearch's 'split brain' scenario require an engineer to do?
- Enable split brain deliberately to improve write performance
- Configure minimum_master_nodes (or use cluster.initial_master_nodes in 7.x+) to prevent two independent clusters from forming (Correct answer)
- Disable the master node role on all nodes
- Allow split brain and merge the clusters manually after detection
Correct answer: Configure minimum_master_nodes (or use cluster.initial_master_nodes in 7.x+) to prevent two independent clusters from forming
Proper quorum configuration (minimum_master_nodes = (N/2)+1 in older versions, or the discovery.zen settings replacement) prevents the cluster from electing two masters.
ElasticSearch Professional Standards & Competencies 3
Which Elasticsearch practice demonstrates competency in maintaining cluster health proactively?