ElasticSearch Professional Standards & Competencies 4 — Questions and Answers
Question 1: An Elasticsearch engineer is reviewing a colleague's pull request that removes the 'read' privilege from a role and grants 'all' instead. What is the professional concern?
- 'all' is always more efficient than 'read'
- Granting 'all' violates least-privilege and increases the blast radius if the account is compromised (Correct answer)
- 'all' is required for search queries to work
- There is no concern since roles are managed by Elasticsearch automatically
Correct answer: Granting 'all' violates least-privilege and increases the blast radius if the account is compromised
Least-privilege is a foundational security principle; granting 'all' instead of 'read' unnecessarily expands the attack surface.
Question 2: Which Elasticsearch competency is demonstrated by correctly interpreting a 'circuit_breaking_exception' error?
- The cluster has a network partition
- JVM heap memory is exhausted and Elasticsearch is protecting itself from an OutOfMemoryError (Correct answer)
- The index has too many shards
- TLS certificates have expired
Correct answer: JVM heap memory is exhausted and Elasticsearch is protecting itself from an OutOfMemoryError
Circuit breakers prevent JVM OutOfMemoryErrors by rejecting requests that would exceed configured memory limits, and understanding this guides heap tuning.
Question 3: A professional standard for Elasticsearch deployments requires that all inter-node communication be encrypted. Which setting enforces this?
- xpack.security.transport.ssl.enabled: true (Correct answer)
- index.number_of_replicas: 1
- cluster.routing.allocation.enable: all
- http.cors.enabled: true
Correct answer: xpack.security.transport.ssl.enabled: true
Setting xpack.security.transport.ssl.enabled to true enforces TLS on the transport layer used for all inter-node Elasticsearch communication.
Question 4: When an Elasticsearch cluster disk usage exceeds the flood-stage watermark, what professional action is required immediately?
- Restart all data nodes simultaneously
- Free disk space or add capacity, then reset index.blocks.read_only_allow_delete on affected indices (Correct answer)
- Increase the watermark threshold to 100% to regain writes
- Delete the _security index to recover space
Correct answer: Free disk space or add capacity, then reset index.blocks.read_only_allow_delete on affected indices
Elasticsearch sets indices to read-only at the flood-stage watermark; resolving disk pressure and then clearing the read-only block restores write access.
Question 5: What is the professional purpose of using Index Lifecycle Management (ILM) in Elasticsearch?
- To increase write throughput by removing old documents automatically
- To automate the movement of indices through hot, warm, cold, and delete phases based on age or size policies (Correct answer)
- To replicate indices across clusters for disaster recovery
- To enforce schema validation on incoming documents
Correct answer: To automate the movement of indices through hot, warm, cold, and delete phases based on age or size policies
ILM automates index lifecycle transitions—rollover, shrink, freeze, and delete—reducing operational burden and storage costs.
Question 6: A professional Elasticsearch engineer is asked to present cluster capacity planning to leadership. Which metric is MOST relevant?
- The number of Kibana visualizations created
- Daily ingest volume (GB/day), retention period, replication factor, and target heap usage (Correct answer)
- The number of unique users querying Kibana
- The version of the Logstash pipeline
Correct answer: Daily ingest volume (GB/day), retention period, replication factor, and target heap usage
Capacity planning for Elasticsearch centers on ingest rate, data retention, replication overhead, and JVM heap, which together determine required disk, RAM, and CPU.
Question 7: Which professional behavior is expected when an Elasticsearch node's JVM heap usage consistently exceeds 75%?
- Accept the high heap usage as normal Elasticsearch behavior
- Investigate slow query patterns, force-merge large segments, or add nodes to redistribute shards before the situation causes GC pressure (Correct answer)
- Disable the garbage collector to improve performance
- Increase the heap to 32GB or more to resolve the issue
Correct answer: Investigate slow query patterns, force-merge large segments, or add nodes to redistribute shards before the situation causes GC pressure
Sustained heap above 75% signals GC pressure risk; investigation and remediation (query optimization, segment merging, shard rebalancing) are required before reaching critical levels.
ElasticSearch Professional Standards & Competencies 4
An Elasticsearch engineer is reviewing a colleague's pull request that removes the 'read' privilege from a role and grants 'all' instead.
What is the professional concern?