ElasticSearch Professional Standards & Competencies 5 — Questions and Answers
Question 1: A professional deploying Elasticsearch in a regulated industry must ensure data at rest is encrypted. Which approach is correct?
- Rely on Elasticsearch's built-in field compression as encryption
- Use OS-level disk encryption (e.g., LUKS) or cloud provider encryption, since Elasticsearch does not encrypt data at rest natively (Correct answer)
- Set index.codec to best_compression to encrypt data
- Enable xpack.security.http.ssl to encrypt stored data
Correct answer: Use OS-level disk encryption (e.g., LUKS) or cloud provider encryption, since Elasticsearch does not encrypt data at rest natively
Elasticsearch does not provide native at-rest encryption; disk-level encryption via the OS or cloud provider is required to satisfy regulatory mandates.
Question 2: Which Elasticsearch competency is demonstrated by choosing a 'keyword' field type over 'text' for a status field used only in filter aggregations?
- Text fields are always preferred for performance reasons
- Keyword fields store exact values without analysis, making them correct and efficient for filtering and aggregating categorical data (Correct answer)
- Keyword fields support full-text search better than text fields
- The field type does not affect aggregation accuracy
Correct answer: Keyword fields store exact values without analysis, making them correct and efficient for filtering and aggregating categorical data
Keyword fields bypass the analysis pipeline and store raw values, which is the correct choice for exact-match filtering and terms aggregations on low-cardinality fields.
Question 3: What professional obligation does an Elasticsearch engineer have when discovering that a production index has no snapshot policy configured?
- Ignore it since Elasticsearch replication prevents data loss
- Immediately create and test a snapshot lifecycle management (SLM) policy and report the gap to stakeholders (Correct answer)
- Delete old indices to avoid the need for snapshots
- Assume the infrastructure team handles backups without verification
Correct answer: Immediately create and test a snapshot lifecycle management (SLM) policy and report the gap to stakeholders
Replicas protect against node failure but not against accidental deletion or corruption; professional practice requires verified, automated snapshot policies.
Question 4: When a search query returns unexpectedly low relevance scores, which professional debugging step should be taken first?
- Immediately switch to a BM25 alternative scoring model
- Use the Explain API to inspect how scores are computed for specific documents (Correct answer)
- Increase the number of shards to improve scoring
- Delete and re-index all data to reset scores
Correct answer: Use the Explain API to inspect how scores are computed for specific documents
The Explain API (GET /<index>/_explain/<id>) provides a detailed breakdown of how relevance scores were calculated, enabling targeted tuning.
Question 5: A professional Elasticsearch engineer is asked to implement multi-tenancy for different client organizations. Which approach best balances isolation and resource efficiency?
- Use a single index with a 'client_id' field and document-level security to enforce tenant isolation (Correct answer)
- Create a separate Elasticsearch cluster for each client regardless of cost
- Share one index with no access controls and rely on application-layer filtering
- Use a single superuser role for all tenants
Correct answer: Use a single index with a 'client_id' field and document-level security to enforce tenant isolation
Document-level security (DLS) with a tenant identifier field provides logical isolation within a shared index, balancing cost efficiency with access control.
Question 6: Which professional practice ensures Elasticsearch mappings remain maintainable as a schema evolves over time?
- Allow unlimited dynamic mapping with no review process
- Version index templates and use reindex workflows to migrate data when breaking changes are required (Correct answer)
- Delete all existing data and start fresh for every schema change
- Disable all dynamic mapping globally to freeze the schema permanently
Correct answer: Version index templates and use reindex workflows to migrate data when breaking changes are required
Versioned templates and controlled reindex migrations allow schema evolution without data loss, supporting a reproducible and auditable change management process.
Question 7: An Elasticsearch professional is onboarding a new team member. Which topic is MOST critical to cover first for safe cluster operations?
- How to customize Kibana color themes
- The impact of shard count on performance, and why adding shards is not a universal solution (Correct answer)
- How to write Elasticsearch blog posts
- How to disable security for easier local development
Correct answer: The impact of shard count on performance, and why adding shards is not a universal solution
Misconfigured shard counts are among the most common causes of Elasticsearch performance problems; understanding the over-sharding pitfall is foundational operational knowledge.
ElasticSearch Professional Standards & Competencies 5
A professional deploying Elasticsearch in a regulated industry must ensure data at rest is encrypted.
Which approach is correct?