ElasticSearch Regulatory Frameworks & Compliance 2 — Questions and Answers
Question 1: Which Elasticsearch feature allows you to automatically delete indices after a specified retention period, helping organizations meet data minimization requirements under GDPR?
- Index Lifecycle Management (ILM) (Correct answer)
- Snapshot and Restore
- Cross-Cluster Replication
- Index Aliases
Correct answer: Index Lifecycle Management (ILM)
ILM policies can define a delete phase with a minimum age, automatically removing indices and their data once the retention window expires.
Question 2: Under HIPAA, which Elasticsearch configuration ensures that Protected Health Information (PHI) stored in indices is encrypted at rest?
- Enabling Elasticsearch keystore encryption
- Enabling TLS on transport layer only
- Enabling encryption at rest via the X-Pack security plugin or OS-level disk encryption (Correct answer)
- Using base64 encoding for PHI fields
Correct answer: Enabling encryption at rest via the X-Pack security plugin or OS-level disk encryption
HIPAA requires encryption at rest; Elasticsearch supports this through X-Pack's encrypted storage or by relying on OS/disk-level encryption solutions.
Question 3: An Elasticsearch cluster stores EU citizen data. Under GDPR Article 17 ('Right to Erasure'), what is the most compliant approach to deleting a single user's data?
- Delete the entire index containing the user's data
- Use the Delete by Query API targeting the user's document ID or identifier (Correct answer)
- Overwrite the document with null values
- Disable the index containing the user's record
Correct answer: Use the Delete by Query API targeting the user's document ID or identifier
The Delete by Query API allows targeted deletion of specific documents matching a query, fulfilling erasure requests without affecting other users' data.
Question 4: Which PCI-DSS requirement most directly mandates network segmentation for an Elasticsearch cluster that stores cardholder data?
- Requirement 3: Protect stored cardholder data
- Requirement 1: Install and maintain a firewall configuration (Correct answer)
- Requirement 6: Develop and maintain secure systems
- Requirement 10: Track and monitor all access
Correct answer: Requirement 1: Install and maintain a firewall configuration
PCI-DSS Requirement 1 governs firewall and network controls, including segmenting systems that store cardholder data from untrusted networks.
Question 5: A compliance officer requires that all Elasticsearch search queries against sensitive data be logged with the requesting user's identity. Which feature enables this?
- Elasticsearch Slow Log
- Audit Logging (X-Pack Security) (Correct answer)
- Elasticsearch Watcher
- GeoIP Processor
Correct answer: Audit Logging (X-Pack Security)
X-Pack Security's audit logging records authentication events, authorization decisions, and REST/transport-layer requests along with the authenticated user's identity.
Question 6: Under SOC 2 Type II, an auditor asks for evidence that access to Elasticsearch was reviewed periodically. Which Elasticsearch mechanism best supports this requirement?
- Regular cluster health checks via the _cluster/health API
- Native realm user listings combined with periodic access reviews documented externally (Correct answer)
- Using the _cat/nodes API to list active connections
- Snapshot policies with quarterly cadence
Correct answer: Native realm user listings combined with periodic access reviews documented externally
SOC 2 access review evidence is produced by exporting user/role lists from the native realm and documenting a formal review cycle, often tracked in an external ITSM tool.
Question 7: Which Elasticsearch role-based access control (RBAC) concept restricts a user to reading only documents that match a specific query, supporting data segregation mandated by regulatory frameworks?
- Field-level security
- Document-level security (DLS) (Correct answer)
- Index aliases with filters
- API key scoping
Correct answer: Document-level security (DLS)
Document-level security allows roles to define a query that filters which documents a user can retrieve, ensuring they only see records they are authorized to access.
ElasticSearch Regulatory Frameworks & Compliance 2
Which Elasticsearch feature allows you to automatically delete indices after a specified retention period, helping organizations meet data minimization requirements under GDPR?