ElasticSearch Regulatory Frameworks & Compliance 3 — Questions and Answers
Question 1: A financial services firm must comply with SEC Rule 17a-4, which requires WORM (Write Once Read Many) storage for certain records. How can Elasticsearch deployments best meet this requirement?
- Enable read-only index blocks after initial ingestion and pair with compliant WORM object storage for snapshots (Correct answer)
- Use Elasticsearch's built-in WORM mode flag in index settings
- Set 'index.write.wait_for_active_shards' to 'all'
- Configure ILM to freeze indices after creation
Correct answer: Enable read-only index blocks after initial ingestion and pair with compliant WORM object storage for snapshots
Elasticsearch itself does not provide SEC 17a-4 WORM compliance; organizations pair read-only index blocks with certified WORM-compliant storage (e.g., AWS S3 Object Lock) for snapshots.
Question 2: Under CCPA, a California resident submits a 'right to know' request asking what personal data is held about them. Which Elasticsearch approach best supports responding to this request?
- Run a full cluster reindex to isolate the user's data
- Query all relevant indices using the user's identifier and aggregate results to fulfill the disclosure (Correct answer)
- Delete all indices containing the user's data
- Use cross-cluster search to forward the request to a CCPA endpoint
Correct answer: Query all relevant indices using the user's identifier and aggregate results to fulfill the disclosure
Responding to CCPA 'right to know' requests requires searching all relevant indices with the user's identifier and compiling the results into a disclosure report.
Question 3: Which Elasticsearch feature allows an organization to mask or omit sensitive fields (e.g., SSN, credit card numbers) in query results returned to specific roles, supporting least-privilege compliance?
- Document-level security
- Field-level security (FLS) (Correct answer)
- Ingest pipeline redaction processor
- Watcher alert filtering
Correct answer: Field-level security (FLS)
Field-level security restricts which fields in a document a given role can read, effectively hiding sensitive fields like SSNs from unauthorized users.
Question 4: An organization subject to NIST SP 800-53 must implement 'least privilege' for Elasticsearch cluster management. Which practice best satisfies this control?
- Creating a single superuser account shared among all administrators
- Defining granular custom roles that grant only the cluster privileges required for each admin's duties (Correct answer)
- Using API keys for all users with unlimited privileges
- Enabling anonymous access with IP filtering
Correct answer: Defining granular custom roles that grant only the cluster privileges required for each admin's duties
NIST least-privilege is implemented by creating role definitions that map narrowly to job functions, preventing administrators from acquiring broader access than needed.
Question 5: Which Elasticsearch TLS configuration option ensures that both the Elasticsearch node and the connecting client mutually authenticate each other, as often required by FedRAMP?
- One-way TLS with a CA-signed server certificate
- Mutual TLS (mTLS) with client certificate verification enabled (Correct answer)
- TLS with self-signed certificates and hostname verification disabled
- SSH tunneling between nodes
Correct answer: Mutual TLS (mTLS) with client certificate verification enabled
Mutual TLS requires both parties to present valid certificates, ensuring bidirectional identity verification which FedRAMP's high-impact baseline mandates for inter-service communication.
Question 6: A GDPR Data Protection Impact Assessment (DPIA) identifies that Elasticsearch log data contains EU personal data. Which technical measure satisfies the 'pseudonymization' recommendation?
- Storing logs in a separate cluster with no cross-cluster replication
- Using an ingest pipeline to hash or tokenize personal identifiers before indexing (Correct answer)
- Enabling slow log at the DEBUG level
- Applying ILM hot-warm architecture
Correct answer: Using an ingest pipeline to hash or tokenize personal identifiers before indexing
An ingest pipeline with a script or fingerprint processor can replace personal identifiers with deterministic hashes or tokens before data is written to an index, achieving pseudonymization.
Question 7: Under ISO 27001, an organization must demonstrate that access rights to Elasticsearch are removed promptly when an employee leaves. Which combination of controls best supports this?
- Manual password resets performed weekly
- Integration with an Identity Provider (IdP) via SAML/LDAP so that disabling an account in the IdP revokes Elasticsearch access immediately (Correct answer)
- Rotating all Elasticsearch API keys monthly
- Configuring ILM to expire user accounts
Correct answer: Integration with an Identity Provider (IdP) via SAML/LDAP so that disabling an account in the IdP revokes Elasticsearch access immediately
Federating Elasticsearch authentication to an IdP means that deprovisioning an account in the IdP immediately prevents the user from authenticating, satisfying ISO 27001 access revocation controls.
ElasticSearch Regulatory Frameworks & Compliance 3
A financial services firm must comply with SEC Rule 17a-4, which requires WORM (Write Once Read Many) storage for certain records.
How can Elasticsearch deployments best meet this requirement?