ElasticSearch Regulatory Frameworks & Compliance 3

Question 1

A financial services firm must comply with SEC Rule 17a-4, which requires WORM (Write Once Read Many) storage for certain records. How can Elasticsearch deployments best meet this requirement?

Accepted Answer

Enable read-only index blocks after initial ingestion and pair with compliant WORM object storage for snapshots

Answer

Elasticsearch itself does not provide SEC 17a-4 WORM compliance; organizations pair read-only index blocks with certified WORM-compliant storage (e.g., AWS S3 Object Lock) for snapshots.

Question 2

Under CCPA, a California resident submits a 'right to know' request asking what personal data is held about them. Which Elasticsearch approach best supports responding to this request?

Accepted Answer

Query all relevant indices using the user's identifier and aggregate results to fulfill the disclosure

Answer

Responding to CCPA 'right to know' requests requires searching all relevant indices with the user's identifier and compiling the results into a disclosure report.

Question 3

Which Elasticsearch feature allows an organization to mask or omit sensitive fields (e.g., SSN, credit card numbers) in query results returned to specific roles, supporting least-privilege compliance?

Accepted Answer

Field-level security (FLS)

Answer

Field-level security restricts which fields in a document a given role can read, effectively hiding sensitive fields like SSNs from unauthorized users.

Question 4

An organization subject to NIST SP 800-53 must implement 'least privilege' for Elasticsearch cluster management. Which practice best satisfies this control?

Accepted Answer

Defining granular custom roles that grant only the cluster privileges required for each admin's duties

Answer

NIST least-privilege is implemented by creating role definitions that map narrowly to job functions, preventing administrators from acquiring broader access than needed.

Question 5

Which Elasticsearch TLS configuration option ensures that both the Elasticsearch node and the connecting client mutually authenticate each other, as often required by FedRAMP?

Accepted Answer

Mutual TLS (mTLS) with client certificate verification enabled

Answer

Mutual TLS requires both parties to present valid certificates, ensuring bidirectional identity verification which FedRAMP's high-impact baseline mandates for inter-service communication.

ElasticSearch Practice Test

ElasticSearch Practice Test

ElasticSearch Regulatory Frameworks & Compliance 3