ElasticSearch Regulatory Frameworks & Compliance 4 — Questions and Answers
Question 1: A healthcare organization uses Elasticsearch to index medical records. Which Elasticsearch configuration prevents accidental exposure of PHI by ensuring inter-node communication is encrypted?
- Enabling TLS on the HTTP layer only
- Enabling TLS on the transport layer for node-to-node communication (Correct answer)
- Using VPN tunnels and disabling Elasticsearch security features
- Setting 'network.host' to 'localhost'
Correct answer: Enabling TLS on the transport layer for node-to-node communication
The transport layer handles all node-to-node communication; encrypting it with TLS prevents eavesdropping on PHI as it replicates between shards.
Question 2: PCI-DSS Requirement 10.2 mandates logging of all individual user access to cardholder data. In Elasticsearch, which audit log event type most directly satisfies this requirement?
- 'authentication_success' and 'access_granted' audit events (Correct answer)
- 'index_created' and 'index_deleted' audit events
- 'shard_started' cluster events
- 'node_joined' transport events
Correct answer: 'authentication_success' and 'access_granted' audit events
Authentication success and access granted events record the user identity and the resource accessed, providing the per-user access trail PCI-DSS Requirement 10.2 requires.
Question 3: An Elasticsearch deployment must comply with GDPR's data residency requirement, ensuring EU citizen data never leaves the EU. Which feature enforces data locality across a multi-region cluster?
- Cross-cluster replication with a global routing policy
- Shard allocation filtering using 'index.routing.allocation.require' attributes tied to EU nodes (Correct answer)
- Index lifecycle management delete phase
- Snapshot repositories in all regions
Correct answer: Shard allocation filtering using 'index.routing.allocation.require' attributes tied to EU nodes
Shard allocation filters can enforce that specific indices only reside on nodes tagged with an EU region attribute, preventing data from being written to or replicated to non-EU nodes.
Question 4: Which Elasticsearch API would a compliance engineer use to verify that a specific index's settings enforce the required number of replicas for high-availability mandated by a regulatory SLA?
- GET /_cluster/health
- GET /<index>/_settings (Correct answer)
- GET /_cat/shards
- GET /_nodes/stats
Correct answer: GET /<index>/_settings
The index settings API returns the current configuration including 'index.number_of_replicas', allowing verification that the redundancy level meets SLA requirements.
Question 5: A company implementing CIS Elasticsearch Benchmark recommendations wants to disable dynamic scripting to reduce the attack surface. What is the correct approach in modern Elasticsearch versions?
- Set 'script.disable_dynamic' to true in elasticsearch.yml
- Restrict allowed script contexts and types via 'script.allowed_types' and 'script.allowed_contexts' settings (Correct answer)
- Delete the scripts directory from the Elasticsearch installation
- Set 'xpack.security.enabled' to false
Correct answer: Restrict allowed script contexts and types via 'script.allowed_types' and 'script.allowed_contexts' settings
Modern Elasticsearch controls scripting exposure through 'script.allowed_types' (e.g., only 'stored') and 'script.allowed_contexts', replacing the deprecated disable_dynamic flag.
Question 6: A SIEM team needs Elasticsearch to forward audit logs to an external system in real time to satisfy a regulatory requirement for centralized log management. Which approach is most appropriate?
- Manually export audit log files via FTP on a weekly schedule
- Configure Elasticsearch audit log output and use Logstash or Filebeat to ship events to the centralized SIEM (Correct answer)
- Enable Elasticsearch Watcher to email audit summaries
- Use the _cat/audit API endpoint to pull logs
Correct answer: Configure Elasticsearch audit log output and use Logstash or Filebeat to ship events to the centralized SIEM
Elasticsearch can write audit logs to files or directly to an index; Filebeat or Logstash then ships those logs in real time to a centralized SIEM, satisfying continuous monitoring requirements.
Question 7: Under GDPR, a data controller must be able to demonstrate lawful basis for processing personal data stored in Elasticsearch. Which governance practice best supports this requirement?
- Tagging indices with metadata fields that link to the corresponding data processing record in a Data Processing Register (Correct answer)
- Enabling Elasticsearch's built-in GDPR compliance mode
- Storing personal data in encrypted snapshots only
- Using anonymous access to prevent identifying who stored the data
Correct answer: Tagging indices with metadata fields that link to the corresponding data processing record in a Data Processing Register
Maintaining a Data Processing Register and linking indices to their processing records via index metadata or naming conventions provides the audit trail needed to demonstrate lawful basis.
ElasticSearch Regulatory Frameworks & Compliance 4
A healthcare organization uses Elasticsearch to index medical records.
Which Elasticsearch configuration prevents accidental exposure of PHI by ensuring inter-node communication is encrypted?