ElasticSearch Regulatory Frameworks & Compliance 4

Question 1

A healthcare organization uses Elasticsearch to index medical records. Which Elasticsearch configuration prevents accidental exposure of PHI by ensuring inter-node communication is encrypted?

Accepted Answer

Enabling TLS on the transport layer for node-to-node communication

Answer

The transport layer handles all node-to-node communication; encrypting it with TLS prevents eavesdropping on PHI as it replicates between shards.

Question 2

PCI-DSS Requirement 10.2 mandates logging of all individual user access to cardholder data. In Elasticsearch, which audit log event type most directly satisfies this requirement?

Accepted Answer

'authentication_success' and 'access_granted' audit events

Answer

Authentication success and access granted events record the user identity and the resource accessed, providing the per-user access trail PCI-DSS Requirement 10.2 requires.

Question 3

An Elasticsearch deployment must comply with GDPR's data residency requirement, ensuring EU citizen data never leaves the EU. Which feature enforces data locality across a multi-region cluster?

Accepted Answer

Shard allocation filtering using 'index.routing.allocation.require' attributes tied to EU nodes

Answer

Shard allocation filters can enforce that specific indices only reside on nodes tagged with an EU region attribute, preventing data from being written to or replicated to non-EU nodes.

Question 4

Which Elasticsearch API would a compliance engineer use to verify that a specific index's settings enforce the required number of replicas for high-availability mandated by a regulatory SLA?

Accepted Answer

GET /<index>/_settings

Answer

The index settings API returns the current configuration including 'index.number_of_replicas', allowing verification that the redundancy level meets SLA requirements.

Question 5

A company implementing CIS Elasticsearch Benchmark recommendations wants to disable dynamic scripting to reduce the attack surface. What is the correct approach in modern Elasticsearch versions?

Accepted Answer

Restrict allowed script contexts and types via 'script.allowed_types' and 'script.allowed_contexts' settings

Answer

Modern Elasticsearch controls scripting exposure through 'script.allowed_types' (e.g., only 'stored') and 'script.allowed_contexts', replacing the deprecated disable_dynamic flag.

ElasticSearch Practice Test

ElasticSearch Practice Test

ElasticSearch Regulatory Frameworks & Compliance 4