ElasticSearch Regulatory Frameworks & Compliance 5 — Questions and Answers
Question 1: A regulated organization must ensure that Elasticsearch configuration changes are tracked and attributable to specific administrators. Which approach best satisfies this change management control?
- Storing elasticsearch.yml in a version-controlled Git repository with mandatory pull request approvals and enforcing infrastructure-as-code for all cluster changes (Correct answer)
- Keeping a manual spreadsheet of configuration changes
- Using Elasticsearch Watcher to detect config file modifications
- Restarting the cluster after every change to create a new audit trail
Correct answer: Storing elasticsearch.yml in a version-controlled Git repository with mandatory pull request approvals and enforcing infrastructure-as-code for all cluster changes
Version-controlling configuration files with mandatory review workflows creates an immutable audit trail of who changed what and when, satisfying change management controls in frameworks like SOC 2 and ISO 27001.
Question 2: Which Elasticsearch snapshot repository type is most appropriate when an organization must store backups in a location that meets FedRAMP-authorized cloud service requirements?
- A local shared filesystem repository on-premises
- An AWS S3 repository pointing to a FedRAMP-authorized GovCloud bucket (Correct answer)
- An HDFS repository on a commercial cloud provider
- A URL repository pointing to an internal web server
Correct answer: An AWS S3 repository pointing to a FedRAMP-authorized GovCloud bucket
FedRAMP requires using authorized cloud services; AWS GovCloud is a FedRAMP High-authorized environment, making its S3 buckets appropriate for storing regulated backup data.
Question 3: An Elasticsearch cluster handles data subject to the EU-US Data Privacy Framework. A breach occurs affecting EU personal data. What is the maximum time organizations typically have to notify supervisory authorities under GDPR?
- 24 hours
- 72 hours (Correct answer)
- 7 days
- 30 days
Correct answer: 72 hours
GDPR Article 33 requires notification to the competent supervisory authority within 72 hours of becoming aware of a personal data breach where feasible.
Question 4: A compliance audit finds that an Elasticsearch cluster's 'elastic' superuser account password has never been rotated. Which risk does this most directly violate in common frameworks like NIST 800-53?
- CM-6: Configuration Settings
- IA-5: Authenticator Management (credential rotation and expiration) (Correct answer)
- AU-2: Audit Events
- SC-8: Transmission Confidentiality
Correct answer: IA-5: Authenticator Management (credential rotation and expiration)
NIST 800-53 IA-5 governs authenticator management, including requirements to rotate passwords periodically and prohibit indefinite use of unchanged credentials.
Question 5: A legal hold requires that specific Elasticsearch documents related to litigation be preserved and not modified or deleted for a defined period. What is the best technical implementation?
- Move the documents to a frozen index and apply a read-only index block, then remove ILM policies that could delete them (Correct answer)
- Export the documents to CSV and store externally
- Create an alias pointing to the documents
- Increase the number of replicas for the affected index
Correct answer: Move the documents to a frozen index and apply a read-only index block, then remove ILM policies that could delete them
Applying a read-only block prevents modifications and deletions while freezing conserves resources; removing applicable ILM delete policies ensures the hold period is respected.
Question 6: Which Elasticsearch security feature allows an organization to delegate authentication to an enterprise identity provider (e.g., Okta or Azure AD) to satisfy SSO requirements common in SOC 2 and ISO 27001 audits?
- Native realm with manually managed users
- SAML or OpenID Connect realm configuration in Elasticsearch security settings (Correct answer)
- API key authentication with long-lived keys
- HTTP basic authentication over HTTPS
Correct answer: SAML or OpenID Connect realm configuration in Elasticsearch security settings
Configuring a SAML or OIDC realm allows Elasticsearch to federate authentication to enterprise IdPs like Okta or Azure AD, enabling SSO and centralized access governance.
Question 7: A data governance policy requires that all personally identifiable information (PII) fields in Elasticsearch be identified and catalogued. Which approach best supports automated PII discovery across large clusters?
- Manually review each index mapping and document a list in a spreadsheet
- Use Elasticsearch's built-in PII scanner available in the security plugin
- Deploy Elastic's Data Frame Analytics or an external data classification tool to scan index mappings and sample documents for PII patterns (Correct answer)
- Rely on application developers to self-report PII fields
Correct answer: Deploy Elastic's Data Frame Analytics or an external data classification tool to scan index mappings and sample documents for PII patterns
Automated data classification tools or ML-based pattern matching against index mappings and sample data provide scalable, consistent PII discovery across many indices.
ElasticSearch Regulatory Frameworks & Compliance 5
A regulated organization must ensure that Elasticsearch configuration changes are tracked and attributable to specific administrators.
Which approach best satisfies this change management control?