ElasticSearch Regulatory Frameworks & Compliance 5

Question 1

A regulated organization must ensure that Elasticsearch configuration changes are tracked and attributable to specific administrators. Which approach best satisfies this change management control?

Accepted Answer

Storing elasticsearch.yml in a version-controlled Git repository with mandatory pull request approvals and enforcing infrastructure-as-code for all cluster changes

Answer

Version-controlling configuration files with mandatory review workflows creates an immutable audit trail of who changed what and when, satisfying change management controls in frameworks like SOC 2 and ISO 27001.

Question 2

Which Elasticsearch snapshot repository type is most appropriate when an organization must store backups in a location that meets FedRAMP-authorized cloud service requirements?

Accepted Answer

An AWS S3 repository pointing to a FedRAMP-authorized GovCloud bucket

Answer

FedRAMP requires using authorized cloud services; AWS GovCloud is a FedRAMP High-authorized environment, making its S3 buckets appropriate for storing regulated backup data.

Question 3

An Elasticsearch cluster handles data subject to the EU-US Data Privacy Framework. A breach occurs affecting EU personal data. What is the maximum time organizations typically have to notify supervisory authorities under GDPR?

Accepted Answer

72 hours

Answer

GDPR Article 33 requires notification to the competent supervisory authority within 72 hours of becoming aware of a personal data breach where feasible.

Question 4

A compliance audit finds that an Elasticsearch cluster's 'elastic' superuser account password has never been rotated. Which risk does this most directly violate in common frameworks like NIST 800-53?

Accepted Answer

IA-5: Authenticator Management (credential rotation and expiration)

Answer

NIST 800-53 IA-5 governs authenticator management, including requirements to rotate passwords periodically and prohibit indefinite use of unchanged credentials.

Question 5

A legal hold requires that specific Elasticsearch documents related to litigation be preserved and not modified or deleted for a defined period. What is the best technical implementation?

Accepted Answer

Move the documents to a frozen index and apply a read-only index block, then remove ILM policies that could delete them

Answer

Applying a read-only block prevents modifications and deletions while freezing conserves resources; removing applicable ILM delete policies ensures the hold period is respected.

ElasticSearch Practice Test

ElasticSearch Practice Test

ElasticSearch Regulatory Frameworks & Compliance 5