ElasticSearch Risk Assessment & Management 2 — Questions and Answers
Question 1: Which Elasticsearch feature allows you to receive alerts before a security threat causes data loss?
- Watcher (Correct answer)
- Snapshot lifecycle policy
- ILM rollover
- Cross-cluster replication
Correct answer: Watcher
Watcher monitors cluster conditions and triggers alerts or actions when defined thresholds are met.
Question 2: An attacker gains access to an Elasticsearch node's JVM heap dump. Which data risk does this primarily create?
- Exposure of in-memory data including cached documents and credentials (Correct answer)
- Corruption of on-disk shard files
- Loss of cluster state metadata
- Denial of service via memory exhaustion
Correct answer: Exposure of in-memory data including cached documents and credentials
Heap dumps contain live JVM memory, which may include cached plaintext documents, passwords, or API keys.
Question 3: What is the primary risk of enabling dynamic mapping in a production Elasticsearch index?
- Unintended field type inference can cause mapping explosions and query failures (Correct answer)
- Documents are indexed slower due to type detection overhead
- All fields default to the keyword type, losing full-text search
- Replicas cannot be allocated until mapping is finalized
Correct answer: Unintended field type inference can cause mapping explosions and query failures
Dynamic mapping can auto-create thousands of unintended fields, leading to mapping explosions that degrade cluster performance.
Question 4: Which risk does NOT apply when storing sensitive PII in Elasticsearch without field-level security?
- Any user with read access on the index can retrieve PII fields
- PII fields are automatically encrypted at the storage layer (Correct answer)
- Aggregations on PII fields can leak data to unauthorized users
- Scroll and search-after queries can expose PII in bulk
Correct answer: PII fields are automatically encrypted at the storage layer
Elasticsearch does not automatically encrypt individual fields; field-level encryption must be implemented externally.
Question 5: A cluster's master node is also acting as a data node. What risk does this configuration introduce?
- Heavy indexing load can destabilize master election and cause split-brain scenarios (Correct answer)
- Shards cannot be allocated across multiple nodes
- Search queries bypass the query cache
- Security certificates are not applied to data transport
Correct answer: Heavy indexing load can destabilize master election and cause split-brain scenarios
Combining master and data roles means resource pressure from indexing/search can starve master tasks, risking cluster instability.
Question 6: Which Elasticsearch mechanism helps mitigate the risk of a single shard failure causing data loss?
- Replica shards (Correct answer)
- Index aliases
- Cross-cluster search
- Ingest pipelines
Correct answer: Replica shards
Replica shards are copies of primary shards stored on different nodes, providing redundancy against single-node failures.
Question 7: You discover that your Elasticsearch cluster is accessible on port 9200 from the public internet without authentication. What is the FIRST remediation step?
- Restrict port 9200 at the network/firewall level immediately (Correct answer)
- Enable X-Pack security and restart nodes
- Set discovery.seed_hosts to an empty list
- Rotate all API keys
Correct answer: Restrict port 9200 at the network/firewall level immediately
Network-level blocking provides immediate protection while longer-term authentication and security configurations are applied.
ElasticSearch Risk Assessment & Management 2
Which Elasticsearch feature allows you to receive alerts before a security threat causes data loss?