ElasticSearch Risk Assessment & Management 2

Question 1

Which Elasticsearch feature allows you to receive alerts before a security threat causes data loss?

Accepted Answer

Watcher

Answer

Watcher monitors cluster conditions and triggers alerts or actions when defined thresholds are met.

Question 2

An attacker gains access to an Elasticsearch node's JVM heap dump. Which data risk does this primarily create?

Accepted Answer

Exposure of in-memory data including cached documents and credentials

Answer

Heap dumps contain live JVM memory, which may include cached plaintext documents, passwords, or API keys.

Question 3

What is the primary risk of enabling dynamic mapping in a production Elasticsearch index?

Accepted Answer

Unintended field type inference can cause mapping explosions and query failures

Answer

Dynamic mapping can auto-create thousands of unintended fields, leading to mapping explosions that degrade cluster performance.

Question 4

Which risk does NOT apply when storing sensitive PII in Elasticsearch without field-level security?

Accepted Answer

PII fields are automatically encrypted at the storage layer

Answer

Elasticsearch does not automatically encrypt individual fields; field-level encryption must be implemented externally.

Question 5

A cluster's master node is also acting as a data node. What risk does this configuration introduce?

Accepted Answer

Heavy indexing load can destabilize master election and cause split-brain scenarios

Answer

Combining master and data roles means resource pressure from indexing/search can starve master tasks, risking cluster instability.

ElasticSearch Practice Test