ElasticSearch Risk Assessment & Management 3 — Questions and Answers
Question 1: Which Elasticsearch audit log event type is most useful for detecting unauthorized index deletion attempts?
- indices_deleted
- authentication_failed
- connection_denied
- access_denied (Correct answer)
Correct answer: access_denied
The access_denied event captures attempts to perform actions the user lacks privileges for, including unauthorized delete operations.
Question 2: What risk arises when cross-cluster replication (CCR) is configured without TLS between clusters?
- Replicated data is transmitted in plaintext, exposing it to interception (Correct answer)
- CCR will silently drop documents that contain special characters
- The follower index will not update when the leader index changes
- Cluster stats are not forwarded to the remote cluster
Correct answer: Replicated data is transmitted in plaintext, exposing it to interception
Without TLS, data replicated between clusters travels over an unencrypted channel, vulnerable to man-in-the-middle attacks.
Question 3: An Elasticsearch cluster experiences a sudden spike in bulk indexing requests that exhausts the thread pool queue. What type of risk event is this?
- Availability risk causing write rejections and potential data loss (Correct answer)
- Integrity risk due to document corruption
- Compliance risk due to unindexed audit logs
- Confidentiality risk from exposed queue contents
Correct answer: Availability risk causing write rejections and potential data loss
Thread pool exhaustion causes bulk rejections (429 errors), meaning incoming data may be lost if not retried by the client.
Question 4: Which setting reduces the risk of a runaway search query consuming all available CPU on an Elasticsearch node?
- search.max_buckets combined with circuit breakers (Correct answer)
- index.max_result_window set to a high value
- indices.fielddata.cache.size set to 100%
- Disabling the query cache globally
Correct answer: search.max_buckets combined with circuit breakers
Limiting aggregation bucket counts and enabling circuit breakers prevents excessively resource-hungry queries from destabilizing the node.
Question 5: Why is it risky to store Elasticsearch keystore credentials (elasticsearch-keystore) in a version control system?
- Secrets committed to VCS can be retrieved by anyone with repository access, causing credential leakage (Correct answer)
- The keystore binary format is incompatible with git line-ending normalization
- VCS commits trigger automatic keystore rotation that breaks running nodes
- Keystore files contain shard routing tables that are node-specific
Correct answer: Secrets committed to VCS can be retrieved by anyone with repository access, causing credential leakage
Committing the keystore to VCS exposes sensitive credentials (passwords, API keys) to all repository contributors and audit logs.
Question 6: A security assessment finds that Elasticsearch nodes are using self-signed certificates expired 30 days ago. What is the primary operational risk?
- Nodes may reject intra-cluster TLS handshakes, causing the cluster to lose quorum or split (Correct answer)
- Index aliases stop resolving after certificate expiry
- Snapshot repositories become read-only after certificate expiry
- Kibana session tokens are invalidated cluster-wide
Correct answer: Nodes may reject intra-cluster TLS handshakes, causing the cluster to lose quorum or split
Expired certificates can cause TLS handshake failures between nodes, potentially partitioning the cluster or blocking node joins.
Question 7: Which Elasticsearch feature helps assess the risk of a query returning stale data after a primary shard failover?
- The _seq_no and _primary_term fields for optimistic concurrency control (Correct answer)
- The routing parameter on search requests
- The preference parameter set to _local
- The explain API on the query
Correct answer: The _seq_no and _primary_term fields for optimistic concurrency control
Sequence numbers and primary terms allow clients to detect whether a document has been modified or if they are reading post-failover data.
ElasticSearch Risk Assessment & Management 3
Which Elasticsearch audit log event type is most useful for detecting unauthorized index deletion attempts?