ElasticSearch Risk Assessment & Management 3

Question 1

Which Elasticsearch audit log event type is most useful for detecting unauthorized index deletion attempts?

Accepted Answer

access_denied

Answer

The access_denied event captures attempts to perform actions the user lacks privileges for, including unauthorized delete operations.

Question 2

What risk arises when cross-cluster replication (CCR) is configured without TLS between clusters?

Accepted Answer

Replicated data is transmitted in plaintext, exposing it to interception

Answer

Without TLS, data replicated between clusters travels over an unencrypted channel, vulnerable to man-in-the-middle attacks.

Question 3

An Elasticsearch cluster experiences a sudden spike in bulk indexing requests that exhausts the thread pool queue. What type of risk event is this?

Accepted Answer

Availability risk causing write rejections and potential data loss

Answer

Thread pool exhaustion causes bulk rejections (429 errors), meaning incoming data may be lost if not retried by the client.

Question 4

Which setting reduces the risk of a runaway search query consuming all available CPU on an Elasticsearch node?

Accepted Answer

search.max_buckets combined with circuit breakers

Answer

Limiting aggregation bucket counts and enabling circuit breakers prevents excessively resource-hungry queries from destabilizing the node.

Question 5

Why is it risky to store Elasticsearch keystore credentials (elasticsearch-keystore) in a version control system?

Accepted Answer

Secrets committed to VCS can be retrieved by anyone with repository access, causing credential leakage

Answer

Committing the keystore to VCS exposes sensitive credentials (passwords, API keys) to all repository contributors and audit logs.

ElasticSearch Practice Test