ElasticSearch Risk Assessment & Management 4

Question 1

What is the risk of setting indices.recovery.max_bytes_per_sec to an extremely high value during a large shard recovery?

Accepted Answer

Recovery saturates network bandwidth, degrading query performance for live traffic

Answer

Unrestricted recovery bandwidth can crowd out search and indexing traffic, causing latency spikes and timeouts in production.

Question 2

Which risk is introduced by using a single Elasticsearch service account token for all application microservices?

Accepted Answer

Compromise of one service exposes credentials used by all services, widening the blast radius

Answer

Shared credentials mean a breach of one microservice grants an attacker access under the same identity to all resources that token can reach.

Question 3

An Elasticsearch ILM policy is misconfigured, preventing old indices from rolling over. What risk does this create over time?

Accepted Answer

A single index grows indefinitely, increasing shard size beyond recommended limits and degrading search performance

Answer

Without rollover, indices accumulate unbounded data, leading to oversized shards that slow merges, queries, and recovery operations.

Question 4

Which attack vector is specifically mitigated by enabling Elasticsearch's document-level security (DLS)?

Accepted Answer

Users accessing documents they are not authorized to see within a shared index

Answer

DLS applies per-query filters so users only see documents matching their security policy, preventing unauthorized cross-tenant data access.

Question 5

A cluster has no snapshot repository configured. Which risk category does this represent?

Accepted Answer

Disaster recovery risk — no point-in-time restore is possible after data loss

Answer

Without snapshots, there is no mechanism to restore data following accidental deletion, hardware failure, or ransomware.

ElasticSearch Practice Test