ElasticSearch Risk Assessment & Management 5

Question 1

Which Elasticsearch configuration change reduces the risk of cluster-wide disruption when a single node runs out of disk space?

Accepted Answer

Setting cluster.routing.allocation.disk.watermark.low and high thresholds

Answer

Disk watermark thresholds trigger shard relocation before a node reaches full capacity, preventing allocation failures and index lockout.

Question 2

A penetration tester discovers that Elasticsearch's REST API responds to unauthenticated DELETE requests on /_all. What is the severity of this finding?

Accepted Answer

Critical — all indices and their data can be permanently deleted in a single request

Answer

An unauthenticated DELETE /_all wipes every index in the cluster instantly, representing a critical data destruction vulnerability.

Question 3

Which risk does enabling Elasticsearch's 'allow_unsafe_bootstrapping' flag introduce in a new cluster setup?

Accepted Answer

It bypasses quorum checks, allowing a single node to form a cluster independently, which can cause data divergence if other nodes rejoin

Answer

Unsafe bootstrapping overrides consensus safety guarantees; if used carelessly, it can create a split-brain condition when the rest of the cluster is rejoined.

Question 4

What Elasticsearch security risk is introduced by running Kibana with an elasticsearch.username that has cluster:admin privileges?

Accepted Answer

A Kibana exploit or misconfiguration can be leveraged to perform cluster-wide admin actions

Answer

Kibana's service account should use least-privilege credentials; over-privileged service accounts expand the impact of any Kibana-level compromise.

Question 5

Which Elasticsearch index setting, if left at its default, increases the risk of excessive memory use during large sort operations?

Accepted Answer

indices.fielddata.cache.size defaulting to unbounded

Answer

Without an explicit fielddata cache size limit, sort and aggregation operations can fill available heap and trigger JVM garbage collection pressure or OOM errors.

ElasticSearch Practice Test

ElasticSearch Practice Test

ElasticSearch Risk Assessment & Management 5