Jenkins Jenkins Security 2 — Questions and Answers
Question 1: What is the Jenkins API token used for?
- Generating build artifacts
- Authenticating API or CLI calls without using the user's password (Correct answer)
- Encrypting pipeline secrets
- Accessing the Jenkins plugin repository
Correct answer: Authenticating API or CLI calls without using the user's password
Jenkins API tokens allow users and scripts to authenticate to the Jenkins API or CLI without exposing the actual user password.
Question 2: Which LDAP setting in Jenkins specifies the attribute used to find the user's username in the directory?
- User search filter
- User ID attribute (Correct answer)
- Group membership attribute
- Display name attribute
Correct answer: User ID attribute
The User ID attribute specifies which LDAP attribute (e.g., `uid` or `sAMAccountName`) maps to the Jenkins username.
Question 3: What is Script Security in Jenkins and what does it protect?
- It is a firewall that blocks external script execution
- It sandboxes Groovy scripts in pipelines and approves safe operations to prevent malicious code execution (Correct answer)
- It encrypts all Groovy pipeline scripts at rest
- It prevents unauthorized plugin installations
Correct answer: It sandboxes Groovy scripts in pipelines and approves safe operations to prevent malicious code execution
Script Security sandboxes Groovy code in pipelines and Groovy scripts, requiring admin approval for unsafe operations to prevent code injection.
Question 4: What does marking a script as 'approved' in Jenkins Script Security mean?
- The script is deployed to production
- An admin has reviewed and whitelisted specific Groovy methods or the entire script to run without sandbox restrictions (Correct answer)
- The script is encrypted
- The script bypasses all security checks
Correct answer: An admin has reviewed and whitelisted specific Groovy methods or the entire script to run without sandbox restrictions
When an admin approves a script or method in the Script Security plugin, it is whitelisted to run outside the Groovy sandbox.
Question 5: What is the purpose of Agent-to-Controller Security in Jenkins?
- Encrypts data transferred between agents and the controller
- Restricts what commands agents can send to the controller to prevent a compromised agent from attacking the controller (Correct answer)
- Authenticates agents using SSL certificates
- Limits which jobs agents can execute
Correct answer: Restricts what commands agents can send to the controller to prevent a compromised agent from attacking the controller
Agent-to-Controller Security restricts the commands agents can request of the controller, limiting the blast radius if an agent node is compromised.
Question 6: Which Jenkins feature allows auditing who changed a job's configuration and when?
- Build History
- Job Configuration History Plugin
- Audit Trail Plugin (Correct answer)
- Change Log
Correct answer: Audit Trail Plugin
The Audit Trail Plugin logs user actions in Jenkins including job configuration changes, builds triggered, and who performed them.
Jenkins Jenkins Security 2
What is the Jenkins API token used for?