Jenkins Jenkins Security 2

Question 1

What is the Jenkins API token used for?

Accepted Answer

Authenticating API or CLI calls without using the user's password

Answer

Jenkins API tokens allow users and scripts to authenticate to the Jenkins API or CLI without exposing the actual user password.

Question 2

Which LDAP setting in Jenkins specifies the attribute used to find the user's username in the directory?

Accepted Answer

User ID attribute

Answer

The User ID attribute specifies which LDAP attribute (e.g., `uid` or `sAMAccountName`) maps to the Jenkins username.

Question 3

What is Script Security in Jenkins and what does it protect?

Accepted Answer

It sandboxes Groovy scripts in pipelines and approves safe operations to prevent malicious code execution

Answer

Script Security sandboxes Groovy code in pipelines and Groovy scripts, requiring admin approval for unsafe operations to prevent code injection.

Question 4

What does marking a script as 'approved' in Jenkins Script Security mean?

Accepted Answer

An admin has reviewed and whitelisted specific Groovy methods or the entire script to run without sandbox restrictions

Answer

When an admin approves a script or method in the Script Security plugin, it is whitelisted to run outside the Groovy sandbox.

Question 5

What is the purpose of Agent-to-Controller Security in Jenkins?

Accepted Answer

Restricts what commands agents can send to the controller to prevent a compromised agent from attacking the controller

Answer

Agent-to-Controller Security restricts the commands agents can request of the controller, limiting the blast radius if an agent node is compromised.

Jenkins Practice Test