Jenkins Security Flashcards

Where is Jenkins security configuration managed?

Answer: Manage Jenkins > Configure Global Security

The Configure Global Security page is where you enable security, set the security realm, and configure authorization strategy.

Which security realm allows Jenkins to use its own user database for authentication?

Answer: Jenkins' own user database

The 'Jenkins' own user database' realm stores users in Jenkins' internal database, managed via the Manage Users page.

What is the Matrix-based security authorization strategy in Jenkins?

Answer: A permission model that assigns specific permissions to individual users or groups in a table

Matrix-based security presents a permission grid where admins can grant specific permissions (like build, configure, view) to each user or group.

What does enabling 'Prevent Cross Site Request Forgery exploits' do in Jenkins?

Answer: Adds a CSRF protection token (crumb) required on all state-changing HTTP requests

CSRF protection in Jenkins requires a 'crumb' token with every mutating HTTP request, preventing cross-site request forgery attacks.

Which Jenkins credential type is used to store a username and password pair?

Answer: Username with password

The 'Username with password' credential type stores a username/password pair and can be bound in pipelines using `withCredentials`.

What is the scope difference between 'Global' and 'System' credentials in Jenkins?

Answer: Global credentials are accessible from any job; System credentials are only accessible to Jenkins internals and plugins

System-scoped credentials are only available to Jenkins core and plugins (e.g., for agent connections), while Global credentials are accessible to jobs and pipelines.