PCA PCA Security & Authentication 2 — Questions and Answers
Question 1: What OAuth2 configuration capability does Prometheus support natively in scrape_configs?
- Client credentials flow to obtain a bearer token before scraping (Correct answer)
- Authorization code flow for user-facing authentication
- PKCE-secured token exchange for dashboards
- SAML-based federated identity for scrape targets
Correct answer: Client credentials flow to obtain a bearer token before scraping
Prometheus's oauth2 block supports the client credentials grant, allowing it to fetch access tokens to authenticate against protected scrape endpoints.
Question 2: Which Prometheus web configuration file field specifies the path to the server's TLS certificate?
- cert_file (Correct answer)
- tls_cert
- server_certificate
- ssl_cert_path
Correct answer: cert_file
The cert_file field in the web configuration YAML points to the PEM-encoded TLS certificate file for the Prometheus server.
Question 3: What is the risk of running Prometheus without any authentication on its HTTP API in a shared network environment?
- Any user with network access can read all metrics, modify configurations, or trigger administrative actions (Correct answer)
- Prometheus will refuse to start without authentication configured
- Unauthenticated access only exposes the /metrics endpoint, not the API
- Without auth, Prometheus automatically rate-limits API calls
Correct answer: Any user with network access can read all metrics, modify configurations, or trigger administrative actions
Without authentication, the Prometheus HTTP API is fully open, exposing potentially sensitive metrics and admin endpoints to anyone on the network.
Question 4: Which mutual TLS (mTLS) configuration field in Prometheus scrape_config specifies the client certificate to present to the target?
- cert_file under tls_config (Correct answer)
- client_cert in authorization block
- mtls_cert in basic_auth
- identity_cert in oauth2 block
Correct answer: cert_file under tls_config
In tls_config, cert_file specifies the client certificate Prometheus presents during mutual TLS handshakes with scrape targets.
Question 5: What is the purpose of `ca_file` in a Prometheus tls_config block?
- It specifies the CA certificate used to verify the target's TLS certificate (Correct answer)
- It lists the cipher algorithms allowed during scraping
- It defines the certificate authority for Prometheus's own HTTPS server
- It names the Kubernetes secret containing TLS credentials
Correct answer: It specifies the CA certificate used to verify the target's TLS certificate
ca_file provides the CA bundle that Prometheus uses to validate the server certificate presented by scrape targets.
Question 6: In Prometheus web configuration, what does the `http2` field control?
- Whether Prometheus serves its own API over HTTP/2 (Correct answer)
- Whether scrape targets must support HTTP/2
- The maximum number of concurrent HTTP/2 streams for remote_write
- Enabling HTTP/2 push for dashboard assets
Correct answer: Whether Prometheus serves its own API over HTTP/2
The http2 field in web config enables or disables HTTP/2 support on the Prometheus server's own HTTP listener.
PCA PCA Security & Authentication 2
What OAuth2 configuration capability does Prometheus support natively in scrape_configs?