PCA PCA Security & Authentication 2

Question 1

What OAuth2 configuration capability does Prometheus support natively in scrape_configs?

Accepted Answer

Client credentials flow to obtain a bearer token before scraping

Answer

Prometheus's oauth2 block supports the client credentials grant, allowing it to fetch access tokens to authenticate against protected scrape endpoints.

Question 2

Which Prometheus web configuration file field specifies the path to the server's TLS certificate?

Accepted Answer

cert_file

Answer

The cert_file field in the web configuration YAML points to the PEM-encoded TLS certificate file for the Prometheus server.

Question 3

What is the risk of running Prometheus without any authentication on its HTTP API in a shared network environment?

Accepted Answer

Any user with network access can read all metrics, modify configurations, or trigger administrative actions

Answer

Without authentication, the Prometheus HTTP API is fully open, exposing potentially sensitive metrics and admin endpoints to anyone on the network.

Question 4

Which mutual TLS (mTLS) configuration field in Prometheus scrape_config specifies the client certificate to present to the target?

Accepted Answer

cert_file under tls_config

Answer

In tls_config, cert_file specifies the client certificate Prometheus presents during mutual TLS handshakes with scrape targets.

Question 5

What is the purpose of `ca_file` in a Prometheus tls_config block?

Accepted Answer

It specifies the CA certificate used to verify the target's TLS certificate

Answer

ca_file provides the CA bundle that Prometheus uses to validate the server certificate presented by scrape targets.

(PCA) Prometheus Certified Associate Practice Test

(PCA) Prometheus Certified Associate Practice Test

PCA PCA Security & Authentication 2