PCA PCA Security & Authentication

Question 1

What is the recommended way to add TLS encryption to Prometheus scrape endpoints?

Accepted Answer

Configure tls_config in the scrape job or use a reverse proxy with TLS termination

Answer

Enable the --tls flag on the Prometheus binary

Answer

Use IPtables to encrypt TSDB traffic

Answer

Configure TLS via recording_rules

Question 2

Which Prometheus configuration option allows scraping a target that uses a self-signed TLS certificate without verification?

Accepted Answer

insecure_skip_verify: true

Answer

tls_verify: false

Answer

skip_tls: true

Answer

no_tls_check: true

Question 3

What is the purpose of the `authorization` section in a Prometheus scrape_config?

Accepted Answer

It configures bearer token or custom header authentication for scraping a target

Answer

It defines which users can access the Prometheus UI

Answer

It controls which IP ranges can reach the Prometheus API

Answer

It sets the OAuth2 provider for the Prometheus server itself

Question 4

How can Prometheus scrape targets that require HTTP Basic Authentication?

Accepted Answer

By specifying basic_auth with username and password in the scrape_config

Answer

By setting AUTH_USER and AUTH_PASS environment variables

Answer

By encoding credentials in the target URL

Answer

By using a pre-shared key in tls_config

Question 5

What does the `--web.config.file` flag enable in Prometheus?

Accepted Answer

TLS and basic authentication for the Prometheus HTTP server itself

Answer

Loading scrape configs from a remote web URL

Answer

Configuring web proxy settings for scraping

Answer

Enabling the experimental web UI features

Question 6

Why is it a best practice to store Prometheus authentication credentials in separate secret files rather than inline in prometheus.yml?

Accepted Answer

Secret files can be mounted from Kubernetes Secrets or Vault, reducing the risk of credentials in version control

Answer

Prometheus only reads credentials from files, not inline YAML

Answer

Inline credentials are encrypted but file-based are not

Answer

Secret files allow hot-reloading without a Prometheus restart