PCA PCA Security & Authentication 1 — Questions and Answers
Question 1: What is the recommended way to add TLS encryption to Prometheus scrape endpoints?
- Configure tls_config in the scrape job or use a reverse proxy with TLS termination (Correct answer)
- Enable the --tls flag on the Prometheus binary
- Use IPtables to encrypt TSDB traffic
- Configure TLS via recording_rules
Correct answer: Configure tls_config in the scrape job or use a reverse proxy with TLS termination
Prometheus supports tls_config in scrape_configs to present or verify TLS certificates, or you can terminate TLS at a reverse proxy.
Question 2: Which Prometheus configuration option allows scraping a target that uses a self-signed TLS certificate without verification?
- insecure_skip_verify: true (Correct answer)
- tls_verify: false
- skip_tls: true
- no_tls_check: true
Correct answer: insecure_skip_verify: true
Setting insecure_skip_verify: true in tls_config disables certificate validation, which is useful for self-signed certs but reduces security.
Question 3: What is the purpose of the `authorization` section in a Prometheus scrape_config?
- It configures bearer token or custom header authentication for scraping a target (Correct answer)
- It defines which users can access the Prometheus UI
- It controls which IP ranges can reach the Prometheus API
- It sets the OAuth2 provider for the Prometheus server itself
Correct answer: It configures bearer token or custom header authentication for scraping a target
The authorization block lets Prometheus send a bearer token or other credentials when scraping targets that require authentication.
Question 4: How can Prometheus scrape targets that require HTTP Basic Authentication?
- By specifying basic_auth with username and password in the scrape_config (Correct answer)
- By setting AUTH_USER and AUTH_PASS environment variables
- By encoding credentials in the target URL
- By using a pre-shared key in tls_config
Correct answer: By specifying basic_auth with username and password in the scrape_config
The basic_auth block in scrape_configs allows Prometheus to send HTTP Basic Authentication headers to protected targets.
Question 5: What does the `--web.config.file` flag enable in Prometheus?
- TLS and basic authentication for the Prometheus HTTP server itself (Correct answer)
- Loading scrape configs from a remote web URL
- Configuring web proxy settings for scraping
- Enabling the experimental web UI features
Correct answer: TLS and basic authentication for the Prometheus HTTP server itself
The --web.config.file flag loads a YAML file that configures TLS and HTTP Basic Auth for the Prometheus server's own API and UI.
Question 6: Why is it a best practice to store Prometheus authentication credentials in separate secret files rather than inline in prometheus.yml?
- Secret files can be mounted from Kubernetes Secrets or Vault, reducing the risk of credentials in version control (Correct answer)
- Prometheus only reads credentials from files, not inline YAML
- Inline credentials are encrypted but file-based are not
- Secret files allow hot-reloading without a Prometheus restart
Correct answer: Secret files can be mounted from Kubernetes Secrets or Vault, reducing the risk of credentials in version control
Storing credentials in secret files allows them to be managed by secret managers and keeps sensitive data out of version-controlled config files.
PCA PCA Security & Authentication 1
What is the recommended way to add TLS encryption to Prometheus scrape endpoints?