PCA PCA Security & Authentication

Question 1

What is the recommended way to add TLS encryption to Prometheus scrape endpoints?

Accepted Answer

Configure tls_config in the scrape job or use a reverse proxy with TLS termination

Answer

Prometheus supports tls_config in scrape_configs to present or verify TLS certificates, or you can terminate TLS at a reverse proxy.

Question 2

Which Prometheus configuration option allows scraping a target that uses a self-signed TLS certificate without verification?

Accepted Answer

insecure_skip_verify: true

Answer

Setting insecure_skip_verify: true in tls_config disables certificate validation, which is useful for self-signed certs but reduces security.

Question 3

What is the purpose of the `authorization` section in a Prometheus scrape_config?

Accepted Answer

It configures bearer token or custom header authentication for scraping a target

Answer

The authorization block lets Prometheus send a bearer token or other credentials when scraping targets that require authentication.

Question 4

How can Prometheus scrape targets that require HTTP Basic Authentication?

Accepted Answer

By specifying basic_auth with username and password in the scrape_config

Answer

The basic_auth block in scrape_configs allows Prometheus to send HTTP Basic Authentication headers to protected targets.

Question 5

What does the `--web.config.file` flag enable in Prometheus?

Accepted Answer

TLS and basic authentication for the Prometheus HTTP server itself

Answer

The --web.config.file flag loads a YAML file that configures TLS and HTTP Basic Auth for the Prometheus server's own API and UI.

(PCA) Prometheus Certified Associate Practice Test