Encryption in transit and at rest in Elasticsearch - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of the Elasticsearch TLS configuration snippet?

Given the following Elasticsearch configuration snippet for enabling TLS encryption in transit, what will be the effect when Elasticsearch nodes start?

Elasticsearch

xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: certs/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: certs/elastic-certificates.p12

A Elasticsearch nodes will fail to start due to missing password for keystore.

B Elasticsearch nodes will communicate without encryption because verification_mode is set to certificate.

C Elasticsearch nodes will communicate over encrypted transport using TLS with certificate verification.

D Elasticsearch nodes will communicate over unencrypted HTTP transport.

💡 Hint

Look at the 'xpack.security.transport.ssl.enabled' and 'verification_mode' settings.

Setting 'xpack.security.transport.ssl.enabled' to true enables TLS encryption for transport layer. The 'verification_mode: certificate' means nodes verify certificates but do not require hostname verification, so communication is encrypted and verified.

❓ Predict Output

intermediate

What happens if you enable encryption at rest without setting a keystore password?

Consider this Elasticsearch configuration snippet for encryption at rest: xpack.security.enabled: true xpack.security.encryptionKey: "myencryptionkey123" xpack.security.audit.enabled: true What will happen when Elasticsearch tries to encrypt data at rest?

A Elasticsearch will fail to start due to missing keystore password for encryption key.

B Elasticsearch will store data unencrypted because encryptionKey is not a valid setting.

C Elasticsearch will encrypt data but audit logs will be disabled.

D Elasticsearch will encrypt data at rest using the provided encryption key without errors.

💡 Hint

Check if 'xpack.security.encryptionKey' is sufficient for encryption at rest.

The 'xpack.security.encryptionKey' setting provides the key for encrypting sensitive data at rest. No keystore password is required here, so encryption proceeds successfully.

🔧 Debug

advanced

Identify the error in this Elasticsearch TLS transport configuration

This snippet is intended to enable TLS encryption for Elasticsearch transport layer. What error will occur when Elasticsearch starts?

Elasticsearch

xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.keystore.path: certs/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: certs/elastic-certificates.p12
xpack.security.transport.ssl.verification_mode: none

A Elasticsearch will start successfully but without verifying certificates, risking MITM attacks.

B Elasticsearch will fail to start due to invalid 'verification_mode' value 'none'.

C Elasticsearch will fail to start because keystore and truststore paths are missing passwords.

D Elasticsearch will start but transport encryption will be disabled.

💡 Hint

Check the allowed values for 'verification_mode'.

'none' is a valid value for 'verification_mode' which disables certificate verification but still encrypts transport. This is insecure but does not cause startup failure.

📝 Syntax

advanced

Which option correctly enables HTTPS for Elasticsearch HTTP layer?

Select the correct configuration snippet to enable HTTPS encryption for the HTTP layer in Elasticsearch.

A

xpack.security.http.ssl.enabled: false
xpack.security.http.ssl.keystore.path: certs/http.p12
xpack.security.http.ssl.keystore.password: "password"

B

xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.keystore.path: certs/http.p12
xpack.security.http.ssl.keystore.password: "password"

C

xpack.security.http.ssl.enabled: true
xpack.security.transport.ssl.keystore.path: certs/http.p12
xpack.security.http.ssl.keystore.password: "password"

D

xpack.security.transport.ssl.enabled: true
xpack.security.http.ssl.keystore.path: certs/http.p12
xpack.security.http.ssl.keystore.password: "password"

💡 Hint

Focus on the correct prefix for HTTP SSL settings.

To enable HTTPS on the HTTP layer, 'xpack.security.http.ssl.enabled' must be true and keystore path and password must be set under the HTTP SSL namespace.

🚀 Application

expert

How many nodes will successfully join the cluster with this transport encryption config?

You have a 3-node Elasticsearch cluster. Each node has the following transport encryption settings: Node 1: xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: certificate xpack.security.transport.ssl.keystore.path: certs/node1.p12 xpack.security.transport.ssl.truststore.path: certs/ca.p12 Node 2: xpack.security.transport.ssl.enabled: true xpack.security.transport.ssl.verification_mode: full xpack.security.transport.ssl.keystore.path: certs/node2.p12 xpack.security.transport.ssl.truststore.path: certs/ca.p12 Node 3: xpack.security.transport.ssl.enabled: false How many nodes will successfully join the cluster?

A 2 nodes will join; Node 3 will fail due to disabled transport encryption.

B All 3 nodes will join successfully despite Node 3's disabled encryption.

C Only Node 1 will join; Node 2 fails due to stricter verification_mode, Node 3 fails due to disabled encryption.

D No nodes will join because of mismatched verification_mode settings.

💡 Hint

Consider how transport encryption and verification_mode affect node communication.

Nodes 1 and 2 have transport encryption enabled and trust the CA, so they can communicate. Node 3 has transport encryption disabled, so it cannot join the encrypted cluster.