Describe Security Considerations with Hadoop and the Cloud DATA-ENGINEERING-OPTIMIZE Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A financial services company runs a Hadoop cluster on-premises. They must ensure that data written to a specific HDFS directory is encrypted at rest, and that only authorized users can read it. They also need to track who accesses the data for compliance. Which combination of Hadoop security features should they implement?

   • AConfigure Kerberos authentication for all users and rely on OS-level file permissions for the directory.
   • BEncrypt the entire HDFS filesystem with a single key and use HDFS snapshots for auditing.
   • CUse HDFS permissions to restrict access to the directory and enable HDFS trash to retain deleted files.
   • DEnable HDFS transparent encryption with an encryption zone for the directory, and use Apache Ranger policies to grant read access and audit access attempts.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company needs to encrypt data in transit between their on-premises application and a cloud Hadoop cluster. They also want to ensure that the data is encrypted at rest in HDFS. Which configuration should they use?

   • AUse TLS for all client connections to the cluster and enable HDFS encryption zones for the target directories.
   • BUse a VPN for the connection and rely on the cloud provider's default storage encryption.
   • CEnable HDFS encryption zones and use Kerberos for authentication.
   • DUse SSL for the web UI and configure HDFS permissions to restrict access.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company runs a Hadoop cluster on cloud VMs. They want to allow a data science team to access the cluster from their laptops without managing long-term credentials. They also want to restrict the team's access to only the data they need. Which approach should they use?

   • AUse SSH keys for each team member and configure HDFS permissions based on the keys.
   • BSet up a VPN and allow all team members to access the cluster without additional authentication.
   • CCreate IAM roles for the data science team and configure the Hadoop cluster to use those roles for authentication and authorization.
   • DCreate a shared service account and distribute the credentials to the team.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A healthcare company must store patient data in a cloud Hadoop cluster. The data is subject to HIPAA, which requires encryption of data at rest and in transit, and audit logs of all access. The company also wants to ensure that only authorized personnel can access the data. Which approach should they take?

   • AUse HDFS permissions to restrict access and rely on the cloud provider's default encryption.
   • BEnable HDFS encryption zones, use TLS for all data transfers, configure Apache Ranger policies for access control, and enable audit logging.
   • CUse Kerberos for authentication and network security groups to restrict access.
   • DEncrypt data at rest using cloud KMS and use a VPN for all data transfers.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security team needs to detect unauthorized access to a Hadoop cluster. They want to monitor all access attempts and receive alerts for suspicious activity. Which combination of tools should they use?

   • AUse network security groups to block suspicious IP addresses and rely on those logs.
   • BUse HDFS permissions to restrict access and rely on the cloud provider's monitoring service.
   • CEnable Kerberos authentication and review the Kerberos logs manually.
   • DEnable audit logging in Apache Ranger and integrate the logs with a SIEM system that triggers alerts on suspicious patterns.
   Reveal Solution Discussion Select an answer first