Free CJE Security & Access Control Questions and Answers — Questions and Answers

Question 1: Which Jenkins feature controls who can access specific resources?

Pipeline syntax
Role-Based Access Control (Correct answer)
Plugin Manager
SCM polling

Correct answer: Role-Based Access Control

Role-Based Access Control (RBAC) is a crucial security feature in Jenkins that allows administrators to define granular permissions for users and groups based on their assigned roles. This enables precise control over who can access, configure, or execute specific jobs, views, or system settings, ensuring secure and compliant operations within Jenkins.

Question 2: How can Jenkins secure credentials used in jobs?

Plain text files.
Using the Credentials plugin and encrypted storage. (Correct answer)
Environment variables only.
No security for credentials.

Correct answer: Using the Credentials plugin and encrypted storage.

Jenkins secures sensitive information like passwords, API tokens, and SSH keys using the Credentials plugin, which stores them in an encrypted format. This prevents credentials from being exposed in plain text within job configurations or logs. Jobs can then reference these credentials securely without directly embedding them, enhancing overall security.

Question 3: What is the purpose of the 'Matrix-based security' in Jenkins?

To manage plugins.
To assign permissions to users/groups. (Correct answer)
To configure pipelines.
To set environment variables.

Correct answer: To assign permissions to users/groups.

Matrix-based security in Jenkins is a flexible authorization strategy that allows administrators to define specific permissions for individual users and groups across various Jenkins resources. It presents a grid-like interface where permissions (e.g., read, write, build) can be granted or revoked for different entities, providing fine-grained access control.

Question 4: Which protocol can Jenkins use to encrypt web traffic?

FTP
HTTP
HTTPS (Correct answer)
Telnet

Correct answer: HTTPS

Jenkins can use HTTPS (Hypertext Transfer Protocol Secure) to encrypt web traffic between the client browser and the Jenkins server. Implementing HTTPS is crucial for securing sensitive data transmitted over the network, such as login credentials, build logs, and configuration details. This protects against eavesdropping, tampering, and man-in-the-middle attacks, ensuring secure communication.

Question 5: How can you restrict job execution to authorized users?

Using Role-Based Access Control. (Correct answer)
Allowing anonymous access.
Disabling plugins.
Changing pipeline scripts.

Correct answer: Using Role-Based Access Control.

Role-Based Access Control (RBAC) is a security mechanism that assigns permissions to users based on their roles within the system. In Jenkins, implementing RBAC allows administrators to define specific roles with granular permissions, such as the ability to build or configure jobs. This ensures that only authorized individuals can perform specific actions, thereby effectively restricting job execution.

Question 6: What is CSRF protection in Jenkins?

Security against brute force attacks.
Prevents unauthorized command execution. (Correct answer)
Encrypts data at rest.
Monitors network traffic.

Correct answer: Prevents unauthorized command execution.

CSRF (Cross-Site Request Forgery) protection in Jenkins is a crucial security measure designed to prevent malicious websites or scripts from tricking a logged-in user's browser into sending unauthorized requests to the Jenkins server. It safeguards against attackers exploiting a user's authenticated session to execute commands or make changes without their explicit consent. This helps maintain the integrity and security of the Jenkins instance.

Question 7: Which plugin provides enhanced security and access control in Jenkins?

Role Strategy Plugin (Correct answer)
Pipeline plugin
Git plugin
Mailer plugin

Correct answer: Role Strategy Plugin

The Role Strategy Plugin is widely used in Jenkins to implement fine-grained access control and enhance security. it allows administrators to define global roles, item roles (for specific jobs), and agent roles, assigning different permissions to users or groups based on these roles. This provides a robust mechanism for managing who can access and modify various parts of the Jenkins environment.

Question 8: How do you enforce strong authentication in Jenkins?

Use built-in Jenkins user database only.
Integrate with LDAP or SSO. (Correct answer)
Disable security.
Use guest accounts.

Correct answer: Integrate with LDAP or SSO.

Integrating Jenkins with external authentication systems like LDAP (Lightweight Directory Access Protocol) or SSO (Single Sign-On) providers is the most effective way to enforce strong authentication. This allows Jenkins to leverage existing enterprise user directories and security policies, centralizing user management and often enabling features like multi-factor authentication. It enhances security by avoiding reliance solely on Jenkins's internal user database.

Question 9: What is the function of API tokens in Jenkins?

Allow anonymous API access.
Authenticate users for API access. (Correct answer)
Encrypt pipeline scripts.
Provide database access.

Correct answer: Authenticate users for API access.

API tokens in Jenkins serve as a secure alternative to user passwords for authenticating programmatic access to the Jenkins API. They allow external tools, scripts, or integrations to interact with Jenkins without exposing user credentials directly. Each token is associated with a specific user and inherits their permissions, ensuring secure and controlled automation.

Free CJE Security & Access Control Questions and Answers

Which Jenkins feature controls who can access specific resources?