EX294 Manage automation security and operations — 10 Questions

Question 1

A managed node is not responding to Ansible automation. The administrator verifies that the node is reachable via SSH and that the SSH key is correctly deployed. However, 'ansible all -m ping' fails with 'UNREACHABLE'. The automation controller uses a custom execution environment. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The SSH private key has incorrect permissions on the controller.. The SSH private key must have permissions set to 600 (owner read/write only) for SSH to accept it. Even though the key is correctly deployed on the controller host, the custom execution environment (container) may have different file permissions, or the key might be copied with incorrect permissions. SSH will refuse to use a key with overly permissive settings, resulting in an 'UNREACHABLE' status despite the host being network-reachable.

Answer

The remote user specified in the credential does not have sudo access.

Answer

The custom execution environment is missing the 'python3' or 'python' package.

Answer

The automation controller is behind a firewall that blocks SSH.

Question 2

An Ansible automation controller job template uses a custom credential type that requires a secret token. The token is stored as an extra variable in the job template definition. A security audit reveals the token is visible in plaintext in the job output. Which action should the administrator take to secure the secret?

Accepted Answer

Define the variable in the job template's 'extra variables' field with 'no_log: true' set in the playbook for that variable.. Setting `no_log: true` on the variable in the playbook prevents Ansible from printing the value of that variable in any output, including job logs. This is the standard method to hide sensitive data like tokens when they are passed as extra variables, as it works at the task level to suppress logging of the variable's content.

Answer

Vault-encrypt the variable in the playbook and reference it with {{ vault_var }}.

Answer

Create a custom credential type that injects the token as an environment variable, and remove the extra variable from the job template.

Answer

Store the token in a file on the controller with 600 permissions and use 'lookup' in the playbook.

Question 3

A Red Hat Ansible Automation Platform deployment uses automation mesh to manage remote nodes across a high-latency WAN. An administrator notices that some job runs fail intermittently due to connection timeouts. The administrator wants to improve reliability without changing network infrastructure. Which configuration change is most effective?

Accepted Answer

Increase the 'timeout' value in the [defaults] section of ansible.cfg to 60 seconds.. Increasing the 'timeout' value in the [defaults] section of ansible.cfg extends the SSH connection timeout, which directly addresses intermittent failures caused by high-latency WAN links. This change allows Ansible to wait longer for a remote node to respond before aborting the connection, improving reliability without altering network infrastructure.

Answer

Increase the 'retries' parameter for each task.

Answer

Increase the 'forks' value in ansible.cfg to 50.

Answer

Set 'async: 600' and 'poll: 10' in the playbook.

Question 4

An organization requires that all Ansible playbooks be executed using a specific service account that has limited permissions. The account can only run playbooks from a specific directory. Which approach best enforces this requirement in automation controller?

Accepted Answer

Create a project that syncs only the authorized directory, and assign the service account as the only user with execute permissions on that project.. Automation Controller (formerly Ansible Tower) uses Projects to manage playbook source code. By creating a Project that syncs only the authorized directory and assigning the service account as the only user with execute permissions on that Project, you restrict the service account to running playbooks exclusively from that directory. This enforces the requirement at the platform level, leveraging role-based access control (RBAC) within the controller.

Answer

Use an inventory that contains only the allowed hosts.

Answer

Configure an execution environment that mounts the authorized directory as read-only.

Answer

Assign the service account a machine credential that connects to the controller via SSH.

Question 5

An Ansible playbook uses 'become: yes' to install packages. The playbook works when run manually by the administrator but fails when run from automation controller with 'Missing sudo password'. The administrator has configured a machine credential with the SSH key and the 'Become password' field is blank. What is the most likely issue?

Accepted Answer

The machine credential does not include the become password.. The playbook uses 'become: yes' to escalate privileges, which requires a become password when the remote user's sudo configuration demands password authentication. Since the machine credential's 'Become password' field is blank, Automation Controller cannot supply the password during the privilege escalation step, causing the 'Missing sudo password' error. The administrator's manual run succeeds because the SSH session can prompt interactively for the password, but Automation Controller's non-interactive execution requires the password to be pre-configured in the credential.

Answer

The become method is set to 'su' instead of 'sudo'.

Answer

The remote user is not in the sudoers file.

Answer

The SSH private key is not loaded into the automation controller.

Question 6

An automation controller administrator must ensure that a playbook's output does not expose sensitive data. Which TWO actions should be taken? (Choose exactly two.)

Accepted Answer

Set 'no_log: true' on tasks that handle sensitive data.. Only Option A is valid. Setting 'no_log: true' on sensitive tasks prevents Ansible from printing task arguments and output to the console or log files, ensuring that sensitive information like passwords or API keys are not exposed. Option D references 'display_args_to_stdout = false', which is not a valid Ansible configuration option and does not exist. Therefore, only one action is correct.

Answer

Set 'stdout_callback = actionable' in ansible.cfg.

Answer

Use 'name: "Sensitive task"' but keep the task body visible.

Answer

Add 'display_args_to_stdout = false' to the execution environment's ansible.cfg.

Answer

Use 'tags: never' on sensitive tasks.

Question 7

An organization has multiple automation controller clusters spread across different geographic regions. The security policy requires that job artifacts (such as logs and assets) must remain in the region where the job ran. Which THREE configurations support this requirement? (Choose exactly three.)

Accepted Answer

Disable the 'Enable remote logging' option in the controller configuration for each cluster.. Disabling 'Enable remote logging' in the controller configuration ensures that job artifacts (logs, assets) are stored locally on the controller's filesystem rather than being forwarded to an external logging server. This directly enforces the regional data residency requirement by preventing artifacts from leaving the geographic region where the controller cluster resides.

Answer

Use a custom execution environment that writes artifacts to a network share.

Answer

Configure automation mesh to route jobs to the nearest execution node.

Question 8

You are managing an Ansible Automation Platform deployment that uses automation mesh with one control node and two execution nodes. The control node is in the DMZ, and the execution nodes are in a private network. The organization's security policy requires that all secrets (e.g., SSH keys, API tokens) be encrypted at rest and never transmitted in plaintext. You have configured vault-encrypted credentials and set the vault password as a credential on the control node. However, a recent audit reveals that when a job runs, the vault password is visible in the job output on the execution nodes. The execution nodes are configured to stream job events back to the control node. The automation controller version is 4.3. The following settings are in place: 'no_log' is not set for any variables; the vault password is stored as a 'Vault password' credential type. The job template uses a custom credential type that injects the vault password as an environment variable. The execution nodes have access to the vault password via that environment variable. The audit shows the environment variable is printed in the job output because the playbook uses the 'env' module to display environment variables for debugging. You must prevent the vault password from appearing in any job output without breaking the ability to decrypt vault-encrypted variables. Which action should you take?

Accepted Answer

Edit the custom credential type's input injection to set 'no_log: true' for the environment variable that carries the vault password.. Setting `no_log: true` on the environment variable injection in the custom credential type prevents Ansible from logging the value of that variable in job output, while still allowing the vault password to be used by the playbook to decrypt vault-encrypted variables. This directly addresses the audit finding without removing debugging capabilities or changing the credential type.

Answer

Remove the 'env' task from the playbook and ensure no other tasks print environment variables.

Answer

Configure the automation controller's 'Settings' to enable 'Display secrets' = false.

Answer

Change the custom credential type to use the built-in 'Vault password' credential type and remove the custom credential type.

Question 9

A managed node is configured with an Ansible vault-encrypted variable file. When running a playbook that uses these variables, the user receives a 'decryption failed' error. Which two steps should the user take to resolve the issue?

Accepted Answer

Ensure the vault ID matches the one used when encrypting the file.. Ansible vault supports multiple vault IDs (labels) to manage different passwords for different encrypted files. If the vault ID used during decryption does not match the one used when encrypting the file, Ansible will fail to decrypt it, even if the correct password is provided. The `--vault-id` option or `ANSIBLE_VAULT_ID_MATCH` environment variable must align the ID with the encryption context.

Answer

Verify the file permissions are set to 600.

Answer

Check that the SSH private key has access to the managed node.

Answer

Make sure the vault password file contains the path to the vault file.

Question 10

Your team manages a fleet of 200 Red Hat Enterprise Linux 8 servers. Security policy requires that all servers have a specific set of security configurations: (1) SELinux must be enforcing, (2) the firewall must allow only SSH and HTTPS, (3) SSH root login must be disabled, and (4) the 'auditd' service must be running and enabled. You have created an Ansible role 'security-hardening' that applies these settings. The role is idempotent and uses the 'lineinfile' module to modify /etc/ssh/sshd_config, the 'firewalld' module to configure firewall rules, the 'selinux' module to set SELinux to enforcing, and the 'service' module to enable and start auditd. You run the playbook against a test group of 10 servers, and it reports 'changed=0' for all tasks, indicating the servers are already compliant. However, a subsequent manual audit reveals that on two servers, SELinux is permissive and SSH root login is still permitted. What is the most likely cause of this discrepancy?

Accepted Answer

The inventory hostnames for those two servers are incorrect, causing Ansible to connect to different hosts that are already compliant.. If the inventory hostnames for the two non-compliant servers are incorrect, Ansible would connect to different hosts that are already compliant, resulting in 'changed=0' for all tasks. The playbook never actually ran against the intended servers, so the manual audit correctly found them non-compliant. This is a common inventory misconfiguration issue where the target hostname does not match the actual server.

Answer

The 'become' privilege escalation is not configured, so the tasks cannot modify system files.

Answer

The playbook was run with the '--check' flag, which simulates changes without applying them.

Answer

The Ansible modules used in the role are not installed on the control node.