EX294 Manage automation security and operations — 20 Questions

Question 1

An Ansible automation controller job template uses a custom credential type that requires a secret token. The token is stored as an extra variable in the job template definition. A security audit reveals the token is visible in plaintext in the job output. Which action should the administrator take to secure the secret?

Accepted Answer

Define the variable in the job template's 'extra variables' field with 'no_log: true' set in the playbook for that variable.. Option A is correct because setting `no_log: true` on the variable in the playbook prevents Ansible from printing the value of that variable in any output, including job logs. This is the standard method to hide sensitive data like tokens when they are passed as extra variables, as it works at the task level to suppress logging of the variable's content.

Answer

Vault-encrypt the variable in the playbook and reference it with {{ vault_var }}.

Answer

Create a custom credential type that injects the token as an environment variable, and remove the extra variable from the job template.

Answer

Store the token in a file on the controller with 600 permissions and use 'lookup' in the playbook.

Question 2

A Red Hat Ansible Automation Platform deployment uses automation mesh to manage remote nodes across a high-latency WAN. An administrator notices that some job runs fail intermittently due to connection timeouts. The administrator wants to improve reliability without changing network infrastructure. Which configuration change is most effective?

Accepted Answer

Increase the 'timeout' value in the [defaults] section of ansible.cfg to 60 seconds.. Option A is correct because increasing the 'timeout' value in the [defaults] section of ansible.cfg extends the SSH connection timeout, which directly addresses intermittent failures caused by high-latency WAN links. This change allows Ansible to wait longer for a remote node to respond before aborting the connection, improving reliability without altering network infrastructure.

Answer

Increase the 'retries' parameter for each task.

Answer

Increase the 'forks' value in ansible.cfg to 50.

Answer

Set 'async: 600' and 'poll: 10' in the playbook.

Question 3

An organization requires that all Ansible playbooks be executed using a specific service account that has limited permissions. The account can only run playbooks from a specific directory. Which approach best enforces this requirement in automation controller?

Accepted Answer

Create a project that syncs only the authorized directory, and assign the service account as the only user with execute permissions on that project.. Option C is correct because Automation Controller (formerly Ansible Tower) uses Projects to manage playbook source code. By creating a Project that syncs only the authorized directory and assigning the service account as the only user with execute permissions on that Project, you restrict the service account to running playbooks exclusively from that directory. This enforces the requirement at the platform level, leveraging role-based access control (RBAC) within the controller.

Answer

Use an inventory that contains only the allowed hosts.

Answer

Configure an execution environment that mounts the authorized directory as read-only.

Answer

Assign the service account a machine credential that connects to the controller via SSH.

Question 4

A managed node is not responding to Ansible automation. The administrator verifies that the node is reachable via SSH and that the SSH key is correctly deployed. However, 'ansible all -m ping' fails with 'UNREACHABLE'. The automation controller uses a custom execution environment. What is the most likely cause?

Accepted Answer

The custom execution environment is missing the 'python3' or 'python' package.. Option C is correct because the custom execution environment is a container image that must contain the Python interpreter (python3 or python) for Ansible to execute modules on the managed node. When the environment lacks Python, the 'ansible -m ping' module cannot be transferred and executed, resulting in an 'UNREACHABLE' status despite SSH connectivity being verified.

Answer

The SSH private key has incorrect permissions on the controller.

Answer

The remote user specified in the credential does not have sudo access.

Answer

The automation controller is behind a firewall that blocks SSH.

Question 5

An Ansible playbook uses 'become: yes' to install packages. The playbook works when run manually by the administrator but fails when run from automation controller with 'Missing sudo password'. The administrator has configured a machine credential with the SSH key and the 'Become password' field is blank. What is the most likely issue?

Accepted Answer

The machine credential does not include the become password.. The playbook uses 'become: yes' to escalate privileges, which requires a become password when the remote user's sudo configuration demands password authentication. Since the machine credential's 'Become password' field is blank, Automation Controller cannot supply the password during the privilege escalation step, causing the 'Missing sudo password' error. The administrator's manual run succeeds because the SSH session can prompt interactively for the password, but Automation Controller's non-interactive execution requires the password to be pre-configured in the credential.

Answer

The become method is set to 'su' instead of 'sudo'.

Answer

The remote user is not in the sudoers file.

Answer

The SSH private key is not loaded into the automation controller.

Question 6

An automation controller administrator must ensure that a playbook's output does not expose sensitive data. Which TWO actions should be taken? (Choose exactly two.)

Accepted Answer

Set 'no_log: true' on tasks that handle sensitive data.. Setting 'no_log: true' on tasks that handle sensitive data (Option A) is the correct approach because it prevents Ansible from printing task arguments and output to the console or log files, ensuring that sensitive information like passwords or API keys are not exposed. This directive is a built-in Ansible feature specifically designed for security-sensitive operations.

Answer

Set 'stdout_callback = actionable' in ansible.cfg.

Answer

Use 'name: "Sensitive task"' but keep the task body visible.

Answer

Use 'tags: never' on sensitive tasks.

Question 7

An organization has multiple automation controller clusters spread across different geographic regions. The security policy requires that job artifacts (such as logs and assets) must remain in the region where the job ran. Which THREE configurations support this requirement? (Choose exactly three.)

Accepted Answer

Disable the 'Enable remote logging' option in the controller configuration for each cluster.. Option A is correct because disabling 'Enable remote logging' in the controller configuration ensures that job artifacts (logs, assets) are stored locally on the controller's filesystem rather than being forwarded to an external logging server. This directly enforces the regional data residency requirement by preventing artifacts from leaving the geographic region where the controller cluster resides.

Answer

Use a custom execution environment that writes artifacts to a network share.

Answer

Configure automation mesh to route jobs to the nearest execution node.

Question 8

You are managing an Ansible Automation Platform deployment that uses automation mesh with one control node and two execution nodes. The control node is in the DMZ, and the execution nodes are in a private network. The organization's security policy requires that all secrets (e.g., SSH keys, API tokens) be encrypted at rest and never transmitted in plaintext. You have configured vault-encrypted credentials and set the vault password as a credential on the control node. However, a recent audit reveals that when a job runs, the vault password is visible in the job output on the execution nodes. The execution nodes are configured to stream job events back to the control node. The automation controller version is 4.3. The following settings are in place: 'no_log' is not set for any variables; the vault password is stored as a 'Vault password' credential type. The job template uses a custom credential type that injects the vault password as an environment variable. The execution nodes have access to the vault password via that environment variable. The audit shows the environment variable is printed in the job output because the playbook uses the 'env' module to display environment variables for debugging. You must prevent the vault password from appearing in any job output without breaking the ability to decrypt vault-encrypted variables. Which action should you take?

Accepted Answer

Edit the custom credential type's input injection to set 'no_log: true' for the environment variable that carries the vault password.. Option D is correct because setting `no_log: true` on the environment variable injection in the custom credential type prevents Ansible from logging the value of that variable in job output, while still allowing the vault password to be used by the playbook to decrypt vault-encrypted variables. This directly addresses the audit finding without removing debugging capabilities or changing the credential type.

Answer

Remove the 'env' task from the playbook and ensure no other tasks print environment variables.

Answer

Configure the automation controller's 'Settings' to enable 'Display secrets' = false.

Answer

Change the custom credential type to use the built-in 'Vault password' credential type and remove the custom credential type.

Question 9

A managed node is configured with an Ansible vault-encrypted variable file. When running a playbook that uses these variables, the user receives a 'decryption failed' error. Which two steps should the user take to resolve the issue?

Accepted Answer

Ensure the vault ID matches the one used when encrypting the file.. Option D is correct because Ansible vault supports multiple vault IDs (labels) to manage different passwords for different encrypted files. If the vault ID used during decryption does not match the one used when encrypting the file, Ansible will fail to decrypt it, even if the correct password is provided. The `--vault-id` option or `ANSIBLE_VAULT_ID_MATCH` environment variable must align the ID with the encryption context.

Answer

Verify the file permissions are set to 600.

Answer

Check that the SSH private key has access to the managed node.

Answer

Make sure the vault password file contains the path to the vault file.

Question 10

Your team manages a fleet of 200 Red Hat Enterprise Linux 8 servers. Security policy requires that all servers have a specific set of security configurations: (1) SELinux must be enforcing, (2) the firewall must allow only SSH and HTTPS, (3) SSH root login must be disabled, and (4) the 'auditd' service must be running and enabled. You have created an Ansible role 'security-hardening' that applies these settings. The role is idempotent and uses the 'lineinfile' module to modify /etc/ssh/sshd_config, the 'firewalld' module to configure firewall rules, the 'selinux' module to set SELinux to enforcing, and the 'service' module to enable and start auditd. You run the playbook against a test group of 10 servers, and it reports 'changed=0' for all tasks, indicating the servers are already compliant. However, a subsequent manual audit reveals that on two servers, SELinux is permissive and SSH root login is still permitted. What is the most likely cause of this discrepancy?

Accepted Answer

The inventory hostnames for those two servers are incorrect, causing Ansible to connect to different hosts that are already compliant.. Option C is correct because if the inventory hostnames for the two non-compliant servers are incorrect, Ansible would connect to different hosts that are already compliant, resulting in 'changed=0' for all tasks. The playbook never actually ran against the intended servers, so the manual audit correctly found them non-compliant. This is a common inventory misconfiguration issue where the target hostname does not match the actual server.

Answer

The 'become' privilege escalation is not configured, so the tasks cannot modify system files.

Answer

The playbook was run with the '--check' flag, which simulates changes without applying them.

Answer

The Ansible modules used in the role are not installed on the control node.

Question 11

Drag and drop the steps to configure a container using Podman with a custom Dockerfile in the correct order.

Question 12

Match each Linux command to its function.

Question 13

An automation team wants to securely store SSH private keys for use in playbooks. Which Ansible feature should they use?

Accepted Answer

Ansible Vault. Ansible Vault is the correct feature for securely storing SSH private keys because it encrypts sensitive data at rest using AES-256, allowing keys to be decrypted at runtime when a vault password or key is provided. This enables playbooks to reference encrypted SSH key files without exposing plaintext credentials in version control or on disk.

Answer

Ansible Collections

Answer

Ansible Fact Cache

Answer

Ansible Galaxy

Question 14

A playbook fails with 'ERROR! 'become' is not a valid attribute for a Play'. What is the most likely cause?

Accepted Answer

The playbook uses an older syntax that requires 'sudo'. Option D is correct because in older versions of Ansible (prior to 2.0), privilege escalation was handled using the 'sudo' keyword at the play level. The error 'become' is not a valid attribute for a Play' indicates that the playbook is using the modern 'become' directive at the play level, but the installed Ansible version (likely 1.x) does not support it. The correct syntax for that version would be 'sudo: yes'.

Answer

The playbook lacks a hosts line

Answer

The become directive is misspelled

Answer

become is allowed only in tasks, not plays

Question 15

An organization uses Automation Controller with multiple teams. They want to ensure that team members can only launch job templates that are explicitly assigned to their team. Which configuration approach should be used?

Accepted Answer

Create roles and assign them at the job template level using team roles. Option D is correct because Automation Controller (formerly Ansible Tower) uses Role-Based Access Control (RBAC) where roles (e.g., Execute, Admin) can be assigned to teams at the job template level. This ensures that only members of a specific team can launch the job templates explicitly assigned to that team, without affecting other teams or requiring organization-wide permissions.

Answer

Assign each team to an organization and set organization-level permissions

Answer

Set 'allow simultaneous' to false on job templates

Answer

Use an Identity Provider (IdP) to restrict access

Question 16

A developer wants to encrypt a string in a playbook variable file. Which command should they use?

Accepted Answer

ansible-vault encrypt_string. Option D is correct because `ansible-vault encrypt_string` is specifically designed to encrypt a single string value for use in a playbook variable file, without encrypting the entire file. This command outputs the encrypted string in a format that can be directly pasted into a YAML variable definition, preserving the rest of the file as plaintext.

Answer

ansible-vault rekey

Answer

ansible-vault create

Answer

ansible-vault edit

Question 17

An Ansible playbook is failing due to an undefined variable. Which approach would best help identify the source of the variable?

Accepted Answer

Add a debug task with var: hostvars[inventory_hostname]. Option C is correct because adding a debug task with `var: hostvars[inventory_hostname]` dumps all variables for the current host, including those inherited from group_vars, host_vars, and play-level vars. This allows you to inspect the full variable namespace and identify which variable is undefined or missing, directly addressing the root cause of the failure.

Answer

Add the 'ignore_errors: yes' directive

Answer

Set environment variable ANSIBLE_DEBUG=1

Answer

Use the --syntax-check flag

Question 18

A Red Hat Ansible Automation Platform installation uses a custom execution environment. The playbook runs fail with 'execution environment not found'. The execution environment is stored in a private registry requiring authentication. What must be configured?

Accepted Answer

Add the registry URL to the automation controller's container registry credentials. Option C is correct because when an execution environment is stored in a private registry that requires authentication, the automation controller must have the registry's URL and credentials configured as a container registry credential. This credential is then used by the controller to authenticate and pull the execution environment image during job runs. Without this, the controller cannot access the private registry, resulting in the 'execution environment not found' error.

Answer

Set the execution_environment_image variable in the playbook

Answer

Configure the execution environment in the inventory

Answer

Add the registry to the project's source control

Question 19

An administrator needs to limit the number of concurrent jobs that can run on a specific automation controller node. Which setting should be adjusted?

Accepted Answer

The max concurrent jobs setting in the node's configuration. The correct setting to limit concurrent jobs on a specific automation controller node is the 'max concurrent jobs' parameter in the node's configuration. This setting directly controls how many jobs the node can execute simultaneously, preventing resource exhaustion and ensuring predictable performance. Adjusting this value is the proper method for managing node-level concurrency in Red Hat Ansible Automation Platform.

Answer

The forks parameter in the playbook

Answer

The job template's 'allow simultaneous' option

Answer

The number of execution environments

Question 20

A playbook using the 'uri' module is timing out when connecting to an external API. The network team confirms connectivity. What Ansible configuration parameter can be adjusted to increase the timeout?

Accepted Answer

ansible_timeout. Option C is correct because `ansible_timeout` is an Ansible configuration parameter that controls the default socket-level timeout for network connections, including those made by the `uri` module. When an external API is slow to respond, increasing this value (default 10 seconds) allows the playbook to wait longer before aborting the connection attempt.

Answer

validate_certs

Answer

retries

Answer

delay