EX294 Manage automation security and operations — 20 Questions

Question 1

An Ansible automation controller job template uses a custom credential type that requires a secret token. The token is stored as an extra variable in the job template definition. A security audit reveals the token is visible in plaintext in the job output. Which action should the administrator take to secure the secret?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define the variable in the job template's 'extra variables' field with 'no_log: true' set in the playbook for that variable.. Setting `no_log: true` on the variable in the playbook prevents Ansible from printing the value of that variable in any output, including job logs. This is the standard method to hide sensitive data like tokens when they are passed as extra variables, as it works at the task level to suppress logging of the variable's content.

Answer

Vault-encrypt the variable in the playbook and reference it with {{ vault_var }}.

Answer

Create a custom credential type that injects the token as an environment variable, and remove the extra variable from the job template.

Answer

Store the token in a file on the controller with 600 permissions and use 'lookup' in the playbook.

Question 2

A Red Hat Ansible Automation Platform deployment uses automation mesh to manage remote nodes across a high-latency WAN. An administrator notices that some job runs fail intermittently due to connection timeouts. The administrator wants to improve reliability without changing network infrastructure. Which configuration change is most effective?

Accepted Answer

Increase the 'timeout' value in the [defaults] section of ansible.cfg to 60 seconds.. Increasing the 'timeout' value in the [defaults] section of ansible.cfg extends the SSH connection timeout, which directly addresses intermittent failures caused by high-latency WAN links. This change allows Ansible to wait longer for a remote node to respond before aborting the connection, improving reliability without altering network infrastructure.

Answer

Increase the 'retries' parameter for each task.

Answer

Increase the 'forks' value in ansible.cfg to 50.

Answer

Set 'async: 600' and 'poll: 10' in the playbook.

Question 3

An organization requires that all Ansible playbooks be executed using a specific service account that has limited permissions. The account can only run playbooks from a specific directory. Which approach best enforces this requirement in automation controller?

Accepted Answer

Create a project that syncs only the authorized directory, and assign the service account as the only user with execute permissions on that project.. Automation Controller (formerly Ansible Tower) uses Projects to manage playbook source code. By creating a Project that syncs only the authorized directory and assigning the service account as the only user with execute permissions on that Project, you restrict the service account to running playbooks exclusively from that directory. This enforces the requirement at the platform level, leveraging role-based access control (RBAC) within the controller.

Answer

Use an inventory that contains only the allowed hosts.

Answer

Configure an execution environment that mounts the authorized directory as read-only.

Answer

Assign the service account a machine credential that connects to the controller via SSH.

Question 4

A managed node is not responding to Ansible automation. The administrator verifies that the node is reachable via SSH and that the SSH key is correctly deployed. However, 'ansible all -m ping' fails with 'UNREACHABLE'. The automation controller uses a custom execution environment. What is the most likely cause?

Accepted Answer

The SSH private key has incorrect permissions on the controller.. The SSH private key must have permissions set to 600 (owner read/write only) for SSH to accept it. Even though the key is correctly deployed on the controller host, the custom execution environment (container) may have different file permissions, or the key might be copied with incorrect permissions. SSH will refuse to use a key with overly permissive settings, resulting in an 'UNREACHABLE' status despite the host being network-reachable.

Answer

The remote user specified in the credential does not have sudo access.

Answer

The custom execution environment is missing the 'python3' or 'python' package.

Answer

The automation controller is behind a firewall that blocks SSH.

Question 5

An automation controller administrator must ensure that a playbook's output does not expose sensitive data. Which TWO actions should be taken? (Choose exactly two.)

Accepted Answer

Set 'no_log: true' on tasks that handle sensitive data.. Only Option A is valid. Setting 'no_log: true' on sensitive tasks prevents Ansible from printing task arguments and output to the console or log files, ensuring that sensitive information like passwords or API keys are not exposed. Option D references 'display_args_to_stdout = false', which is not a valid Ansible configuration option and does not exist. Therefore, only one action is correct.

Answer

Set 'stdout_callback = actionable' in ansible.cfg.

Answer

Use 'name: "Sensitive task"' but keep the task body visible.

Answer

Add 'display_args_to_stdout = false' to the execution environment's ansible.cfg.

Answer

Use 'tags: never' on sensitive tasks.

Question 6

An organization has multiple automation controller clusters spread across different geographic regions. The security policy requires that job artifacts (such as logs and assets) must remain in the region where the job ran. Which THREE configurations support this requirement? (Choose exactly three.)

Accepted Answer

Disable the 'Enable remote logging' option in the controller configuration for each cluster.. Option A is correct because disabling 'Enable remote logging' in the controller configuration prevents job logs from being forwarded to an external logging aggregator (such as Splunk, Elasticsearch, or a syslog server) that could reside outside the region, keeping log artifacts local to the cluster. Option C is correct because assigning each cluster its own inventory and restricting node membership to that region's hosts ensures jobs only execute against and produce artifacts for hosts within the same geographic region, satisfying data-residency boundaries. Option D is correct because setting the 'local' execution node and configuring the controller to store artifacts on the local filesystem forces job output (logs, stdout, and generated assets) to be written to disk on the controller within that region rather than being shipped elsewhere. Option B is not correct because a custom execution environment that writes artifacts to a network share could place artifacts in a different region depending on where the share is hosted, which does not guarantee residency. Option E is not correct because automation mesh routing jobs to the nearest execution node only affects job placement and latency; it does not by itself control where artifacts are stored or prevent remote logging, so it does not enforce the residency requirement.

Answer

Use a custom execution environment that writes artifacts to a network share.

Answer

Configure automation mesh to route jobs to the nearest execution node.

Question 7

You are managing an Ansible Automation Platform deployment that uses automation mesh with one control node and two execution nodes. The control node is in the DMZ, and the execution nodes are in a private network. The organization's security policy requires that all secrets (e.g., SSH keys, API tokens) be encrypted at rest and never transmitted in plaintext. You have configured vault-encrypted credentials and set the vault password as a credential on the control node. However, a recent audit reveals that when a job runs, the vault password is visible in the job output on the execution nodes. The execution nodes are configured to stream job events back to the control node. The automation controller version is 4.3. The following settings are in place: 'no_log' is not set for any variables; the vault password is stored as a 'Vault password' credential type. The job template uses a custom credential type that injects the vault password as an environment variable. The execution nodes have access to the vault password via that environment variable. The audit shows the environment variable is printed in the job output because the playbook uses the 'env' module to display environment variables for debugging. You must prevent the vault password from appearing in any job output without breaking the ability to decrypt vault-encrypted variables. Which action should you take?

Accepted Answer

Edit the custom credential type's input injection to set 'no_log: true' for the environment variable that carries the vault password.. Setting `no_log: true` on the environment variable injection in the custom credential type prevents Ansible from logging the value of that variable in job output, while still allowing the vault password to be used by the playbook to decrypt vault-encrypted variables. This directly addresses the audit finding without removing debugging capabilities or changing the credential type.

Answer

Remove the 'env' task from the playbook and ensure no other tasks print environment variables.

Answer

Configure the automation controller's 'Settings' to enable 'Display secrets' = false.

Answer

Change the custom credential type to use the built-in 'Vault password' credential type and remove the custom credential type.

Question 8

Your team manages a fleet of 200 Red Hat Enterprise Linux 8 servers. Security policy requires that all servers have a specific set of security configurations: (1) SELinux must be enforcing, (2) the firewall must allow only SSH and HTTPS, (3) SSH root login must be disabled, and (4) the 'auditd' service must be running and enabled. You have created an Ansible role 'security-hardening' that applies these settings. The role is idempotent and uses the 'lineinfile' module to modify /etc/ssh/sshd_config, the 'firewalld' module to configure firewall rules, the 'selinux' module to set SELinux to enforcing, and the 'service' module to enable and start auditd. You run the playbook against a test group of 10 servers, and it reports 'changed=0' for all tasks, indicating the servers are already compliant. However, a subsequent manual audit reveals that on two servers, SELinux is permissive and SSH root login is still permitted. What is the most likely cause of this discrepancy?

Accepted Answer

The inventory hostnames for those two servers are incorrect, causing Ansible to connect to different hosts that are already compliant.. If the inventory hostnames for the two non-compliant servers are incorrect, Ansible would connect to different hosts that are already compliant, resulting in 'changed=0' for all tasks. The playbook never actually ran against the intended servers, so the manual audit correctly found them non-compliant. This is a common inventory misconfiguration issue where the target hostname does not match the actual server.

Answer

The 'become' privilege escalation is not configured, so the tasks cannot modify system files.

Answer

The playbook was run with the '--check' flag, which simulates changes without applying them.

Answer

The Ansible modules used in the role are not installed on the control node.

Question 9

Match each Linux command to its function.

Accepted Answer

ls: Lists directory contents. Correct matches: ls lists directory contents, cp copies files/directories, mv moves/renames, rm removes. Common confusions include mixing up cp with mv and ls with cat.

Answer

ls: Displays file contents

Answer

cp: Moves files

Question 10

A playbook fails with 'ERROR! 'become' is not a valid attribute for a Play'. What is the most likely cause?

Accepted Answer

The playbook uses an older syntax that requires 'sudo'. In older versions of Ansible (prior to 2.0), privilege escalation was handled using the 'sudo' keyword at the play level. The error 'become' is not a valid attribute for a Play' indicates that the playbook is using the modern 'become' directive at the play level, but the installed Ansible version (likely 1.x) does not support it. The correct syntax for that version would be 'sudo: yes'.

Answer

The playbook lacks a hosts line

Answer

The become directive is misspelled

Answer

become is allowed only in tasks, not plays

Question 11

An Ansible playbook is failing due to an undefined variable. Which approach would best help identify the source of the variable?

Accepted Answer

Add a debug task with var: hostvars[inventory_hostname]. Adding a debug task with `var: hostvars[inventory_hostname]` dumps all variables for the current host, including those inherited from group_vars, host_vars, and play-level vars. This allows you to inspect the full variable namespace and identify which variable is undefined or missing, directly addressing the root cause of the failure.

Answer

Add the 'ignore_errors: yes' directive

Answer

Set environment variable ANSIBLE_DEBUG=1

Answer

Use the --syntax-check flag

Question 12

An administrator needs to limit the number of concurrent jobs that can run on a specific automation controller node. Which setting should be adjusted?

Accepted Answer

The max concurrent jobs setting in the node's configuration. The correct setting to limit concurrent jobs on a specific automation controller node is the 'max concurrent jobs' parameter in the node's configuration. This setting directly controls how many jobs the node can execute simultaneously, preventing resource exhaustion and ensuring predictable performance. Adjusting this value is the proper method for managing node-level concurrency in Red Hat Ansible Automation Platform.

Answer

The forks parameter in the playbook

Answer

The job template's 'allow simultaneous' option

Answer

The number of execution environments

Question 13

A playbook using the 'uri' module is timing out when connecting to an external API. The network team confirms connectivity. What Ansible configuration parameter can be adjusted to increase the timeout?

Accepted Answer

ansible_timeout. `ansible_timeout` is an Ansible configuration parameter that controls the default socket-level timeout for network connections, including those made by the `uri` module. When an external API is slow to respond, increasing this value (default 10 seconds) allows the playbook to wait longer before aborting the connection attempt.

Answer

validate_certs

Answer

retries

Answer

delay

Question 14

A security team requires that all automation controller job logs be forwarded to an external SIEM system. Which integration should be used?

Accepted Answer

Automation controller's built-in logging aggregator. Automation controller (formerly Ansible Tower) includes a built-in logging aggregator that can forward job logs to external SIEM systems via supported protocols such as HTTPS, TCP, or UDP. This integration is configured directly in the controller's settings, requiring no additional scripts or system-level changes, making it the correct and supported method for centralized log forwarding.

Answer

Ansible Log Forwarder

Answer

Custom callback plugin

Answer

rsyslog configuration

Question 15

Refer to the exhibit. The user ran ansible-navigator without specifying an inventory. What does the warning indicate about the target hosts?

Accepted Answer

The playbook only ran against localhost because no inventory was defined. When `ansible-navigator` runs without a specified inventory, it defaults to using the implicit localhost. The implicit localhost is automatically part of the `all` group, so a playbook with `hosts: all` will match localhost and execute tasks on it. The warning indicates that no inventory was provided, meaning only localhost is available as a target host. Therefore, the playbook ran only against localhost, which corresponds to option C.

Answer

The playbook ran against all hosts in the default inventory

Answer

The playbook used the implicit localhost but it does not match 'all', causing no tasks to run

Answer

The playbook failed because no hosts matched

Question 16

Refer to the exhibit. An automation job failed with the given error. What is the most likely cause?

Accepted Answer

The SSH key is not authorized for the remote user. The error message indicates an SSH authentication failure, which occurs when the SSH key presented by the control node is not authorized for the remote user's account. This is the most likely cause because Ansible relies on SSH key-based authentication by default, and a missing or mismatched public key on the remote host will prevent the connection.

Answer

The playbook syntax is incorrect

Answer

The SSH port is blocked

Answer

The remote host is unreachable

Question 17

Which two conditions could prevent an automation controller job from starting? (Choose two.)

Accepted Answer

The project sync is pending. Option B is correct because a job template that references a project whose sync is still pending cannot launch — the controller must have a successfully synced project revision before it can start the job, so a pending project sync blocks the start. Option C is correct because a job template that has been disabled will not launch; the controller refuses to start jobs from disabled templates until they are re-enabled. Option A is not correct because an empty inventory source does not prevent a job from starting — the job can still run (often failing at playbook execution or with no hosts matched) rather than being blocked from starting. Option D is not correct because the system auditor role is a read-only role; it affects what a user can view or launch based on permissions, but being a system auditor by itself is not a condition that prevents a job from starting. Option E is not correct because using the 'latest' image tag for an execution environment is valid and does not block job startup, even though pinning a specific tag is a best practice.

Answer

The inventory source is empty

Answer

The user is a system auditor

Answer

The execution environment image tag is 'latest'

Question 18

A systems administrator needs to securely store a database password for use in an Ansible playbook. The password should be encrypted at rest and decrypted only at runtime when the playbook is executed. Which approach should the administrator take?

Accepted Answer

Use the ansible-vault encrypt_string command to encrypt the password and store it in a variables file.. `ansible-vault encrypt_string` encrypts the password at rest using AES-256, storing it as a ciphertext string in a variables file. At runtime, when the playbook is executed with `--ask-vault-pass` or a vault password file, Ansible decrypts the value transparently, ensuring the plaintext password is never written to disk or logs.

Answer

Store the password as a plain text variable in the playbook and use the no_log: yes directive to prevent logging.

Answer

Store the password in an unprotected external file and reference it with include_vars.

Answer

Save the password in an environment variable and access it via lookup('env','DB_PASS').

Question 19

An administrator is configuring a job template in automation controller that runs a playbook to deploy a web application. The playbook requires a database password that changes quarterly. To avoid updating the credential each quarter, what is the best approach to dynamically provide the password without exposing it in the playbook?

Accepted Answer

Define a survey prompt in the job template that asks for the password during launch.. A survey prompt in the job template allows the password to be entered at launch time, avoiding hardcoding or storing it in the playbook or project. This approach dynamically provides the password each quarter without requiring credential updates, as the survey can be configured to prompt for the password as a variable that the playbook uses. It aligns with automation controller's built-in survey feature for secure, runtime variable input.

Answer

Use a lookup plugin to fetch the password from an external secrets manager.

Answer

Store the password as a variable in the project repository and encrypt it with ansible-vault.

Answer

Create a custom credential type that prompts for the password each launch.

Question 20

A workflow template in automation controller consists of three job templates that must run sequentially with different credentials. The first job template uses a machine credential to provision a VM, the second uses a network credential to configure the switch, and the third uses a cloud credential to deploy the application. To secure the credential usage, what should the administrator configure?

Accepted Answer

Set each job template to use the appropriate credential and ensure workflow node permissions are set to 'use credential'.. To secure credential usage in a workflow with multiple job templates requiring different credentials, each job template should be configured with its appropriate credential, and workflow node permissions should be set to 'use credential'. This ensures that each job runs with only the necessary credentials, adhering to least privilege.

Answer

Create a single credential that covers all three environments.

Answer

Define credential validation rules in the workflow node properties.

Answer

Assign all three credentials to the workflow template directly.