EX294 Manage automation security and operations Practice Test 3 — 15 Questions

Question 1

An administrator is configuring a job template in automation controller that runs a playbook to deploy a web application. The playbook requires a database password that changes quarterly. To avoid updating the credential each quarter, what is the best approach to dynamically provide the password without exposing it in the playbook?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define a survey prompt in the job template that asks for the password during launch.. A survey prompt in the job template allows the password to be entered at launch time, avoiding hardcoding or storing it in the playbook or project. This approach dynamically provides the password each quarter without requiring credential updates, as the survey can be configured to prompt for the password as a variable that the playbook uses. It aligns with automation controller's built-in survey feature for secure, runtime variable input.

Answer

Use a lookup plugin to fetch the password from an external secrets manager.

Answer

Store the password as a variable in the project repository and encrypt it with ansible-vault.

Answer

Create a custom credential type that prompts for the password each launch.

Question 2

A workflow template in automation controller consists of three job templates that must run sequentially with different credentials. The first job template uses a machine credential to provision a VM, the second uses a network credential to configure the switch, and the third uses a cloud credential to deploy the application. To secure the credential usage, what should the administrator configure?

Accepted Answer

Set each job template to use the appropriate credential and ensure workflow node permissions are set to 'use credential'.. Each job template can have its own credential defined. The workflow template does not directly hold credentials; it uses the credentials assigned to each job template. Option A (single credential) is not appropriate. Option C (validation rules) does not exist. Option D (assign to workflow) is not possible.

Answer

Create a single credential that covers all three environments.

Answer

Define credential validation rules in the workflow node properties.

Answer

Assign all three credentials to the workflow template directly.

Question 3

An organization uses automation controller and has multiple teams. They want to create an inventory that automatically includes all hosts from a cloud provider that belong to the 'production' tag, and this inventory should be accessible only to the SRE team. What is the correct way to achieve this?

Accepted Answer

Create a smart inventory with a filter for tag 'production' and assign the SRE team the 'read' role on that inventory.. A smart inventory in automation controller allows you to dynamically filter hosts from an existing source (like a cloud provider) based on criteria such as tags. By creating a smart inventory with a filter for the 'production' tag, you automatically include all matching hosts. Assigning the SRE team the 'read' role on that inventory restricts access to only that team, meeting both requirements without manual updates.

Answer

Create a static inventory file and restrict access via a custom script.

Answer

Use groups in the inventory and assign all production hosts to a group, then restrict access to that group.

Answer

Create a dynamic inventory plugin in each playbook and include a condition to check team membership.

Question 4

After rotating the Ansible Vault password in the automation controller, several job templates that use vault credentials start failing with 'decryption failed'. The vault credential has been updated with the new password. What is the most likely cause of the failure?

Accepted Answer

The vault file in the project repository still uses the old vault password and needs to be re-encrypted with the new password.. The vault file itself is encrypted with a specific password. When the vault password is rotated in the automation controller, the vault file stored in the project repository is still encrypted with the old password. The job template uses the vault credential to decrypt the file, but since the credential now holds the new password, decryption fails. The vault file must be re-encrypted with the new password using `ansible-vault rekey` or by decrypting and re-encrypting it.

Answer

The automation controller needs a restart to apply the new vault credential.

Answer

The vault credential is not linked to the job template correctly.

Answer

The vault credential type requires the old password to be stored separately.

Question 5

An organization uses a proprietary API service that requires token-based authentication with a base64-encoded payload including username, password, and tenant ID. The administrator wants to create a custom credential type in automation controller so that users can input these three values separately, and the playbook receives the final token. Which input configuration fields should be defined?

Accepted Answer

Three separate text fields (username, password, tenant ID) with a custom injector template that concatenates and base64-encodes them.. Automation controller custom credential types allow defining multiple input fields (username, password, tenant ID) and a custom injector template that can concatenate and base64-encode these values into a single token. The injector template uses Jinja2 syntax to combine the inputs and apply the `b64encode` filter, so the playbook receives the final base64-encoded token as a single credential variable.

Answer

One text field for the token, and inject it as an environment variable.

Answer

Two fields: username and password, and use a lookup plugin to fetch tenant ID.

Answer

Create a single multiline text field where users paste the base64 string.

Question 6

An administrator is migrating playbooks to use execution environments in automation controller. They want to ensure that all playbook runs use a custom execution environment that includes the necessary Python libraries and is signed to comply with security policy. What should the administrator do?

Accepted Answer

Build the execution environment using ansible-builder and then push it to a private registry and reference it in the automation controller.. The administrator must build a custom execution environment using `ansible-builder`, which packages the required Python libraries and Ansible content into a container image. This image must then be pushed to a private registry (e.g., Quay.io or Red Hat Registry) and referenced in automation controller's execution environment configuration. Additionally, signing the image (e.g., via Podman or Skopeo) ensures compliance with security policies by verifying image integrity before execution.

Answer

Push the custom execution environment to the default namespace and assign it to job templates.

Answer

Use the default execution environment and install Python libraries via the playbook.

Answer

Define the execution environment in the project repository and use a pre-run hook.

Question 7

A systems administrator is securing Ansible automation. Which two practices help protect sensitive data in playbooks? (Choose two.)

Accepted Answer

Use ansible-vault to encrypt variable files.. `ansible-vault` encrypts variable files at rest using AES-256, allowing sensitive data like passwords or API keys to be stored securely in version control. When a playbook runs, the vault password must be provided (e.g., via `--ask-vault-pass` or a vault password file), and Ansible decrypts the file in memory only, never writing plaintext to disk. This ensures that sensitive values are not exposed in the playbook source code or logs.

Answer

Use the debug module with verbosity to output passwords.

Answer

Avoid using become: yes on tasks that access secrets.

Answer

Store credentials in plain text in the inventory.

Question 8

An automation controller administrator needs to limit access to a sensitive inventory. Which two methods can be used to restrict access to that inventory? (Choose two.)

Accepted Answer

Place the inventory in an organization and assign appropriate roles to users and teams.. In Ansible Automation Platform, access to inventories is managed through Role-Based Access Control (RBAC) within organizations. Placing the inventory in an organization allows administrators to assign specific roles (e.g., Admin, Execute, Read) to users or teams, effectively restricting access. Additionally, using a custom role with read-only permissions ensures that users can view the inventory but cannot modify or delete it, providing a fine-grained access control mechanism.

Answer

Assign the 'admin' role to the inventory and grant it only to specific users.

Answer

Encrypt the inventory with ansible-vault and share the vault password only with authorized users.

Answer

Set the inventory to 'private' in the inventory settings.

Question 9

An organization uses automation controller with multiple projects and teams. They want to enforce that only the operations team can run job templates that make changes in production, while the development team can only run job templates that deploy to development environments. Which three components should be configured to achieve this? (Choose three.)

Accepted Answer

Assign different credentials to each job template.. Credentials in automation controller (formerly Ansible Tower/AWX) define the authentication context for a job template. By assigning different credentials (e.g., SSH keys or cloud API tokens) to production and development job templates, you can enforce that only the operations team's credentials have access to production infrastructure, while the development team's credentials are restricted to development environments. This is a fundamental access control mechanism that ties authentication directly to job execution.

Answer

Set execution environments to be team-specific.

Answer

Use a workflow template that routes based on user role.

Question 10

Refer to the exhibit. A playbook fails with the given error. What is the most likely cause?

Accepted Answer

The vault password file is missing or incorrect.. The error message indicates that Ansible cannot decrypt the vault file because the vault password is missing or incorrect. This is most commonly caused by an incorrect or missing vault password file. Option A (syntax error) and option D (unreachable host) would produce different error messages. Option C (encrypted inventory file) is not a standard Ansible behavior; inventory files are typically not encrypted. Therefore, the correct answer is B.

Answer

The playbook syntax is wrong.

Answer

The inventory file is encrypted.

Answer

The remote host is unreachable.

Question 11

Refer to the exhibit. What is the most likely cause of the job being in 'pending' state?

Accepted Answer

The job is queued because the capacity limit of the automation controller is reached.. In Ansible Automation Platform, when a job is in 'pending' state, it typically indicates that the automation controller has queued the job because the maximum number of concurrent jobs (capacity limit) has been reached. The controller uses a job fork limit and instance group capacity to determine how many jobs can run simultaneously; once that limit is hit, additional jobs are placed in a pending queue until capacity frees up.

Answer

The credential is invalid and the system is attempting to validate it.

Answer

The job template is configured with a survey that requires approval.

Answer

The project needs to be updated before the job can run.

Question 12

A company has deployed Ansible Automation Platform with a single automation controller node. The operations team uses a workflow that includes three job templates: A, B, and C, each requiring different credentials. Recently, the workflow started failing intermittently with errors such as 'Timeout' and 'Connection refused' on certain hosts. The inventory is dynamic from a cloud provider. The administrator checks that the credentials are valid and the hosts are online. The job execution history shows that the failures occur only when the workflow attempts to run job template B on a subset of hosts that are located in a different subnet. Job templates A and C run fine on all hosts. What is the most likely cause and the best course of action?

Accepted Answer

The hosts in the problematic subnet are not reachable due to a firewall; add those hosts to a separate inventory and use a different cloud credential.. The errors 'Connection refused' and 'Timeout' on a subset of hosts for only one job template suggest a network‑level issue specific to that template’s communication path. A firewall rule blocking the port or IP used by job template B (potentially a non‑default SSH port or a different route due to its credential) is the most likely cause. Adding the affected hosts to a separate inventory with a different cloud credential can force Ansible to use an alternative network path or gateways, bypassing the restriction. Simply installing a second controller node does not explain why templates A and C succeed on the same hosts.

Answer

The credential used by job template B is associated with an incorrect SSH key for those hosts; create a new credential for that subnet and update the job template.

Answer

The automation controller does not have network access to the problematic subnet; install a second automation controller node in that subnet and configure clustering.

Answer

The job template B requires a sudo escalation that is not configured on those hosts; update the playbook to use become_method: su.

Question 13

Which TWO of the following are best practices for securing automation controller secrets and credentials?

Accepted Answer

Use Ansible Vault to encrypt sensitive data like passwords and API keys. Ansible Vault provides encryption for sensitive data such as passwords and API keys, ensuring they are not stored in plaintext. This is a core security practice for automation controller secrets, as it protects credentials at rest and during transport when used with playbooks.

Answer

Store secrets in plain text in inventory files for simplicity

Answer

Disable logging to prevent exposure of sensitive data in logs

Answer

Grant all users admin access to reduce permission complexity

Question 14

A large enterprise runs a multi-tenant Ansible Automation Platform deployment. The security team has mandated strict role-based access control (RBAC) for three departments: Network (manages routers/switches), Security (manages firewalls/IDS), and Operations (manages servers/applications). Each department must have its own projects, inventories, job templates, and credentials. Additionally, credentials must not be viewable by users who do not own them. The platform currently uses a single organization with one team and all users have admin permissions. Which course of action best meets these requirements?

Accepted Answer

Create three organizations (Network, Security, Operations). Within each organization, create a team, assign users, and grant appropriate permissions. Use custom roles to restrict credential access to team members only.. Creating separate organizations for each department provides the strongest isolation boundary in Ansible Automation Platform. Within each organization, a dedicated team with custom roles ensures that credentials are scoped to that team and cannot be viewed by users outside it, satisfying the RBAC and credential visibility requirements.

Answer

Create custom roles with no organizations. Assign users directly to resources via user-level permissions.

Answer

Keep a single organization but create three teams. Assign each team to its own projects and inventories, and use job template-level permissions to restrict access.

Answer

Use a single organization with one team. Set all credentials to 'read-only' to prevent viewing of secret values.

Question 15

A junior administrator needs to rotate the password for a database user stored in an Ansible Vault-encrypted file (secrets.yml). The current password is unknown to the admin, but they have the vault password file (vault-pass.txt). The admin wants to edit the file securely without exposing the decrypted content in the terminal history or logs. Which command should they run?

Accepted Answer

ansible-vault edit --vault-password-file vault-pass.txt secrets.yml. `ansible-vault edit` decrypts the file to a temporary file, opens it in the default editor (e.g., vi), and upon saving, re-encrypts it transparently. This prevents the decrypted content from ever being written to the terminal history or logs, as the editing happens in a secure temporary location that is cleaned up after the editor closes.

Answer

ansible-vault decrypt --vault-password-file vault-pass.txt secrets.yml

Answer

ansible-vault rekey --vault-password-file vault-pass.txt secrets.yml

Answer

ansible-vault view --vault-password-file vault-pass.txt secrets.yml