EX294 Manage automation security and operations Practice Test 4 — 15 Questions

Question 1

Refer to the exhibit. An administrator deployed this configuration using the controller_configuration role. After deployment, user jdoe can administer Engineering organization but cannot launch a job template within it. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user needs to be added to the job template's role specifically. In Ansible Tower/AWX, organization-level admin roles grant administrative privileges over the organization's objects (e.g., users, teams, inventories) but do not automatically confer execute permissions on specific job templates. To launch a job template, a user must have the 'execute' role on that job template itself, either directly or via a team or user role assignment. Since user jdoe can administer the Engineering organization but cannot launch a job template, the missing piece is the explicit job template role assignment.

Answer

The admin role for organization does not include job template launch permissions

Answer

The user's password is vault-encrypted and cannot be decrypted

Answer

The role assignment should be at the team level, not user level

Question 2

Which two actions are appropriate when configuring a custom execution environment for an automation controller job? (Choose two.)

Accepted Answer

Building the execution environment using ansible-builder. Option B is correct because ansible-builder is the supported tool for creating custom execution environments; it reads an execution-environment.yml definition file and produces a container image containing the required collections, Python packages, and system dependencies. Option E is correct because the execution environment image is defined by a Containerfile (or Dockerfile) that specifies the base image and installs the needed packages, which ansible-builder uses as its build input. Option A is incorrect because execution environments can be stored in private registries (e.g., automation hub, private container registries), not only public ones, and public-only storage is not a requirement. Option C is incorrect because execution_environment_image is configured on the job template or organization in the automation controller, not in the project's SCM repository. Option D is incorrect because using the default execution environment does not constitute configuring a custom execution environment, which is what the scenario requires.

Answer

Storing the execution environment in a public registry only

Answer

Setting the execution_environment_image in the project's SCM

Answer

Using the default execution environment provided by controller

Question 3

An organization needs to implement security best practices for Ansible automation. Which three measures should be taken? (Choose three.)

Accepted Answer

Use ansible-vault to encrypt sensitive variables. Option A is correct because ansible-vault encrypts sensitive variables and files (e.g., via `ansible-vault encrypt` or `encrypt_string`) so secrets such as passwords and API keys are not exposed in plain text within playbooks or repositories. Option C is correct because regularly rotating Ansible Vault passwords limits the impact of a compromised vault password and should be paired with `ansible-vault rekey` to re-encrypt vaulted content under the new password. Option E is correct because limiting access to the automation controller with role-based access control (RBAC) enforces least privilege, ensuring only authorized users or teams can launch jobs, edit credentials, or manage inventories. Option B is not acceptable since storing secrets in plain text in a repository exposes them to anyone with repo access and violates security best practices. Option D is wrong because disabling SSH host key checking globally removes protection against man-in-the-middle attacks and should not be done as a security measure.

Answer

Store all secrets in plain text in repository

Answer

Disable SSH host key checking globally

Question 4

An automation team wants to grant a group of operators the ability to launch job templates in automation controller but prevent them from modifying the job template configuration. They also need to troubleshoot failed jobs by viewing job output. Which predefined role should be assigned to the team for a specific job template?

Accepted Answer

Execute role. The Execute role is the correct predefined role because it grants permission to launch a job template and view job output (including standard out and error logs) without allowing any modifications to the job template's configuration. This aligns exactly with the requirement: operators can execute and troubleshoot failed jobs but cannot edit the template.

Answer

Read role

Answer

Admin role

Answer

Update role

Question 5

A company uses Ansible Automation Platform and wants to ensure that all playbook runs are logged for audit purposes. What is the simplest way to achieve centralized logging of job runs?

Accepted Answer

Configure the syslog server in the automation controller settings.. Automation Controller (formerly Ansible Tower) has a built-in setting under 'System → Logging' where you can configure a syslog server (e.g., using RFC 5424). Once configured, all job runs, playbook output, and audit events are automatically forwarded to that central syslog server without modifying any playbooks or adding custom callbacks. This is the simplest, most centralized, and most maintainable approach for audit logging.

Answer

Use the logging module in each playbook to write to a central syslog.

Answer

Add a playbook callback that sends output to a file on each node.

Answer

Enable verbose logging in the inventory file.

Question 6

An organization uses automation controller and has multiple teams. They want to create an inventory that automatically includes all hosts from a cloud provider that belong to the 'production' tag, and this inventory should be accessible only to the SRE team. What is the correct way to achieve this?

Accepted Answer

Create a smart inventory with a filter for tag 'production' and assign the SRE team the 'read' role on that inventory.. A smart inventory in automation controller allows you to dynamically filter hosts from an existing source (like a cloud provider) based on criteria such as tags. By creating a smart inventory with a filter for the 'production' tag, you automatically include all matching hosts. Assigning the SRE team the 'read' role on that inventory restricts access to only that team, meeting both requirements without manual updates.

Answer

Create a static inventory file and restrict access via a custom script.

Answer

Use groups in the inventory and assign all production hosts to a group, then restrict access to that group.

Answer

Create a dynamic inventory plugin in each playbook and include a condition to check team membership.

Question 7

After rotating the Ansible Vault password in the automation controller, several job templates that use vault credentials start failing with 'decryption failed'. The vault credential has been updated with the new password. What is the most likely cause of the failure?

Accepted Answer

The vault file in the project repository still uses the old vault password and needs to be re-encrypted with the new password.. The vault file itself is encrypted with a specific password. When the vault password is rotated in the automation controller, the vault file stored in the project repository is still encrypted with the old password. The job template uses the vault credential to decrypt the file, but since the credential now holds the new password, decryption fails. The vault file must be re-encrypted with the new password using `ansible-vault rekey` or by decrypting and re-encrypting it.

Answer

The automation controller needs a restart to apply the new vault credential.

Answer

The vault credential is not linked to the job template correctly.

Answer

The vault credential type requires the old password to be stored separately.

Question 8

An administrator is migrating playbooks to use execution environments in automation controller. They want to ensure that all playbook runs use a custom execution environment that includes the necessary Python libraries and is signed to comply with security policy. What should the administrator do?

Accepted Answer

Build the execution environment using ansible-builder and then push it to a private registry and reference it in the automation controller.. The administrator must build a custom execution environment using `ansible-builder`, which packages the required Python libraries and Ansible content into a container image. This image must then be pushed to a private registry (e.g., Quay.io or Red Hat Registry) and referenced in automation controller's execution environment configuration. Additionally, signing the image (e.g., via Podman or Skopeo) ensures compliance with security policies by verifying image integrity before execution.

Answer

Push the custom execution environment to the default namespace and assign it to job templates.

Answer

Use the default execution environment and install Python libraries via the playbook.

Answer

Define the execution environment in the project repository and use a pre-run hook.

Question 9

A systems administrator is securing Ansible automation. Which two practices help protect sensitive data in playbooks? (Choose two.)

Accepted Answer

Use ansible-vault to encrypt variable files.. Option A is correct because ansible-vault encrypts sensitive files such as variable files (for example, vars.yml or group_vars files), so secrets like passwords and API keys are stored in ciphertext rather than readable plain text, and they can be decrypted at runtime with a vault password. Option B is correct because setting no_log: true on a task suppresses logging of that task's command output and arguments, preventing sensitive values such as passwords or tokens from being written into Ansible logs or console output. Option C is incorrect because using the debug module with increased verbosity would print sensitive values such as passwords to output, which is the opposite of protecting them. Option D is incorrect because avoiding become: yes does not protect secrets; privilege escalation is unrelated to whether sensitive data is encrypted or hidden, and become is often legitimately needed for secure tasks. Option E is incorrect because storing credentials in plain text in the inventory exposes them directly and is a classic insecure practice, not a protection measure.

Answer

Use the debug module with verbosity to output passwords.

Answer

Avoid using become: yes on tasks that access secrets.

Answer

Store credentials in plain text in the inventory.

Question 10

Refer to the exhibit. A playbook fails with the given error. What is the most likely cause?

Accepted Answer

The vault password file is missing or incorrect.. The error in the exhibit (typically 'Attempting to decrypt but no vault secrets found' or 'no vault password file') indicates Ansible cannot decrypt vault-encrypted content because the vault password file is missing, unreadable, or contains the wrong password. Ansible needs either --ask-vault-pass or --vault-password-file pointing to a valid file. If the file path is wrong or the password is incorrect, decryption fails before the play can run.

Answer

The playbook syntax is wrong.

Answer

The inventory file is encrypted.

Answer

The remote host is unreachable.

Question 11

Refer to the exhibit. What is the most likely cause of the job being in 'pending' state?

Accepted Answer

The job is queued because the capacity limit of the automation controller is reached.. In Ansible Automation Platform, when a job is in 'pending' state, it typically indicates that the automation controller has queued the job because the maximum number of concurrent jobs (capacity limit) has been reached. The controller uses a job fork limit and instance group capacity to determine how many jobs can run simultaneously; once that limit is hit, additional jobs are placed in a pending queue until capacity frees up.

Answer

The credential is invalid and the system is attempting to validate it.

Answer

The job template is configured with a survey that requires approval.

Answer

The project needs to be updated before the job can run.

Question 12

Which TWO of the following are best practices for securing automation controller secrets and credentials?

Accepted Answer

Use Ansible Vault to encrypt sensitive data like passwords and API keys. Option B is correct because Ansible Vault encrypts sensitive variables, passwords, and API keys at rest with AES-256, so playbooks and variable files can be safely stored in version control without exposing plaintext secrets. Option D is correct because OAuth2 tokens provide scoped, time-limited, and revocable API authentication, which is far safer than long-lived static credentials that, if leaked, grant persistent access. Option A is wrong because storing secrets in plaintext in inventory files exposes them to anyone with file or repository access. Option C is wrong because disabling logging reduces auditability and does not actually secure secrets; instead, you should use no_log and vaulted variables to keep sensitive data out of logs. Option E is wrong because granting all users admin access violates least privilege and dramatically increases the blast radius of any compromised account.

Answer

Store secrets in plain text in inventory files for simplicity

Answer

Disable logging to prevent exposure of sensitive data in logs

Answer

Grant all users admin access to reduce permission complexity

Question 13

A junior administrator needs to rotate the password for a database user stored in an Ansible Vault-encrypted file (secrets.yml). The current password is unknown to the admin, but they have the vault password file (vault-pass.txt). The admin wants to edit the file securely without exposing the decrypted content in the terminal history or logs. Which command should they run?

Accepted Answer

ansible-vault edit --vault-password-file vault-pass.txt secrets.yml. `ansible-vault edit` decrypts the file to a temporary file, opens it in the default editor (e.g., vi), and upon saving, re-encrypts it transparently. This prevents the decrypted content from ever being written to the terminal history or logs, as the editing happens in a secure temporary location that is cleaned up after the editor closes.

Answer

ansible-vault decrypt --vault-password-file vault-pass.txt secrets.yml

Answer

ansible-vault rekey --vault-password-file vault-pass.txt secrets.yml

Answer

ansible-vault view --vault-password-file vault-pass.txt secrets.yml

Question 14

A playbook must read a vault-encrypted variable file named secrets.yml and also use a vault password stored in a file named vault_pass.txt. The playbook is executed with the command `ansible-playbook site.yml --vault-password-file vault_pass.txt`. The file secrets.yml was encrypted with the same password. During execution, the task that uses a variable from secrets.yml fails with an error indicating the variable is undefined. What is the most likely reason?

Accepted Answer

The vault-encrypted variable file must be included with vars_files in the playbook, not merely present in the same directory.. Variables from a vault-encrypted file are only available to a play if the file is explicitly loaded, commonly through vars_files or include_vars. Merely placing the encrypted file alongside the playbook and supplying the vault password does not make its variables available, so the task referencing them fails with an undefined variable error.

Answer

The vault password file must be passed with --vault-id instead of --vault-password-file.

Answer

The vault password file must have permissions of 0600, otherwise Ansible ignores it.

Answer

The variable file must be decrypted to plaintext before it can be used in a playbook.

Question 15

An automation engineer stores a sudo password inside a project variable file that is committed to Git. The team requires that the cleartext value never appears in the repository and that playbooks still consume the variable transparently. Which approach meets this requirement?

Accepted Answer

Encrypt the variable file with ansible-vault encrypt and reference it from the playbook with vars_files; commit the encrypted file to Git.. Ansible Vault encrypts files and individual values using AES-256 so that secrets can be safely stored in source control. Encrypting the whole variable file with ansible-vault encrypt and loading it through vars_files keeps the plaintext out of Git while playbooks still resolve the variable normally. Decryption happens at runtime using a vault password provided interactively or through a password file.

Answer

Run ansible-vault encrypt_string on the variable and store the resulting inline value directly in group_vars/all.yml.

Answer

Add the variable file to .gitignore and distribute it manually to each control node's home directory before running the playbook.

Answer

Store the password in an environment variable on the control node and reference it with lookup('env', 'SUDO_PASS') inside the playbook.