EX294 Manage automation security and operations Practice Test 5 — 15 Questions

Question 1

An automation controller administrator needs to allow a team of developers to run playbooks that use a vault-encrypted variable file. The vault password must not be stored in the playbook repository or exposed in job output. Which approach meets the requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Store the vault password in an Ansible vault credential and attach it to the job template.. Automation controller vault credentials securely store secrets and inject them into jobs without exposing them in the repository or job output. Attaching such a credential to a job template provides the vault password at runtime, enabling decryption of vaulted files while keeping the secret centralized and auditable.

Answer

Configure the job template to prompt for the vault password at launch time.

Answer

Set the vault password as an environment variable named ANSIBLE_VAULT_PASSWORD on the automation controller host.

Answer

Embed the vault password in the playbook as an encrypted variable using ansible-vault encrypt_string.

Question 2

A playbook that manages user accounts must run a task that passes a decrypted service account password to a command. Job output currently shows the password in the task result. Which change ensures the password is not displayed while keeping the task functional?

Accepted Answer

Set no_log: true on the task so its output is suppressed in the job log.. Ansible renders task return data in the job output, so any secret passed as an argument or registered value can leak. Applying no_log: true to the specific task suppresses that output while leaving the task's execution intact. This is the targeted control for hiding sensitive values at runtime, complementing vault encryption that only protects data at rest.

Answer

Run the playbook with --diff to show only changes and hide unchanged task output.

Answer

Add the password variable to a vault-encrypted file and reference it with vars_files.

Answer

Set display_skipped_hosts and display_ok_hosts to false in ansible.cfg.

Question 3

An organization uses automation controller and must ensure that sensitive data such as passwords and API keys are not exposed in job output. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Use automation controller credentials to store secrets instead of plaintext variables.. Using no_log: true on tasks that handle secrets prevents their output from being logged or displayed. Storing secrets in automation controller credentials keeps them out of playbooks and job output. Together, these actions ensure sensitive data is not exposed while maintaining operational visibility.

Answer

Disable job output entirely for all job templates that use secrets.

Answer

Enable verbose logging on the job template to audit variable usage.

Answer

Store all secrets in an unencrypted file on the automation controller and rely on file permissions.

Question 4

A playbook must write a sensitive token to a remote managed node's /etc/app/token.conf file. The security team requires that the token never appear in plaintext in the playbook or in the controller's job output. The token is stored in an Ansible Vault-encrypted variable file. Which task implementation best meets these requirements?

Accepted Answer

Use the copy module with content: "{{ vault_token }}" and set no_log: true on the task.. The copy module with content and no_log: true ensures the decrypted vault variable is written to the remote file while suppressing sensitive task output. Storing the token only in the vault-encrypted file keeps the playbook free of plaintext. The other approaches either embed the secret in a template or allow the expanded token to be logged, violating the security requirements.

Answer

Use the shell module with a command that echoes the token into the file and redirect the output to /dev/null.

Answer

Use the lineinfile module with line: "token={{ vault_token }}" and rely on Vault encryption alone.

Answer

Use the template module with a Jinja2 template that contains the token literal and add no_log: true.

Question 5

An automation controller administrator needs to ensure that a vault password used by multiple job templates is rotated periodically without editing each job template. Which approach is most efficient and secure?

Accepted Answer

Create a single vault credential, attach it to all relevant job templates, and update the credential when rotating the password.. A shared vault credential in automation controller allows multiple job templates to use the same secret. Rotating the password only requires updating the credential, which automatically applies to all attached job templates. This is both efficient and secure, as the credential is encrypted and access-controlled.

Answer

Store the vault password in a file on the automation controller and reference it from each job template's extra variables.

Answer

Use a separate vault credential for each job template so that rotation can be done independently.

Answer

Embed the vault password in the playbook repository and use a source control webhook to trigger updates.

Question 6

An automation controller administrator must ensure that a job template handling credentials follows security best practices for both storage and execution. Which TWO actions should be taken in automation controller? (Choose two.)

Accepted Answer

Reference the credential from the job template so it is injected at runtime instead of hardcoding it in the playbook.. Automation controller stores credentials encrypted and injects them at run time, so keeping SSH keys in a machine credential and referencing that credential from the job template removes secrets from source control and from static inventories. Together these actions centralize secret storage and limit exposure to the moment of execution, which is the intended best practice.

Answer

Enable the job template option to suppress Ansible output so sensitive data is not written to job logs.

Answer

Grant the operator system administrator role on the organization so they can manage all credentials centrally.

Answer

Mark the job template as prompting for the credential on launch so operators supply secrets interactively.

Question 7

You are preparing an Ansible playbook that will run on a managed node. The playbook includes a task that uses the `ansible.builtin.user` module to create a user. The playbook is stored in a Git repository that multiple engineers can access. You need to ensure that the password for the new user is not stored in plain text in the repository. Which Ansible feature should you use to protect the password?

Accepted Answer

ansible-vault encrypt_string. The password must not be stored in plain text in the Git repository. Using `ansible-vault encrypt_string` allows you to encrypt just the password value and include it inline in the playbook or variables file. At runtime, Ansible decrypts the string using the vault password, so the secret remains protected in version control. The other commands either encrypt entire files or manage vault keys, which do not address an inline secret.

Answer

ansible-vault create

Answer

ansible-vault encrypt

Answer

ansible-vault rekey

Question 8

A playbook must retrieve a secret from an external vault service at runtime instead of storing it in the repository. The team wants the value available as a variable named db_password. Which Ansible feature should be used?

Accepted Answer

A lookup plugin such as community.hashi_vault.hashi_vault referenced in a set_fact task.. Lookup plugins execute on the control node and query external data sources during a play run, which is the supported way to pull secrets from services such as HashiCorp Vault. Assigning the lookup result to a variable with set_fact makes the secret usable by later tasks while keeping it out of the repository entirely.

Answer

An ansible-vault encrypted file committed to the project and decrypted with a password file.

Answer

A fact gathered by the setup module from the managed node's /etc/shadow file.

Answer

A host variable defined in the inventory and marked with no_log on the consuming task.

Question 9

An automation team must ensure that sensitive variables used in playbooks are protected both at rest and during job execution in Ansible Automation Platform. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Mark tasks that use sensitive variables with no_log: true to prevent values from appearing in job output.. Encrypting sensitive variables with Ansible Vault and supplying the vault password via a controller credential protects data at rest, while no_log: true prevents runtime exposure in job output. Plaintext group_vars, verbose logging, and repository-stored vault passwords all undermine security and fail to meet the dual protection requirement.

Answer

Store the vault password in the project repository as a plaintext file for easy access.

Answer

Define sensitive variables in group_vars/all in plaintext so they are available to all hosts.

Answer

Enable verbose logging with -vvv to capture all variable values for auditing.

Question 10

You are using Ansible Automation Platform to manage a large number of servers. You need to ensure that playbooks that run against production servers use a separate set of credentials than those used for development servers. The production credentials must be stored securely and audited. Which Ansible Automation Platform feature should you use to achieve this?

Accepted Answer

Create separate credentials in automation controller and assign them to different job templates based on the environment.. Automation controller credentials are designed for secure storage and auditing. By creating separate credentials for production and development and assigning them to the appropriate job templates, you ensure that each environment uses its own set of secrets. The controller encrypts credentials and logs their usage, providing the required audit trail. The other options either store credentials insecurely or lack centralized management and auditing.

Answer

Use the `--ask-pass` and `--ask-become-pass` options when launching playbooks from the command line.

Answer

Use Ansible Vault to encrypt the production credentials and store them in the playbook repository.

Answer

Configure the production inventory with a separate `ansible_user` and `ansible_ssh_pass` in the inventory file.

Question 11

A playbook uses the `copy` module to distribute a configuration file to managed nodes. The file contains a sensitive API key. You want to ensure the API key is not visible in the playbook source or in Ansible logs. Which approach should you use?

Accepted Answer

Store the API key in a vault-encrypted variable file, reference it in the copy module's content parameter, and set no_log: true on the task.. To protect a sensitive API key, it should be stored encrypted using Ansible Vault and referenced in the playbook without exposing plaintext. Marking the task with no_log: true prevents the secret from appearing in output or logs. Using plaintext variables, hardcoded values, or environment variables without no_log leaves the secret exposed in the playbook source or execution logs, failing the security requirement.

Answer

Store the API key in an environment variable on the control node and use the `lookup` plugin `env` to inject it into the copy module.

Answer

Use the `copy` module with the API key hardcoded in the content parameter and rely on Ansible's automatic log redaction.

Answer

Use the `template` module with a Jinja2 template that includes the API key as a plaintext variable defined in the playbook.

Question 12

You are reviewing an Ansible playbook that uses the `ansible.builtin.shell` module to run a command that includes a sensitive API key as an argument. You want to prevent the API key from being displayed in the job output. Which task-level directive should you add?

Accepted Answer

no_log: true. The `no_log: true` directive on a task suppresses all logging for that task, including the command line and its output. This prevents the sensitive API key from appearing in job output. The other directives control privilege escalation, error handling, or change reporting, none of which affect logging of task details. Therefore, `no_log` is the correct choice.

Answer

changed_when: false

Answer

ignore_errors: true

Answer

become: true

Question 13

An automation team uses Ansible Automation Platform to manage a large number of servers. They need to ensure that sensitive data such as passwords and API keys are not stored in plain text in playbooks or inventory files. They decide to use Ansible Vault to encrypt these secrets. Which of the following best describes how Ansible Vault integrates with playbook execution to protect secrets at runtime?

Accepted Answer

Ansible Vault decrypts secrets on the control node at runtime and passes the decrypted values to managed nodes as needed.. Ansible Vault decrypts encrypted files on the control node when the playbook runs, using the vault password supplied via command line or configuration. The decrypted variables are then used in playbook execution and can be passed to managed nodes as needed. This keeps secrets encrypted at rest in source control while enabling their use in automation. The other options incorrectly place decryption on managed nodes or describe non-existent keyring features.

Answer

Ansible Vault stores secrets in an encrypted keyring on the control node and retrieves them only when explicitly requested by a task.

Answer

Ansible Vault decrypts secrets on the managed node and stores them in memory only during task execution.

Answer

Ansible Vault encrypts secrets on the control node and decrypts them on the managed node using a shared vault password.

Question 14

A Red Hat Certified Engineer is configuring Ansible to run playbooks against managed nodes. The security policy requires that all communication between the control node and managed nodes is encrypted and authenticated. The engineer decides to use SSH keys for authentication. Which Ansible configuration parameter should be set to specify the private key file to use for SSH connections?

Accepted Answer

`ansible_ssh_private_key_file`. To specify a private key file for SSH connections in Ansible, the connection variable `ansible_ssh_private_key_file` is used. It can be set in the inventory, in group_vars, host_vars, or as an extra variable. This ensures that Ansible uses the designated key for authentication, meeting the security policy. The other options either specify a password, username, or additional SSH arguments, none of which directly designate the private key file.

Answer

`ansible_ssh_common_args`

Answer

`ansible_ssh_pass`

Answer

`ansible_user`

Question 15

An automation team uses Ansible Automation Platform to manage secrets. They have a requirement that certain tasks must not log sensitive output to the Ansible logs. Which Ansible task keyword should be used to prevent a task from logging its output?

Accepted Answer

`no_log: true`. The `no_log` keyword is specifically designed to prevent Ansible from logging a task's output. When set to `true`, it suppresses the output that would normally appear in logs, including any sensitive data. This is the recommended approach for tasks that handle passwords, API keys, or other secrets. The other keywords control privilege escalation, error handling, or dry-run mode, none of which address logging of sensitive information.

Answer

`ignore_errors: true`

Answer

`check_mode: true`

Answer

`become: true`