easyMultiple ChoiceObjective-mapped
200-901 Practice Question: Uses Ansible for configuration management and…
An organization uses Ansible for configuration management and wants to secure the automation secrets (e.g., SSH keys, API tokens). The secrets are currently stored in plaintext in inventory files. The security team requires that secrets be encrypted at rest and decrypted only at runtime by authorized users. Which solution should be implemented?
⚠ Common exam trap
Cisco often tests the distinction between access control (file permissions) and encryption at rest, leading candidates to mistakenly choose strict permissions as sufficient for securing secrets, when encryption is required to protect data from unauthorized access even if the file system is compromised.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Ansible Vault to encrypt sensitive variables in the inventory files
Ansible Vault is the built-in tool for encrypting sensitive data such as passwords, API tokens, and SSH keys at rest. It encrypts variables or entire files using AES-256, and decryption occurs only at runtime when the correct vault password is provided, meeting the requirement that secrets are decrypted only by authorized users.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store secrets in an encrypted SSH key file and use it for authentication
Why it's wrong here
SSH keys are for authentication, not for storing arbitrary secrets.
- ✗
Set strict file permissions (0600) on the inventory files to limit access
Why it's wrong here
File permissions do not protect secrets from being read by processes running as the owner or root.
- ✗
Use environment variables to pass secrets at runtime
Why it's wrong here
Environment variables can be visible in process information and logs, and are not encrypted at rest.
- ✓
Use Ansible Vault to encrypt sensitive variables in the inventory files
Why this is correct
Ansible Vault encrypts data and only decrypts it when the vault password is provided, securing secrets at rest.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-901 question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.