Ansible Authentication Failed: SSH Credentials
Exhibit
Refer to the exhibit. Error: 'Failed to authenticate to device 192.168.1.100:22'
Refer to the exhibit. An Ansible playbook targeting a Cisco IOS device fails with this error. What is the most likely cause?
Quick Answer
The answer is wrong SSH username or password. This is the most likely cause because when Ansible authentication fails over SSH, it directly indicates that the credentials provided in the playbook—typically set via `ansible_user` and `ansible_ssh_pass` or `ansible_password`—do not match what the Cisco IOS device expects, resulting in a "Permission denied" or "Authentication failed" error. On the Cisco DevNet Associate 200-901 exam, this scenario tests your understanding of how Ansible manages SSH connectivity to network devices, often appearing in troubleshooting questions where the playbook syntax is correct but the credentials are mismatched. A common trap is assuming the error is due to network reachability or SSH key issues, but the explicit failure message points directly to credential mismatch. Remember the mnemonic: "Auth fails, check the user and pails" — meaning verify both `ansible_user` and the password variable.
⚠ Common exam trap
Cisco often tests the distinction between connectivity errors (unreachable) and authentication errors (wrong credentials), where candidates mistakenly attribute a failed SSH authentication to a network reachability issue.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Wrong SSH username or password
The error message in Ansible typically indicates an authentication failure when connecting to the Cisco IOS device via SSH. Option D is correct because the playbook likely specifies incorrect SSH credentials (username or password), preventing Ansible from authenticating with the device. Ansible uses the `ansible_user` and `ansible_ssh_pass` or `ansible_password` variables for SSH authentication, and a mismatch will cause a 'Authentication failed' or 'Permission denied' error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The device is unreachable
Why it's wrong here
Unreachable would give a different error.
- ✗
The playbook syntax is incorrect
Why it's wrong here
Syntax errors would occur before connection.
- ✗
The device is not running IOS
Why it's wrong here
Would not cause auth failure.
- ✓
Wrong SSH username or password
Why this is correct
Authentication failure points to credentials.
Go deeper
Related to this question
About these practice questions
One of 989 original 200-901 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-901
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are a network automation engineer at a large enterprise. The network consists of 200 Cisco Catalyst switches distributed across five data centers. Each switch runs IOS-XE and supports NETCONF. Your team uses a centralized Ansible control node to manage configurations. Recently, the security team mandated that all management access must use SSH keys instead of passwords. You updated the Ansible inventory to use SSH keys and tested on a few switches successfully. However, when you run the playbook against all switches, about 30 switches fail with the error: 'Authentication failed.' You verify that the SSH public key is correctly deployed on those switches via the console. What is the most likely cause of the failure?
hard- A.The public key on the switches is not in the correct format
- B.The Ansible become method is misconfigured
- ✓ C.The private key file on the Ansible control node has permissions 644, which SSH rejects
- D.The switches are not reachable over the network
Why C: SSH strictly requires private key files to have permissions no more permissive than 600 (owner read/write) or 640 (owner read/write, group read) on Unix-like systems. A permission of 644 allows group and others to read the key, which SSH interprets as insecure and refuses to use, causing 'Authentication failed' even though the public key is correctly deployed on the switches.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.