mediumMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A DevOps team uses Ansible to automate server…
A DevOps team uses Ansible to automate server configuration. They need to ensure that sensitive variables like passwords are not exposed in playbook logs or version control. What is the recommended approach?
⚠ Common exam trap
The CAS-004 exam often tests the distinction between encrypting the entire playbook versus selectively encrypting sensitive variables, tempting candidates to choose 'encrypt the whole file' as a stronger security measure, but the recommended approach is to use Ansible Vault for targeted encryption to maintain readability and operational flexibility.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Ansible Vault to encrypt sensitive variables
Ansible Vault is the built-in mechanism for encrypting sensitive data such as passwords, API keys, and certificates within Ansible projects. It encrypts variables or files at rest using AES-256, and the vault password is provided at runtime (e.g., via --ask-vault-pass or a vault password file), ensuring secrets are never stored in plaintext in playbook logs or version control. This approach integrates seamlessly with Ansible's workflow without requiring external tools or compromising automation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use Ansible Vault to encrypt sensitive variables
Why this is correct
Ansible Vault encrypts specific variables or files, protecting secrets.
- ✗
Use environment variables only
Why it's wrong here
Environment variables can be leaked in logs or process listings.
- ✗
Store secrets in plain text within the playbook
Why it's wrong here
Plain text exposes secrets to anyone with access to the playbook or logs.
- ✗
Encrypt the entire playbook file
Why it's wrong here
Encrypting the entire playbook is cumbersome and not targeted.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
One of 968 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.