EX294 Implement advanced Ansible automation Practice Question
An administrator needs to securely pass a database password to a playbook without exposing it in logs or the command line. Which approach is the most secure?
⚠ Common exam trap
Many exam-takers confuse `no_log: true` with actual encryption, thinking it hides the secret from all exposure, when in fact it only suppresses output and does not protect the secret from being visible in the process table or module internals.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the password in an Ansible Vault-encrypted variable file and include it.
Ansible Vault encrypts the variable file at rest, and including it via `vars_files` or `include_vars` decrypts it only in memory during playbook execution. This prevents the password from appearing in logs, the command line, or the process table, meeting the security requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Store the password in an Ansible Vault-encrypted variable file and include it.
Why this is correct
Ansible Vault encrypts the variable file at rest with AES-256, so the password is decrypted only in memory during playbook execution and never appears in logs, process listings or command-line arguments. This satisfies the stem's requirement to avoid exposure in logs or on the command line.
- ✗
Set the password in a variable and use 'no_log: true' on tasks that use it.
Why it's wrong here
no_log suppresses task output but the password still sits in plaintext within the playbook and variable files, so it remains readable on disk and in version control. It is tempting because no_log genuinely hides task output, yet Ansible Vault encrypting the value is what actually protects it at rest.
- ✗
Store the password in a host_vars file with restricted file permissions.
Why it's wrong here
Plaintext host_vars files are readable by anyone with repository or filesystem access, and Ansible logs variable values during playbook runs, so the password leaks. It tempts administrators wanting version-controlled, per-host configuration; that suits non-sensitive settings, not secrets requiring encryption at rest.
- ✗
Prompt for the password and pass it as an extra variable using -e.
Why it's wrong here
Passing secrets via -e exposes them in shell history, process listings and Ansible output, defeating the requirement. It tempts because extra variables are quick and override precedence cleanly; that suits non-sensitive runtime parameters, whereas vault-encrypted variables keep secrets out of logs and command lines.
Go deeper
Related to this question
About these practice questions
One of 392 original EX294 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This EX294 practice question is part of Courseiva's free Red Hat certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the EX294 exam.