EX294 Implement advanced Ansible automation Practice Question
An administrator needs to securely pass a database password to a playbook without exposing it in logs or the command line. Which approach is the most secure?
⚠ Common exam trap
Many exam-takers confuse `no_log: true` with actual encryption, thinking it hides the secret from all exposure, when in fact it only suppresses output and does not protect the secret from being visible in the process table or module internals.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the password in an Ansible Vault-encrypted variable file and include it.
Ansible Vault encrypts the variable file at rest, and including it via `vars_files` or `include_vars` decrypts it only in memory during playbook execution. This prevents the password from appearing in logs, the command line, or the process table, meeting the security requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Store the password in an Ansible Vault-encrypted variable file and include it.
Why this is correct
Vault encrypts the data, and the vault password is prompted or provided via a vault password file.
- ✗
Set the password in a variable and use 'no_log: true' on tasks that use it.
Why it's wrong here
No_log prevents logging but the variable is still stored in plain text.
- ✗
Store the password in a host_vars file with restricted file permissions.
Why it's wrong here
File permissions do not encrypt the content.
- ✗
Prompt for the password and pass it as an extra variable using -e.
Why it's wrong here
Extra variables are visible in the process list and logs.
Go deeper
Related to this question
About these practice questions
One of 520 original EX294 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This EX294 practice question is part of Courseiva's free Red Hat certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the EX294 exam.