EX294 Manage automation security and operations Practice Question
An Ansible automation controller job template uses a custom credential type that requires a secret token. The token is stored as an extra variable in the job template definition. A security audit reveals the token is visible in plaintext in the job output. Which action should the administrator take to secure the secret?
⚠ Common exam trap
Many candidates assume vault encryption alone hides secrets in output, but vault only encrypts at rest; Ansible decrypts at runtime and the plaintext can still appear in logs unless `no_log` is explicitly set.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define the variable in the job template's 'extra variables' field with 'no_log: true' set in the playbook for that variable.
Setting `no_log: true` on the variable in the playbook prevents Ansible from printing the value of that variable in any output, including job logs. This is the standard method to hide sensitive data like tokens when they are passed as extra variables, as it works at the task level to suppress logging of the variable's content.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Define the variable in the job template's 'extra variables' field with 'no_log: true' set in the playbook for that variable.
Why this is correct
Setting no_log on the variable prevents it from being displayed in logs and job output, meeting the security requirement.
- ✗
Vault-encrypt the variable in the playbook and reference it with {{ vault_var }}.
Why it's wrong here
Vault encryption protects the value at rest but does not hide it from job output when passed as an extra variable.
- ✗
Create a custom credential type that injects the token as an environment variable, and remove the extra variable from the job template.
Why it's wrong here
This is a good practice but does not address the existing extra variable; the token would still be visible if the extra variable remains.
- ✗
Store the token in a file on the controller with 600 permissions and use 'lookup' in the playbook.
Why it's wrong here
This does not prevent the token from being displayed in job output if it is used as a variable without no_log.
Go deeper
Related to this question
About these practice questions
This EX294 question is part of Courseiva's 520-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This EX294 practice question is part of Courseiva's free Red Hat certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the EX294 exam.