Manage automation security and operations practice questions

The remote user specified in the credential does not have sudo access.

Why wrong: Incorrect. Missing sudo access would cause a privilege escalation failure (e.g., 'Permission denied' or 'Missing sudo password'), not an 'UNREACHABLE' status. The host would still be reachable.

The custom execution environment is missing the 'python3' or 'python' package.

Why wrong: Incorrect. Missing 'python3' or 'python' on the managed node would cause a module execution failure (e.g., 'FAILED! => {"msg": "...python in path..."}'), not an 'UNREACHABLE' status. The ping module itself does not require Python on the remote host; it uses raw SSH.

The automation controller is behind a firewall that blocks SSH.

Why wrong: Incorrect. If a firewall blocked SSH, the administrator would not have verified SSH connectivity. Since SSH is reachable, this is not the cause.

Vault-encrypt the variable in the playbook and reference it with {{ vault_var }}.

Why wrong: Vault encryption protects the value at rest but does not hide it from job output when passed as an extra variable.

Create a custom credential type that injects the token as an environment variable, and remove the extra variable from the job template.

Why wrong: This is a good practice but does not address the existing extra variable; the token would still be visible if the extra variable remains.

Store the token in a file on the controller with 600 permissions and use 'lookup' in the playbook.

Why wrong: This does not prevent the token from being displayed in job output if it is used as a variable without no_log.

Increase the 'retries' parameter for each task.

Why wrong: Retries handle transient failures but do not extend the time allowed for a single connection.

Increase the 'forks' value in ansible.cfg to 50.

Why wrong: Forks control the number of parallel connections, not timeout behavior.

Set 'async: 600' and 'poll: 10' in the playbook.

Why wrong: Async/poll is for long-running tasks, not for general connection timeouts.

Use an inventory that contains only the allowed hosts.

Why wrong: Inventory does not restrict which playbooks can be run.

Configure an execution environment that mounts the authorized directory as read-only.

Why wrong: Execution environments provide runtime dependencies, not execution path restrictions.

Assign the service account a machine credential that connects to the controller via SSH.

Why wrong: Machine credentials provide authentication, not path restrictions.

The become method is set to 'su' instead of 'sudo'.

Why wrong: The playbook works manually, so the become method is correct.

The remote user is not in the sudoers file.

Why wrong: If the user were not in sudoers, the manual run would also fail.

The SSH private key is not loaded into the automation controller.

Why wrong: The administrator configured a machine credential with the SSH key, and manual SSH works.

Set 'stdout_callback = actionable' in ansible.cfg.

Why wrong: This changes callback but does not hide sensitive data.

Use 'name: "Sensitive task"' but keep the task body visible.

Why wrong: The task name does not hide output.

Add 'display_args_to_stdout = false' to the execution environment's ansible.cfg.

Why wrong: This is not a valid Ansible configuration option. There is no 'display_args_to_stdout' setting in ansible.cfg. The only mechanism to hide sensitive data is 'no_log'.

Use 'tags: never' on sensitive tasks.

Why wrong: Tags control task execution, not output visibility.

Use a custom execution environment that writes artifacts to a network share.

Why wrong: Network shares could be in another region, violating the policy.

Configure automation mesh to route jobs to the nearest execution node.

Why wrong: Mesh routing does not control artifact storage location.

Remove the 'env' task from the playbook and ensure no other tasks print environment variables.

Why wrong: This does not prevent future accidental exposure; the root cause is lack of no_log on the credential type.

Configure the automation controller's 'Settings' to enable 'Display secrets' = false.

Why wrong: There is no such global setting; secrets are hidden only if no_log is set on the specific variable.

Change the custom credential type to use the built-in 'Vault password' credential type and remove the custom credential type.

Why wrong: The built-in vault password credential type still injects the password as a variable that can be printed if not protected.

Verify the file permissions are set to 600.

Why wrong: File permissions do not affect Ansible vault decryption.

Check that the SSH private key has access to the managed node.

Why wrong: SSH key is not related to vault decryption.

Make sure the vault password file contains the path to the vault file.

Why wrong: Vault password file should contain the password, not the file path.

The 'become' privilege escalation is not configured, so the tasks cannot modify system files.

Why wrong: If become was not working, tasks would fail with permission errors, not report changed=0.

The playbook was run with the '--check' flag, which simulates changes without applying them.

Why wrong: If run with --check, the output would indicate 'check mode' and not actual changes; but the scenario says 'changed=0', which means actual run.

The Ansible modules used in the role are not installed on the control node.

Why wrong: If modules were missing, the playbook would fail with an error, not report changed=0.

Build the image using podman build, then create a Dockerfile, then run the container using podman run, then list images using podman images, then verify the container is running using podman ps.

Why wrong: This is incorrect because you cannot build an image without first having a Dockerfile. The Dockerfile must be created before building the image.

Create a Dockerfile, then list images using podman images, then build the image using podman build, then run the container using podman run, then verify the container is running using podman ps.

Why wrong: This is incorrect because listing images before building them is pointless as no images exist yet. The build step must come before listing.

Run the container using podman run, then create a Dockerfile, then build the image using podman build, then list images using podman images, then verify the container is running using podman ps.

Why wrong: This is incorrect because you cannot run a container without an image. The image must be built first.

ls: Displays file contents

Why wrong: Incorrect — ls lists directory contents, not file contents. The command to display file contents is cat.

cp: Moves files

Why wrong: Incorrect — cp copies files; the command to move files is mv.

Ansible Collections

Why wrong: Collections are module packages, not for secret storage.

Ansible Fact Cache

Why wrong: Fact cache caches gathered facts, not secrets.

Ansible Galaxy

Why wrong: Galaxy distributes roles/collections, not for secrets.

The playbook lacks a hosts line

Why wrong: Missing hosts causes a different error.

The become directive is misspelled

Why wrong: The correct attribute name is 'become', not misspelling.

become is allowed only in tasks, not plays

Why wrong: become can be set at play level.

Assign each team to an organization and set organization-level permissions

Why wrong: Organization permissions grant too broad access.

Set 'allow simultaneous' to false on job templates

Why wrong: That controls concurrent runs, not access.

Use an Identity Provider (IdP) to restrict access

Why wrong: IdP handles authentication only.

ansible-vault rekey

Why wrong: Changes the vault password.

ansible-vault create

Why wrong: Creates a new vault file, not encrypt a string.

ansible-vault edit

Why wrong: Edits an existing vault, not encrypt a string.

Add the 'ignore_errors: yes' directive

Why wrong: Suppresses errors, does not identify source.

Set environment variable ANSIBLE_DEBUG=1

Why wrong: Increases verbosity but may be too noisy.

Use the --syntax-check flag

Why wrong: Only checks syntax, not variable values.

Set the execution_environment_image variable in the playbook

Why wrong: That specifies the image name, not registry authentication.

Configure the execution environment in the inventory

Why wrong: Inventory does not set execution environment configuration.

Add the registry to the project's source control

Why wrong: Source control does not manage registry authentication.

The forks parameter in the playbook

Why wrong: Forks controls parallel tasks, not jobs.

The job template's 'allow simultaneous' option

Why wrong: Controls concurrent runs of the same template.

The number of execution environments

Why wrong: Execution environments are not a job throttle.

validate_certs

Why wrong: Controls SSL certificate validation, not timeout.

retries

Why wrong: Used in loop retry, not connection timeout.

delay

Why wrong: Used in loop delays, not timeout.