Ansible Automation Ansible Vault and Secrets Management 2

Question 1

What encryption algorithm does Ansible Vault use by default?

Accepted Answer

AES-256 (specifically AES256-CTR with PBKDF2 key derivation)

Answer

RSA-2048

Answer

3DES

Answer

ChaCha20-Poly1305

Question 2

How can you view the contents of an Ansible Vault-encrypted file without decrypting it permanently?

Accepted Answer

ansible-vault view secrets.yml

Answer

ansible-vault read secrets.yml

Answer

ansible-vault cat secrets.yml

Answer

ansible-vault show secrets.yml

Question 3

What best practice should be followed when storing Ansible Vault password files on disk?

Accepted Answer

The password file should have restricted permissions (mode 0600), be owned by the ansible user, and never be committed to version control

Answer

The password file should be stored in the playbook directory for easy access

Answer

The password file should be encrypted with GPG for double encryption

Answer

The password file should be stored in /etc/ansible/ with world-readable permissions

Question 4

Which Ansible Vault command permanently decrypts a vault-encrypted file to plaintext?

Accepted Answer

ansible-vault decrypt secrets.yml

Answer

ansible-vault remove secrets.yml

Answer

ansible-vault unprotect secrets.yml

Answer

ansible-vault plaintext secrets.yml

Question 5

How do you integrate Ansible Vault with an external secrets manager like HashiCorp Vault?

Accepted Answer

Use a vault password script that retrieves the password from HashiCorp Vault at runtime via its API

Answer

Ansible has native HashiCorp Vault integration via the 'hashicorp_vault' module

Answer

Use the 'community.hashi_vault' lookup plugin to fetch secrets directly without Ansible Vault

Answer

Configure the VAULT_ADDR environment variable and Ansible will automatically connect

Question 6

What does the 'no_log: true' directive do in an Ansible task?

Accepted Answer

It prevents task arguments and output from being logged to stdout and Ansible log files, protecting sensitive data

Answer

It disables system logging on the managed host for the duration of the task

Answer

It prevents the task from writing to syslog on the control node

Answer

It suppresses all output including errors and failures