Ansible Automation Ansible Vault and Secrets Management 2

Question 1

What encryption algorithm does Ansible Vault use by default?

Accepted Answer

AES-256 (specifically AES256-CTR with PBKDF2 key derivation)

Answer

Ansible Vault uses AES-256 encryption (AES256-CTR mode) with PBKDF2 for key derivation from the vault password.

Question 2

How can you view the contents of an Ansible Vault-encrypted file without decrypting it permanently?

Accepted Answer

ansible-vault view secrets.yml

Answer

'ansible-vault view' decrypts and displays the file contents to stdout without writing the decrypted file to disk.

Question 3

What best practice should be followed when storing Ansible Vault password files on disk?

Accepted Answer

The password file should have restricted permissions (mode 0600), be owned by the ansible user, and never be committed to version control

Answer

Vault password files must be protected with strict file permissions and should never be stored in version-controlled directories.

Question 4

Which Ansible Vault command permanently decrypts a vault-encrypted file to plaintext?

Accepted Answer

ansible-vault decrypt secrets.yml

Answer

'ansible-vault decrypt' decrypts the file in-place, converting it to plaintext YAML on disk—use with caution.

Question 5

How do you integrate Ansible Vault with an external secrets manager like HashiCorp Vault?

Accepted Answer

Use a vault password script that retrieves the password from HashiCorp Vault at runtime via its API

Answer

A vault password script dynamically retrieves the Ansible Vault password from HashiCorp Vault at playbook runtime, combining both secret management systems.

Ansible Automation Practice Test

Ansible Automation Practice Test

Ansible Automation Ansible Vault and Secrets Management 2