Ansible Automation Ansible Vault and Secrets Management

Question 1

What is the primary purpose of Ansible Vault?

Accepted Answer

To encrypt sensitive data such as passwords, API keys, and certificates within Ansible files

Answer

Ansible Vault encrypts sensitive content in files or individual strings, allowing secrets to be safely stored in version control.

Question 2

What command creates a new encrypted Ansible Vault file?

Accepted Answer

ansible-vault create secrets.yml

Answer

'ansible-vault create' opens an editor to create a new file that is encrypted on save.

Question 3

How do you run a playbook that uses Ansible Vault-encrypted files?

Accepted Answer

ansible-playbook site.yml --ask-vault-pass

Answer

'--ask-vault-pass' prompts for the vault password interactively at runtime, which is used to decrypt vault-protected content.

Question 4

What is the difference between encrypting an entire file with Ansible Vault versus using 'vault encrypted strings'?

Accepted Answer

Encrypting entire files protects all content; vault encrypted strings (ansible-vault encrypt_string) encrypt individual values while the rest of the file remains readable

Answer

Vault encrypted strings allow mixing encrypted and plaintext variables in a single file, improving readability while protecting only sensitive values.

Question 5

What is Ansible Vault's 'vault-id' feature used for?

Accepted Answer

It allows multiple vault passwords to be used simultaneously, labeling which password decrypts which content

Answer

Vault IDs enable multi-password scenarios, where different secrets can be encrypted with different passwords, useful for different environments or teams.

Ansible Automation Practice Test

Ansible Automation Practice Test

Ansible Automation Ansible Vault and Secrets Management