Ansible Automation Quality Control & Assurance 5 — Questions and Answers
Question 1: Which approach helps catch regressions when updating shared Ansible roles used by multiple teams?
- Running only the updated playbook manually
- Tagging role versions and running Molecule tests in CI before releasing a new version (Correct answer)
- Notifying teams via email after deployment
- Using `ignore_errors: true` globally
Correct answer: Tagging role versions and running Molecule tests in CI before releasing a new version
Version-tagging roles and gating releases behind automated Molecule tests in CI ensures changes don't silently break consumers of shared roles.
Question 2: What does the `delegate_to: localhost` pattern enable in a quality assurance workflow?
- Runs a task on the control node instead of the managed host, useful for API calls or local checks (Correct answer)
- Forces a task to run as a local user
- Copies files from the managed host to localhost
- Enables faster SSH connections
Correct answer: Runs a task on the control node instead of the managed host, useful for API calls or local checks
`delegate_to: localhost` redirects task execution to the Ansible control node, commonly used for calling external APIs or running local validation scripts.
Question 3: Which Ansible-lint profile provides the strictest set of rules for enterprise-grade playbook quality?
- min
- basic
- safety (Correct answer)
- shared
Correct answer: safety
The `safety` profile enforces rules focused on preventing dangerous patterns and is recommended for production-grade Ansible code.
Question 4: What is the function of `meta: flush_handlers` in a quality assurance context?
- Clears all registered variables
- Forces all pending handlers to run immediately at that point in the play (Correct answer)
- Resets the host connection
- Marks all previous tasks as skipped
Correct answer: Forces all pending handlers to run immediately at that point in the play
`meta: flush_handlers` triggers queued handlers immediately rather than waiting until the end of the play, enabling mid-play service restarts followed by verification tasks.
Question 5: In Ansible Tower / AWX, which feature allows automated quality gate enforcement before a job template runs in production?
- Approval workflows on job templates (Correct answer)
- Credential rotation
- Dynamic inventory
- Survey prompts
Correct answer: Approval workflows on job templates
Approval workflows require a designated user or team to manually approve a job before it executes, providing a human quality gate for critical environments.
Question 6: Which best practice reduces the risk of variable injection attacks in Ansible playbooks?
- Using `vars_prompt` with `private: yes` for all variables
- Avoiding `extra_vars` from untrusted sources and validating all external inputs with `assert` (Correct answer)
- Disabling fact gathering to reduce attack surface
- Running all plays with `become: no`
Correct answer: Avoiding `extra_vars` from untrusted sources and validating all external inputs with `assert`
Extra vars have the highest precedence and can override any variable, so untrusted inputs must be sanitized and validated with `assert` before use.
Question 7: What does a green `ok` status (vs `changed`) on a task indicate from a quality assurance perspective?
- The task was skipped due to a `when` condition
- The system was already in the desired state — the role is idempotent for that task (Correct answer)
- The task succeeded but made changes
- The task requires a handler to complete
Correct answer: The system was already in the desired state — the role is idempotent for that task
An `ok` status means the module checked the current state and found it already matched the desired state, confirming idempotency for that task.
Ansible Automation Quality Control & Assurance 5
Which approach helps catch regressions when updating shared Ansible roles used by multiple teams?