Ansible Automation Regulatory Frameworks & Compliance 2 — Questions and Answers
Question 1: Which Ansible feature allows you to define and enforce that only specific users or service accounts can execute playbooks against PCI-DSS scoped systems?
- Ansible Vault encryption
- Role-Based Access Control in Ansible Tower/AWX (Correct answer)
- Ansible callback plugins
- inventory host variables
Correct answer: Role-Based Access Control in Ansible Tower/AWX
Ansible Tower/AWX provides RBAC so that only authorized users can run jobs against sensitive PCI-DSS in-scope hosts.
Question 2: Under HIPAA's Technical Safeguard requirements, which Ansible practice best satisfies the 'audit controls' standard?
- Using no_log: true on all tasks
- Storing playbook output in an immutable, timestamped job log in Tower/AWX (Correct answer)
- Disabling SSH agent forwarding
- Using community roles from Ansible Galaxy
Correct answer: Storing playbook output in an immutable, timestamped job log in Tower/AWX
HIPAA audit controls require recording and examining system activity; Tower's immutable job logs satisfy this requirement.
Question 3: A SOC 2 Type II audit requires evidence of change management. Which Ansible artifact best demonstrates a controlled change process?
- Ad-hoc command history in ~/.bash_history
- Git commit history tied to playbook runs logged in Tower (Correct answer)
- Ansible fact caching files on managed nodes
- The /etc/ansible/hosts static inventory file
Correct answer: Git commit history tied to playbook runs logged in Tower
Git-backed playbooks with Tower job logs provide an auditable chain linking approved code changes to actual system changes.
Question 4: Which Ansible Vault operation should be performed when a team member with access to encrypted secrets leaves the organization, per least-privilege compliance requirements?
- ansible-vault view
- ansible-vault rekey (Correct answer)
- ansible-vault decrypt then re-encrypt
- ansible-vault encrypt_string
Correct answer: ansible-vault rekey
ansible-vault rekey changes the encryption password, revoking access for anyone who knew the old password.
Question 5: The NIST 800-53 AC-2 control requires account management. How can Ansible help automate compliance with this control?
- By disabling all local user accounts on managed nodes
- By running playbooks that enforce approved user lists and remove unauthorized accounts on a schedule (Correct answer)
- By storing user credentials in Ansible Vault only
- By using the 'command' module to list all users
Correct answer: By running playbooks that enforce approved user lists and remove unauthorized accounts on a schedule
Scheduled Ansible playbooks can continuously reconcile user accounts against an approved list, satisfying AC-2's continuous management requirement.
Question 6: Which Ansible module is most appropriate for ensuring firewall rules meet CIS Benchmark requirements on RHEL systems?
- ansible.builtin.command
- ansible.posix.firewalld (Correct answer)
- ansible.builtin.raw
- community.general.ufw
Correct answer: ansible.posix.firewalld
The ansible.posix.firewalld module manages firewalld rules idempotently on RHEL/CentOS, aligning with CIS firewall hardening benchmarks.
Question 7: When using Ansible to automate FedRAMP compliance checks, which inventory approach best supports multi-authorization boundary scanning?
- A single flat hosts file with all systems
- Dynamic inventory grouped by authorization boundary with separate limit flags per playbook run (Correct answer)
- Hardcoded IP addresses in playbook vars
- Using localhost as a proxy for all remote checks
Correct answer: Dynamic inventory grouped by authorization boundary with separate limit flags per playbook run
Dynamic inventory grouped by authorization boundary lets teams scope playbook runs precisely to each FedRAMP boundary without cross-contamination.
Ansible Automation Regulatory Frameworks & Compliance 2
Which Ansible feature allows you to define and enforce that only specific users or service accounts can execute playbooks against PCI-DSS scoped systems?