Ansible Automation Regulatory Frameworks & Compliance 2

Question 1

Which Ansible feature allows you to define and enforce that only specific users or service accounts can execute playbooks against PCI-DSS scoped systems?

Accepted Answer

Role-Based Access Control in Ansible Tower/AWX

Answer

Ansible Tower/AWX provides RBAC so that only authorized users can run jobs against sensitive PCI-DSS in-scope hosts.

Question 2

Under HIPAA's Technical Safeguard requirements, which Ansible practice best satisfies the 'audit controls' standard?

Accepted Answer

Storing playbook output in an immutable, timestamped job log in Tower/AWX

Answer

HIPAA audit controls require recording and examining system activity; Tower's immutable job logs satisfy this requirement.

Question 3

A SOC 2 Type II audit requires evidence of change management. Which Ansible artifact best demonstrates a controlled change process?

Accepted Answer

Git commit history tied to playbook runs logged in Tower

Answer

Git-backed playbooks with Tower job logs provide an auditable chain linking approved code changes to actual system changes.

Question 4

Which Ansible Vault operation should be performed when a team member with access to encrypted secrets leaves the organization, per least-privilege compliance requirements?

Accepted Answer

ansible-vault rekey

Answer

ansible-vault rekey changes the encryption password, revoking access for anyone who knew the old password.

Question 5

The NIST 800-53 AC-2 control requires account management. How can Ansible help automate compliance with this control?

Accepted Answer

By running playbooks that enforce approved user lists and remove unauthorized accounts on a schedule

Answer

Scheduled Ansible playbooks can continuously reconcile user accounts against an approved list, satisfying AC-2's continuous management requirement.

Ansible Automation Practice Test

Ansible Automation Practice Test

Ansible Automation Regulatory Frameworks & Compliance 2