Ansible Automation Regulatory Frameworks & Compliance 3 — Questions and Answers
Question 1: Which Ansible module should be used to validate that SSH daemon configuration on a managed host meets STIG V-72251 (PermitRootLogin disabled)?
- ansible.builtin.service
- ansible.builtin.lineinfile (Correct answer)
- ansible.builtin.copy
- ansible.builtin.ping
Correct answer: ansible.builtin.lineinfile
The lineinfile module can both check and enforce specific configuration lines in sshd_config, satisfying STIG SSH hardening requirements.
Question 2: A compliance requirement mandates that all file transfers to production systems be encrypted in transit. Which Ansible connection plugin ensures this?
- local
- paramiko
- ssh (default) (Correct answer)
- httpapi without TLS
Correct answer: ssh (default)
Ansible's default SSH connection plugin encrypts all communication in transit, satisfying in-transit encryption compliance requirements.
Question 3: Under GDPR Article 32, organizations must implement pseudonymization where appropriate. How can Ansible support this technical measure?
- By storing all data in Ansible facts
- By automating deployment of tokenization services and enforcing their use via configuration management (Correct answer)
- By using no_log: true on every task
- By disabling logging on all managed nodes
Correct answer: By automating deployment of tokenization services and enforcing their use via configuration management
Ansible can automate the deployment and configuration of tokenization or pseudonymization services, making their use consistent and auditable.
Question 4: Which Tower/AWX feature helps satisfy the NIST 800-53 CM-3 (Configuration Change Control) requirement for production changes?
- Job Templates with approval workflows before execution (Correct answer)
- Ad-hoc commands run directly on the CLI
- Disabling job logging to reduce storage
- Using the 'raw' module for all changes
Correct answer: Job Templates with approval workflows before execution
Tower's approval workflows require human sign-off before job templates run, providing the change control gate required by CM-3.
Question 5: An Ansible playbook is used to enforce password complexity on Linux systems per CIS Benchmark 5.3.1. Which file is most commonly targeted?
- /etc/passwd
- /etc/pam.d/common-password or /etc/security/pwquality.conf (Correct answer)
- /etc/shadow
- /etc/group
Correct answer: /etc/pam.d/common-password or /etc/security/pwquality.conf
Password complexity policies are configured in PAM's password stack files or pwquality.conf, which Ansible manages with lineinfile or template modules.
Question 6: To comply with ISO 27001 A.12.1.2 (Change Management), which Ansible practice is most important?
- Running all playbooks as root without logging
- Version-controlling all playbooks and linking playbook runs to change tickets (Correct answer)
- Using only ad-hoc Ansible commands for speed
- Skipping handlers to reduce change surface
Correct answer: Version-controlling all playbooks and linking playbook runs to change tickets
ISO 27001 A.12.1.2 requires documented, authorized changes; linking versioned playbooks to change tickets creates the required audit trail.
Question 7: Which Ansible feature prevents sensitive compliance-related data (such as database passwords) from appearing in Tower job output logs?
- become: yes
- no_log: true on individual tasks (Correct answer)
- gather_facts: false
- serial: 1 in play header
Correct answer: no_log: true on individual tasks
Setting no_log: true on a task suppresses its output from all logs, preventing sensitive values from appearing in job records.
Ansible Automation Regulatory Frameworks & Compliance 3
Which Ansible module should be used to validate that SSH daemon configuration on a managed host meets STIG V-72251 (PermitRootLogin disabled)?