Ansible Automation Regulatory Frameworks & Compliance 3

Question 1

Which Ansible module should be used to validate that SSH daemon configuration on a managed host meets STIG V-72251 (PermitRootLogin disabled)?

Accepted Answer

ansible.builtin.lineinfile

Answer

The lineinfile module can both check and enforce specific configuration lines in sshd_config, satisfying STIG SSH hardening requirements.

Question 2

A compliance requirement mandates that all file transfers to production systems be encrypted in transit. Which Ansible connection plugin ensures this?

Accepted Answer

ssh (default)

Answer

Ansible's default SSH connection plugin encrypts all communication in transit, satisfying in-transit encryption compliance requirements.

Question 3

Under GDPR Article 32, organizations must implement pseudonymization where appropriate. How can Ansible support this technical measure?

Accepted Answer

By automating deployment of tokenization services and enforcing their use via configuration management

Answer

Ansible can automate the deployment and configuration of tokenization or pseudonymization services, making their use consistent and auditable.

Question 4

Which Tower/AWX feature helps satisfy the NIST 800-53 CM-3 (Configuration Change Control) requirement for production changes?

Accepted Answer

Job Templates with approval workflows before execution

Answer

Tower's approval workflows require human sign-off before job templates run, providing the change control gate required by CM-3.

Question 5

An Ansible playbook is used to enforce password complexity on Linux systems per CIS Benchmark 5.3.1. Which file is most commonly targeted?

Accepted Answer

/etc/pam.d/common-password or /etc/security/pwquality.conf

Answer

Password complexity policies are configured in PAM's password stack files or pwquality.conf, which Ansible manages with lineinfile or template modules.

Ansible Automation Practice Test

Ansible Automation Practice Test

Ansible Automation Regulatory Frameworks & Compliance 3