Ansible Automation Regulatory Frameworks & Compliance 4 — Questions and Answers
Question 1: A PCI-DSS Requirement 6.4 mandates that only authorized changes are deployed to production. Which Ansible Tower feature directly enforces this?
- Custom credential types
- Workflow job templates with approval nodes (Correct answer)
- Smart inventories
- Ansible facts caching
Correct answer: Workflow job templates with approval nodes
Workflow job templates with approval nodes create mandatory human-review gates before production deployment steps execute.
Question 2: The DISA STIG for RHEL 8 requires auditd to be running and enabled. Which Ansible task structure correctly enforces this?
- Using command: systemctl status auditd
- Using ansible.builtin.service with state: started and enabled: true (Correct answer)
- Using ansible.builtin.shell: auditd &
- Using ansible.builtin.raw: service auditd start
Correct answer: Using ansible.builtin.service with state: started and enabled: true
The ansible.builtin.service module with state: started and enabled: true idempotently ensures auditd runs now and persists across reboots.
Question 3: Which compliance framework specifically categorizes controls into 'Preventive', 'Detective', and 'Corrective' types, and how does Ansible best support the 'Corrective' category?
- PCI-DSS; by encrypting cardholder data
- COBIT/SOC 2; by running remediation playbooks automatically when a compliance check fails (Correct answer)
- HIPAA; by enforcing audit logs
- NIST 800-171; by disabling USB ports
Correct answer: COBIT/SOC 2; by running remediation playbooks automatically when a compliance check fails
SOC 2 and COBIT use preventive/detective/corrective classifications; Ansible remediates detected drift automatically, fulfilling the corrective control role.
Question 4: Under NIST 800-53 SI-2 (Flaw Remediation), organizations must patch vulnerabilities within defined timeframes. How should Ansible Tower be configured to support this?
- Run patching playbooks manually on request only
- Schedule recurring patching job templates with maintenance window schedules and notify on failure (Correct answer)
- Disable automatic updates to maintain stability
- Use only the 'command: yum update' approach
Correct answer: Schedule recurring patching job templates with maintenance window schedules and notify on failure
Scheduled Tower jobs with failure notifications ensure patches are applied within required timeframes and exceptions are escalated automatically.
Question 5: A security team wants Ansible to report compliance drift without making changes first. Which execution mode or module approach supports this?
- Using become: false on all tasks
- Running playbooks in check mode (--check) or using assert/stat modules in report-only roles (Correct answer)
- Using the raw module for read-only access
- Disabling handlers in the playbook
Correct answer: Running playbooks in check mode (--check) or using assert/stat modules in report-only roles
Ansible's check mode simulates changes without applying them, and assert/stat-based playbooks can report violations without remediation.
Question 6: Which Ansible content collection is specifically designed to apply DISA STIG hardening profiles to RHEL systems?
- community.general
- redhatofficial.rhel8_stig or ansible-lockdown/RHEL8-STIG (Correct answer)
- ansible.posix
- amazon.aws
Correct answer: redhatofficial.rhel8_stig or ansible-lockdown/RHEL8-STIG
The ansible-lockdown/RHEL8-STIG and redhatofficial STIG collections provide pre-built, tested roles that apply DISA STIG controls to RHEL 8.
Question 7: In a FedRAMP High environment, Ansible control nodes themselves must meet security requirements. Which configuration is mandatory?
- Control nodes should run on developer laptops for flexibility
- Control nodes must be hardened, access-controlled, and logged like any other system in the authorization boundary (Correct answer)
- Ansible does not need to be in scope if it only pushes configurations
- Only the managed nodes need FedRAMP controls applied
Correct answer: Control nodes must be hardened, access-controlled, and logged like any other system in the authorization boundary
FedRAMP High includes all systems that can affect in-scope assets; Ansible control nodes with elevated access must be hardened and within the authorization boundary.
Ansible Automation Regulatory Frameworks & Compliance 4
A PCI-DSS Requirement 6.4 mandates that only authorized changes are deployed to production.
Which Ansible Tower feature directly enforces this?