Ansible Automation Regulatory Frameworks & Compliance 4

Question 1

A PCI-DSS Requirement 6.4 mandates that only authorized changes are deployed to production. Which Ansible Tower feature directly enforces this?

Accepted Answer

Workflow job templates with approval nodes

Answer

Workflow job templates with approval nodes create mandatory human-review gates before production deployment steps execute.

Question 2

The DISA STIG for RHEL 8 requires auditd to be running and enabled. Which Ansible task structure correctly enforces this?

Accepted Answer

Using ansible.builtin.service with state: started and enabled: true

Answer

The ansible.builtin.service module with state: started and enabled: true idempotently ensures auditd runs now and persists across reboots.

Question 3

Which compliance framework specifically categorizes controls into 'Preventive', 'Detective', and 'Corrective' types, and how does Ansible best support the 'Corrective' category?

Accepted Answer

COBIT/SOC 2; by running remediation playbooks automatically when a compliance check fails

Answer

SOC 2 and COBIT use preventive/detective/corrective classifications; Ansible remediates detected drift automatically, fulfilling the corrective control role.

Question 4

Under NIST 800-53 SI-2 (Flaw Remediation), organizations must patch vulnerabilities within defined timeframes. How should Ansible Tower be configured to support this?

Accepted Answer

Schedule recurring patching job templates with maintenance window schedules and notify on failure

Answer

Scheduled Tower jobs with failure notifications ensure patches are applied within required timeframes and exceptions are escalated automatically.

Question 5

A security team wants Ansible to report compliance drift without making changes first. Which execution mode or module approach supports this?

Accepted Answer

Running playbooks in check mode (--check) or using assert/stat modules in report-only roles

Answer

Ansible's check mode simulates changes without applying them, and assert/stat-based playbooks can report violations without remediation.

Ansible Automation Practice Test

Ansible Automation Practice Test

Ansible Automation Regulatory Frameworks & Compliance 4