Ansible Automation Regulatory Frameworks & Compliance 5 — Questions and Answers
Question 1: Which Ansible module helps enforce CIS Benchmark requirements for umask settings across multiple Linux distributions?
- ansible.builtin.user
- ansible.builtin.lineinfile targeting /etc/profile and /etc/bashrc (Correct answer)
- ansible.builtin.file with mode parameter only
- ansible.builtin.command: umask 027
Correct answer: ansible.builtin.lineinfile targeting /etc/profile and /etc/bashrc
CIS umask requirements must persist for all sessions, requiring lineinfile to set umask in /etc/profile and /etc/bashrc rather than a one-time command.
Question 2: A HITRUST CSF assessment requires that encryption keys used by applications be rotated regularly. How can Ansible support this control?
- By storing keys in plaintext host_vars files
- By automating key generation, distribution via Vault secrets, and rotation on a scheduled Tower job (Correct answer)
- By disabling key rotation to maintain availability
- By hardcoding keys in playbook tasks
Correct answer: By automating key generation, distribution via Vault secrets, and rotation on a scheduled Tower job
Scheduled Tower jobs can generate new keys, distribute them via Ansible Vault or an integrated secrets manager, and retire old keys on a compliant schedule.
Question 3: Which Ansible feature allows credentials (such as AWS IAM keys or HashiCorp Vault tokens) to be injected into playbook runs without exposing them to the operator running the job?
- Inventory variables in plain YAML
- Tower/AWX credential objects with input/injector configurations (Correct answer)
- Environment variables set in the playbook
- The vars_prompt module
Correct answer: Tower/AWX credential objects with input/injector configurations
Tower credential objects inject secrets at runtime as environment variables or temporary files, never exposing them to operators or logs.
Question 4: Under NERC CIP-007-6 (Systems Security Management), electronic access ports must be controlled. How does Ansible support ongoing compliance?
- By disabling all network interfaces on control nodes
- By running firewall and service hardening playbooks that close unauthorized ports and verify the state on a schedule (Correct answer)
- By storing port lists in Ansible facts
- By using the ping module to test connectivity
Correct answer: By running firewall and service hardening playbooks that close unauthorized ports and verify the state on a schedule
Scheduled Ansible playbooks can enforce approved port/service configurations and report deviations, satisfying NERC CIP-007-6's continuous port management requirement.
Question 5: An auditor asks for evidence that configuration baselines have not drifted since last audit. Which Ansible-based approach provides the strongest evidence?
- Manually reviewing managed nodes one by one
- Regularly scheduled compliance playbooks with assert tasks that fail and alert on any deviation from baseline (Correct answer)
- Keeping playbooks in a local directory without version control
- Using ad-hoc commands to check individual settings
Correct answer: Regularly scheduled compliance playbooks with assert tasks that fail and alert on any deviation from baseline
Scheduled assert-based playbooks create timestamped, logged evidence of continuous baseline enforcement, which auditors can use to confirm no unreported drift occurred.
Question 6: The NIST Cybersecurity Framework 'Respond' function requires containment actions. How can Ansible support rapid containment of a compromised host?
- Manually SSH into the host and isolate it
- A pre-built incident response playbook that isolates the host via firewall rules, revokes credentials, and captures forensic data automatically (Correct answer)
- Rebooting the host using the reboot module
- Deleting the host from the Ansible inventory
Correct answer: A pre-built incident response playbook that isolates the host via firewall rules, revokes credentials, and captures forensic data automatically
Pre-built IR playbooks enable rapid, consistent containment actions that can be triggered from Tower in seconds, supporting the CSF Respond function.
Question 7: Which practice ensures Ansible playbooks used for compliance remediation are themselves trustworthy and have not been tampered with?
- Storing playbooks on the managed nodes
- Signing commits with GPG keys and enforcing branch protection rules in the Git repository used as the Tower project source (Correct answer)
- Emailing playbooks to the team before each run
- Using the 'raw' module to avoid playbook complexity
Correct answer: Signing commits with GPG keys and enforcing branch protection rules in the Git repository used as the Tower project source
GPG-signed commits with branch protection rules create a tamper-evident chain of custody for compliance playbooks, satisfying integrity requirements.
Ansible Automation Regulatory Frameworks & Compliance 5
Which Ansible module helps enforce CIS Benchmark requirements for umask settings across multiple Linux distributions?