Ansible Automation Regulatory Frameworks & Compliance 5

Question 1

Which Ansible module helps enforce CIS Benchmark requirements for umask settings across multiple Linux distributions?

Accepted Answer

ansible.builtin.lineinfile targeting /etc/profile and /etc/bashrc

Answer

CIS umask requirements must persist for all sessions, requiring lineinfile to set umask in /etc/profile and /etc/bashrc rather than a one-time command.

Question 2

A HITRUST CSF assessment requires that encryption keys used by applications be rotated regularly. How can Ansible support this control?

Accepted Answer

By automating key generation, distribution via Vault secrets, and rotation on a scheduled Tower job

Answer

Scheduled Tower jobs can generate new keys, distribute them via Ansible Vault or an integrated secrets manager, and retire old keys on a compliant schedule.

Question 3

Which Ansible feature allows credentials (such as AWS IAM keys or HashiCorp Vault tokens) to be injected into playbook runs without exposing them to the operator running the job?

Accepted Answer

Tower/AWX credential objects with input/injector configurations

Answer

Tower credential objects inject secrets at runtime as environment variables or temporary files, never exposing them to operators or logs.

Question 4

Under NERC CIP-007-6 (Systems Security Management), electronic access ports must be controlled. How does Ansible support ongoing compliance?

Accepted Answer

By running firewall and service hardening playbooks that close unauthorized ports and verify the state on a schedule

Answer

Scheduled Ansible playbooks can enforce approved port/service configurations and report deviations, satisfying NERC CIP-007-6's continuous port management requirement.

Question 5

An auditor asks for evidence that configuration baselines have not drifted since last audit. Which Ansible-based approach provides the strongest evidence?

Accepted Answer

Regularly scheduled compliance playbooks with assert tasks that fail and alert on any deviation from baseline

Answer

Scheduled assert-based playbooks create timestamped, logged evidence of continuous baseline enforcement, which auditors can use to confirm no unreported drift occurred.

Ansible Automation Practice Test

Ansible Automation Practice Test

Ansible Automation Regulatory Frameworks & Compliance 5