Ansible Automation Research & Evidence-Based Practice 3 — Questions and Answers
Question 1: Which Ansible concept supports evidence-based idempotency by ensuring a task only changes the system when the desired state differs from the current state?
- Handlers
- Tags
- Idempotent modules (Correct answer)
- Delegation
Correct answer: Idempotent modules
Idempotent modules check the current state and only make changes if needed, preventing unintended drift.
Question 2: What is the recommended practice when a playbook must run a shell command that has no equivalent Ansible module?
- Use the `raw` module for all shell commands
- Use `command` or `shell` with `changed_when` to control change reporting (Correct answer)
- Avoid Ansible and use a Bash script instead
- Use `script` module exclusively
Correct answer: Use `command` or `shell` with `changed_when` to control change reporting
Using `changed_when` with `command` or `shell` prevents false positives in change reporting when running unavoidable shell commands.
Question 3: Which file in an Ansible role is the correct location to declare dependencies on other roles?
- defaults/main.yml
- vars/main.yml
- meta/main.yml (Correct answer)
- tasks/main.yml
Correct answer: meta/main.yml
Role dependencies are declared in `meta/main.yml` under the `dependencies` key.
Question 4: What is the best-practice approach when the same variable needs different values for development vs. production environments?
- Hard-code values in each task
- Use separate inventory groups with corresponding group_vars (Correct answer)
- Pass all variables on the command line with -e
- Store environments in different Git branches
Correct answer: Use separate inventory groups with corresponding group_vars
Separate inventory groups (`dev`, `prod`) with their own `group_vars/` files is the standard approach for environment-specific variables.
Question 5: According to Ansible documentation, what is the primary advantage of using `ansible-vault encrypt_string` over encrypting an entire variable file?
- It is faster to decrypt at runtime
- It allows encrypting individual sensitive values within an otherwise readable file (Correct answer)
- It generates stronger encryption keys
- It is the only method compatible with AWX
Correct answer: It allows encrypting individual sensitive values within an otherwise readable file
`encrypt_string` lets you store a single secret inline while keeping the rest of the variable file readable.
Question 6: Which Ansible best practice does the use of `notify` and handlers enforce?
- Running tasks in parallel
- Triggering actions like service restarts only when a related change actually occurred (Correct answer)
- Skipping tasks on specific hosts
- Logging task output to a file
Correct answer: Triggering actions like service restarts only when a related change actually occurred
Handlers run only when notified by a task that reported a change, preventing unnecessary restarts.
Question 7: What is the evidence-based reason Ansible recommends against using `shell` module over `command` module when possible?
- The `shell` module is slower
- The `shell` module spawns a full shell and is more prone to injection and quoting errors (Correct answer)
- The `command` module supports pipes and redirects
- The `shell` module requires root privileges
Correct answer: The `shell` module spawns a full shell and is more prone to injection and quoting errors
The `shell` module invokes `/bin/sh`, introducing risk of variable injection and quoting bugs that `command` avoids by not using a shell.
Ansible Automation Research & Evidence-Based Practice 3
Which Ansible concept supports evidence-based idempotency by ensuring a task only changes the system when the desired state differs from the current state?