Ansible Automation Risk Assessment & Management 2 — Questions and Answers
Question 1: Which Ansible feature lets you test playbook changes without making actual system modifications?
- --dry-run flag
- --check mode (Correct answer)
- --simulate flag
- --preview mode
Correct answer: --check mode
The `--check` flag runs Ansible in dry-run mode, reporting what changes would be made without applying them.
Question 2: What risk does using `no_log: true` in a task mitigate?
- Privilege escalation risk
- Sensitive data exposure in logs (Correct answer)
- Network interception risk
- Playbook execution failures
Correct answer: Sensitive data exposure in logs
`no_log: true` prevents sensitive values like passwords and tokens from appearing in Ansible output or log files.
Question 3: An Ansible control node's private SSH key is stored with permissions 0644. What is the primary risk?
- Ansible will refuse to connect
- Other users on the system can read the key (Correct answer)
- SSH connections will be slower
- The key will be rotated automatically
Correct answer: Other users on the system can read the key
World-readable SSH private keys (0644) allow any user on the system to steal the key and impersonate the control node.
Question 4: Which strategy best reduces the blast radius when a faulty playbook runs against a large inventory?
- Using `serial` to limit hosts per batch (Correct answer)
- Increasing `forks` for faster completion
- Disabling `gather_facts`
- Running with `--become`
Correct answer: Using `serial` to limit hosts per batch
The `serial` keyword limits how many hosts are updated at once, so a failure stops before affecting the entire fleet.
Question 5: What does `any_errors_fatal: true` do in a play?
- Ignores all task errors
- Stops the entire play if any host fails (Correct answer)
- Retries failed tasks automatically
- Logs errors to a separate file
Correct answer: Stops the entire play if any host fails
`any_errors_fatal: true` causes Ansible to abort the play for all hosts as soon as one host encounters a fatal error.
Question 6: A playbook uses `ignore_errors: yes` on every task. What risk does this introduce?
- Playbooks run faster but use more CPU
- Silent failures may leave systems in inconsistent states (Correct answer)
- Ansible Vault cannot be used
- Host facts are not gathered
Correct answer: Silent failures may leave systems in inconsistent states
Ignoring all errors means failures are swallowed silently, leaving infrastructure in unknown or broken states without alerting operators.
Question 7: Which Ansible module is best suited for verifying that a deployed configuration file matches the expected checksum before proceeding?
- file
- stat (Correct answer)
- copy
- fetch
Correct answer: stat
The `stat` module returns file metadata including md5sum and checksum, allowing playbooks to validate file integrity before continuing.
Ansible Automation Risk Assessment & Management 2
Which Ansible feature lets you test playbook changes without making actual system modifications?