Ansible Automation Risk Assessment & Management 2

Question 1

Which Ansible feature lets you test playbook changes without making actual system modifications?

Accepted Answer

--check mode

Answer

The `--check` flag runs Ansible in dry-run mode, reporting what changes would be made without applying them.

Question 2

What risk does using `no_log: true` in a task mitigate?

Accepted Answer

Sensitive data exposure in logs

Answer

`no_log: true` prevents sensitive values like passwords and tokens from appearing in Ansible output or log files.

Question 3

An Ansible control node's private SSH key is stored with permissions 0644. What is the primary risk?

Accepted Answer

Other users on the system can read the key

Answer

World-readable SSH private keys (0644) allow any user on the system to steal the key and impersonate the control node.

Question 4

Which strategy best reduces the blast radius when a faulty playbook runs against a large inventory?

Accepted Answer

Using `serial` to limit hosts per batch

Answer

The `serial` keyword limits how many hosts are updated at once, so a failure stops before affecting the entire fleet.

Question 5

What does `any_errors_fatal: true` do in a play?

Accepted Answer

Stops the entire play if any host fails

Answer

`any_errors_fatal: true` causes Ansible to abort the play for all hosts as soon as one host encounters a fatal error.

Ansible Automation Practice Test