Ansible Automation Risk Assessment & Management 3

Question 1

What risk arises when Ansible variables are defined in multiple locations with overlapping names?

Accepted Answer

Unexpected variable precedence may override intended values

Answer

Ansible's 22-level variable precedence means a lower-priority definition can silently be overridden by a higher-priority one, causing unintended behavior.

Question 2

Which practice reduces the risk of accidental production changes when maintaining separate dev and prod inventories?

Accepted Answer

Requiring explicit `--limit` to target production hosts

Answer

Requiring `--limit production` or a separate production inventory file adds a deliberate step that prevents accidental targeting of production systems.

Question 3

An organization stores all Ansible playbooks in a public GitHub repository. What is the primary risk?

Accepted Answer

Hardcoded secrets or infrastructure details may be exposed publicly

Answer

Public repositories expose any hardcoded credentials, internal hostnames, or topology details embedded in playbooks to anyone on the internet.

Question 4

What is the risk of disabling SSH host key checking (`ANSIBLE_HOST_KEY_CHECKING=False`) in production?

Accepted Answer

Vulnerability to man-in-the-middle attacks

Answer

Disabling host key checking removes verification of remote host identity, making connections susceptible to MITM attacks.

Question 5

A team uses `become: yes` globally in ansible.cfg without task-level restrictions. What is the risk?

Accepted Answer

Every task runs as root even when unnecessary, expanding the attack surface

Answer

Global privilege escalation means every task runs as root, unnecessarily increasing the impact of any exploited vulnerability or misconfigured task.

Ansible Automation Practice Test

Ansible Automation Practice Test

Ansible Automation Risk Assessment & Management 3