Ansible Automation Risk Assessment & Management 4

Question 1

Which Ansible feature allows marking specific tasks to run only during a change window, reducing unintended changes outside that window?

Accepted Answer

Tags

Answer

Tags let operators selectively run or skip specific tasks with `--tags` or `--skip-tags`, enabling controlled execution during defined change windows.

Question 2

What risk does using `shell` or `command` modules instead of purpose-built modules introduce?

Accepted Answer

Tasks become non-idempotent and may produce unintended repeated changes

Answer

Shell/command modules bypass Ansible's idempotency guarantees, so tasks may re-run destructive operations every time instead of only when needed.

Question 3

An Ansible playbook modifies firewall rules on 200 servers using `serial: 1`. What risk does this mitigate compared to running all hosts simultaneously?

Accepted Answer

Limits simultaneous outages to one host if the firewall rule locks out management access

Answer

Running one host at a time means a bad firewall rule only locks out one server at a time, leaving the rest accessible for remediation.

Question 4

Which Ansible Vault best practice reduces the risk of accidentally committing unencrypted secrets to version control?

Accepted Answer

Use a `.gitignore` rule and pre-commit hooks to block unencrypted vault files

Answer

Pre-commit hooks can detect and block unencrypted files from being committed, while `.gitignore` prevents accidental staging of plaintext secrets.

Question 5

What is the risk of using a single shared Ansible service account with broad sudo rights across all managed nodes?

Accepted Answer

Compromise of that account grants root-level access to every managed host

Answer

A shared privileged account is a single point of failure; compromising it gives an attacker root access to the entire managed infrastructure.

Ansible Automation Practice Test

Ansible Automation Practice Test

Ansible Automation Risk Assessment & Management 4