Ansible Automation Risk Assessment & Management 5 — Questions and Answers
Question 1: What risk does storing Ansible Tower/AWX job template credentials with 'prompt on launch' disabled introduce?
- Credentials are never used
- Credentials are passed without human review, increasing risk of misuse in automated pipelines (Correct answer)
- Jobs run slower
- Inventory cannot be attached
Correct answer: Credentials are passed without human review, increasing risk of misuse in automated pipelines
Disabling prompt-on-launch means credentials are automatically injected without any human gate, making it easier for unauthorized jobs to use them.
Question 2: An Ansible role downloads packages directly from the internet during a playbook run. What supply chain risk does this introduce?
- Slower playbook execution only
- Dependency on external availability and potential for tampered packages if integrity is not verified (Correct answer)
- Ansible Vault cannot encrypt downloaded content
- Roles cannot use `become`
Correct answer: Dependency on external availability and potential for tampered packages if integrity is not verified
Fetching packages at runtime from external sources risks downloading unavailable, modified, or malicious content if package integrity is not cryptographically verified.
Question 3: Which Ansible configuration option limits the maximum time a task can run, reducing the risk of hung tasks blocking a pipeline?
- max_time
- async with poll (Correct answer)
- timeout in ansible.cfg
- wait_for_connection
Correct answer: async with poll
Using `async` with a timeout value and `poll` interval (or `async_status`) lets you cap task runtime and fail fast rather than waiting indefinitely.
Question 4: A security audit finds that Ansible log files on the control node contain plaintext passwords. What configuration change mitigates this?
- Set `log_path` to /dev/null
- Apply `no_log: true` to tasks handling sensitive data and restrict log file permissions (Correct answer)
- Disable `gather_facts`
- Use `serial: 1` for all plays
Correct answer: Apply `no_log: true` to tasks handling sensitive data and restrict log file permissions
`no_log: true` on sensitive tasks prevents secret values from appearing in logs, and restrictive file permissions limit who can read any logs that are written.
Question 5: What is the risk of allowing all developers to modify shared group_vars files in a production Ansible repository without review?
- Playbooks will execute faster
- Unauthorized or erroneous variable changes can silently alter production behavior across all hosts in the group (Correct answer)
- Ansible Tower jobs are disabled
- Facts gathering is skipped
Correct answer: Unauthorized or erroneous variable changes can silently alter production behavior across all hosts in the group
Unreviewed changes to group_vars can propagate incorrect configurations to every host in the group on the next playbook run without additional approval.
Question 6: Which approach best reduces risk when promoting an Ansible playbook from staging to production?
- Run with `--force` to override checks
- Test in staging with identical inventory structure, then require peer review and approval before production execution (Correct answer)
- Skip `--check` mode in staging to save time
- Use the same vault password for both environments
Correct answer: Test in staging with identical inventory structure, then require peer review and approval before production execution
A staging environment that mirrors production, combined with peer review gates, catches most environment-specific issues before they affect live systems.
Question 7: What does enabling `diff mode` (`--diff`) during a playbook run help assess from a risk management perspective?
- It speeds up task execution
- It shows exactly what file content will change, enabling review before committing to the change (Correct answer)
- It disables privilege escalation
- It skips tasks with `when` conditions
Correct answer: It shows exactly what file content will change, enabling review before committing to the change
Diff mode outputs a unified diff of file changes, letting operators review the precise configuration delta and assess its impact before or during a change window.
Ansible Automation Risk Assessment & Management 5
What risk does storing Ansible Tower/AWX job template credentials with 'prompt on launch' disabled introduce?