Ansible Automation Risk Assessment & Management 5

Question 1

What risk does storing Ansible Tower/AWX job template credentials with 'prompt on launch' disabled introduce?

Accepted Answer

Credentials are passed without human review, increasing risk of misuse in automated pipelines

Answer

Disabling prompt-on-launch means credentials are automatically injected without any human gate, making it easier for unauthorized jobs to use them.

Question 2

An Ansible role downloads packages directly from the internet during a playbook run. What supply chain risk does this introduce?

Accepted Answer

Dependency on external availability and potential for tampered packages if integrity is not verified

Answer

Fetching packages at runtime from external sources risks downloading unavailable, modified, or malicious content if package integrity is not cryptographically verified.

Question 3

Which Ansible configuration option limits the maximum time a task can run, reducing the risk of hung tasks blocking a pipeline?

Accepted Answer

async with poll

Answer

Using `async` with a timeout value and `poll` interval (or `async_status`) lets you cap task runtime and fail fast rather than waiting indefinitely.

Question 4

A security audit finds that Ansible log files on the control node contain plaintext passwords. What configuration change mitigates this?

Accepted Answer

Apply `no_log: true` to tasks handling sensitive data and restrict log file permissions

Answer

`no_log: true` on sensitive tasks prevents secret values from appearing in logs, and restrictive file permissions limit who can read any logs that are written.

Question 5

What is the risk of allowing all developers to modify shared group_vars files in a production Ansible repository without review?

Accepted Answer

Unauthorized or erroneous variable changes can silently alter production behavior across all hosts in the group

Answer

Unreviewed changes to group_vars can propagate incorrect configurations to every host in the group on the next playbook run without additional approval.

Ansible Automation Practice Test

Ansible Automation Practice Test

Ansible Automation Risk Assessment & Management 5