Risk Assessment & Management Flashcards

Which Ansible feature lets you test playbook changes without making actual system modifications?

Answer: --check mode

The `--check` flag runs Ansible in dry-run mode, reporting what changes would be made without applying them.

What risk does using `no_log: true` in a task mitigate?

Answer: Sensitive data exposure in logs

`no_log: true` prevents sensitive values like passwords and tokens from appearing in Ansible output or log files.

An Ansible control node's private SSH key is stored with permissions 0644. What is the primary risk?

Answer: Other users on the system can read the key

World-readable SSH private keys (0644) allow any user on the system to steal the key and impersonate the control node.

Which strategy best reduces the blast radius when a faulty playbook runs against a large inventory?

Answer: Using `serial` to limit hosts per batch

The `serial` keyword limits how many hosts are updated at once, so a failure stops before affecting the entire fleet.

What does `any_errors_fatal: true` do in a play?

Answer: Stops the entire play if any host fails

`any_errors_fatal: true` causes Ansible to abort the play for all hosts as soon as one host encounters a fatal error.

A playbook uses `ignore_errors: yes` on every task. What risk does this introduce?

Answer: Silent failures may leave systems in inconsistent states

Ignoring all errors means failures are swallowed silently, leaving infrastructure in unknown or broken states without alerting operators.

Which Ansible module is best suited for verifying that a deployed configuration file matches the expected checksum before proceeding?

Answer: stat

The `stat` module returns file metadata including md5sum and checksum, allowing playbooks to validate file integrity before continuing.