Ansible Vault: Secrets Management Quiz Quiz

Explore the essentials of Ansible Vault and its role in securely managing sensitive data such as passwords and keys in automation workflows. Check your foundational knowledge on encrypting, decrypting, and handling secrets with Ansible Vault best practices.

1. Purpose of Ansible Vault

   What is the primary purpose of using Ansible Vault in automation environments?

   1. To improve the speed of task execution in playbooks
   2. To securely encrypt sensitive data in playbooks and variable files
   3. To schedule recurring tasks on remote hosts
   4. To automatically install updates to all managed systems

   Explanation: Ansible Vault is designed to encrypt confidential information such as passwords, keys, or secret variables within playbooks and configuration files. Automated updates and scheduling are handled by other tools or modules and not Vault. Increasing playbook speed is also unrelated to Vault; its main function is secure data handling.

2. Encryption Command

   Which command line argument should you use with the Ansible Vault command to encrypt a file named 'secrets.yml'?

   1. ansible-vault encode secrets.yml
   2. ansible-vault lock secrets.yml
   3. ansible-vault hide secrets.yml
   4. ansible-vault encrypt secrets.yml

   Explanation: The correct argument is 'ansible-vault encrypt' followed by the filename, which encrypts the file for secure use. 'Lock', 'encode', and 'hide' are incorrect; these are not valid arguments for encryption within this tool and do not exist in its command-line interface.

3. Default Encryption Algorithm

   When using Ansible Vault by default, which encryption algorithm is typically applied to secure files?

   1. SHA1
   2. RSA
   3. AES256
   4. DES

   Explanation: Ansible Vault uses the AES256 algorithm to encrypt its files by default, which ensures strong symmetric encryption. RSA is used for asymmetric encryption, not typical for Vault’s purpose. SHA1 is a hashing algorithm and not suitable for encryption, while DES is outdated and less secure.

4. Decrypting Files

   What happens when you run 'ansible-vault decrypt secrets.yml' in your terminal?

   1. The file is moved to the recycle bin
   2. The file 'secrets.yml' becomes fully readable with plaintext data
   3. The file will be permanently deleted from the system
   4. The file contents are compressed for backup purposes

   Explanation: Decrypting with Ansible Vault converts the encrypted file back into plaintext, making the content accessible. It does not delete, move, or compress the file; those options are not performed by this command.

5. Using Vault in Playbooks

   How can you include sensitive information in an Ansible playbook without exposing secrets in plain text?

   1. Write passwords directly in the playbook for faster reference
   2. Store sensitive variables in an encrypted YAML file managed by Ansible Vault
   3. Store secrets as plain text environment variables only
   4. Use comments to hide secret data in playbooks

   Explanation: Using an encrypted YAML file managed by Vault is the recommended way to keep secrets protected in playbooks. Writing passwords directly, using comments, or plain text variables do not offer any security and can lead to data exposure.

6. Vault Password Prompt

   When running a playbook that uses encrypted variables, what typically happens if you don't provide a Vault password?

   1. The playbook runs with default values for all encrypted variables
   2. You are prompted to enter the vault password before the playbook runs
   3. The password is automatically generated based on your username
   4. The encrypted variables are skipped automatically

   Explanation: If the Vault password is not already supplied, you will be prompted to enter it. The playbook will not run with default, skipped, or automatically generated passwords, as this would compromise the intent of encrypted secrets.

7. Editing Encrypted Files

   Which Ansible Vault command should be used to safely modify the contents of an encrypted file?

   1. ansible-vault change secrets.yml
   2. ansible-vault update secrets.yml
   3. ansible-vault edit secrets.yml
   4. ansible-vault open secrets.yml

   Explanation: The 'ansible-vault edit' command decrypts the file temporarily for editing and re-encrypts it once saved. 'Update', 'change', or 'open' are not valid commands for editing encrypted files and would result in errors.

8. Vault ID Use Case

   In which scenario is using a Vault ID especially helpful when running Ansible playbooks?

   1. When running playbooks without any encrypted files
   2. When storing non-sensitive variables in a project
   3. When managing multiple encrypted files with different passwords in the same project
   4. When you want to run several playbooks in parallel

   Explanation: Vault IDs allow for different encrypted files to have separate passwords within the same project. Running playbooks in parallel, managing non-sensitive data, or having no encrypted files do not require Vault IDs.

9. Best Practice - Vault Password File

   Which is a recommended practice when providing the Vault password to automate playbook runs?

   1. Type the password as a command-line argument for convenience
   2. Store the vault password in a public repository for easy access
   3. Use the '--vault-password-file' option to reference a secure password file
   4. Write the password in plain text at the top of each playbook

   Explanation: Referencing a securely stored password file using the appropriate command-line option is recommended for automation. Writing passwords on the command line, in repositories, or in playbooks exposes sensitive data and is insecure.

10. Re-keying Vault Files

    If you need to change the password for an already encrypted file, which Ansible Vault sub-command should you use?

    1. ansible-vault reset secrets.yml
    2. ansible-vault refresh secrets.yml
    3. ansible-vault rekey secrets.yml
    4. ansible-vault swap secrets.yml

    Explanation: The 'ansible-vault rekey' command allows users to change the password on an encrypted file. 'Refresh', 'reset', and 'swap' are not valid sub-commands for changing a file's password.