Security u0026 Compliance Automation with Ansible Quiz Quiz

Explore essential concepts in security and compliance automation using Ansible. This quiz assesses understanding of automated policy enforcement, secure configuration management, and compliance verification within IT environments.

1. Automating Password Policy Enforcement

   Which Ansible feature allows you to ensure that password policies, such as minimum length, are consistently enforced across multiple servers?

   1. Templating
   2. Handlers
   3. Inventories
   4. Playbooks

   Explanation: Playbooks define sets of tasks that can automate the enforcement of security controls, such as password policies, across many systems. Inventories are used to define target hosts but do not automate policy enforcement. Handlers respond to changes in state but are not directly concerned with policy definition. Templating helps generate dynamic configuration files but lacks the direct ability to enforce policies without being embedded in playbooks.

2. Compliance Reporting

   What output from an Ansible run can be reviewed to verify compliance with configured security standards?

   1. Ad-hoc command
   2. Module documentation
   3. Plugin registry
   4. Execution log

   Explanation: The execution log provides a detailed record of the tasks performed and indicates whether systems are compliant. Ad-hoc commands are typically one-off and not suited for full compliance verification. Module documentation describes usage but does not provide compliance information. Plugin registry relates to plugin management, not reporting.

3. Role of Idempotence

   Why is idempotence important when automating security configurations with Ansible?

   1. It disables auditing capabilities.
   2. It allows inventory grouping.
   3. It increases playbook execution speed.
   4. It prevents unnecessary changes on repeated runs.

   Explanation: Idempotence ensures that running playbooks multiple times does not alter already-compliant configurations, thereby avoiding unintended changes. While this may indirectly improve speed, its primary purpose is not execution speed. Idempotence does not disable auditing or enable inventory grouping; those are unrelated concepts.

4. Automated Remediation Example

   If a configuration file does not match the desired secure state, what action does Ansible typically take during automation?

   1. It logs a warning but makes no changes.
   2. It ignores the issue.
   3. It deletes the file.
   4. It automatically corrects the file to the compliant state.

   Explanation: Ansible's automation principle is to bring systems into the specified desired state by correcting non-compliance, such as updating a configuration file. Deleting the file would remove necessary content. Ignoring or just logging a warning does not achieve compliance, making them less suitable.

5. Ansible Modules in Security Automation

   Which term describes reusable units in Ansible that perform specific tasks such as managing users or configuring firewalls for compliance?

   1. Modules
   2. Collections
   3. Templates
   4. Loops

   Explanation: Modules are components that perform single actions, such as managing users or securing firewalls, making them essential for automating compliance tasks. Collections refer to overall sets of modules, roles, and plugins but are not single-purpose units. Loops are used to repeat tasks, and templates are for generating files.

6. Inventory in Security Automation

   How does maintaining an up-to-date inventory contribute to effective security automation with Ansible?

   1. It encrypts sensitive data at rest.
   2. It creates graphical reports of security status.
   3. It identifies the systems needing compliance enforcement.
   4. It minimizes the number of playbooks required.

   Explanation: A current inventory ensures that automated tasks target the right systems for compliance. While it doesn't create reports, encrypt data, or reduce playbook count, a good inventory directly supports effective application of security policies.

7. Ansible Fact Gathering

   Before enforcing security baselines, why does Ansible often gather facts about the managed systems?

   1. To limit the playbook execution scope.
   2. To increase privilege escalation speed.
   3. To generate random passwords automatically.
   4. To collect system details relevant for compliance decisions.

   Explanation: Fact gathering provides information like OS versions and active users, which enables targeted compliance actions. It does not generate random passwords, speed up privilege escalation, or restrict playbook scope.

8. Playbook Structure for Authentication Policies

   Which approach can help organize Ansible playbooks to separate authentication policy enforcement from other tasks?

   1. Relying solely on inventories
   2. Placing all tasks in a single task list
   3. Using distinct roles for authentication
   4. Disabling variable substitution

   Explanation: Roles enable modular organization, allowing authentication policy enforcement to be separated for clarity and reuse. Combining all tasks reduces maintainability. Disabling variable substitution and relying only on inventories are unrelated to task organization.

9. Sensitive Data and Automation

   What should be used in Ansible to protect sensitive compliance data such as passwords within playbooks?

   1. Task dependencies
   2. Dry run mode
   3. Static analysis
   4. Variable encryption

   Explanation: Encrypting variables is crucial for protecting sensitive data like passwords when automating compliance. Dry run mode does not offer encryption, task dependencies organize task order, and static analysis checks code quality, none of which protect data.

10. Compliance Verification Example

    An Ansible task checks that SSH root login is disabled on all servers. What type of compliance control is this enforcing?

    1. User training compliance
    2. Network traffic control
    3. Configuration compliance
    4. Physical access management

    Explanation: Disabling SSH root login via automation ensures that systems meet specific configuration requirements. It does not control network traffic, train users, or manage physical access, so those options are incorrect.