350-901 AUTOCOR: Designing, Deploying, and Managing Network Automation SystemsDemo

Question

An application is being developed using a microservice-based architecture. Ansible is the infrastructure as code tool that will be used for the CI/CD system. The CI/CD system must provide protection for, and have access to, credentials such as secrets and API keys.

Which approach meets this goal?

A Use private code repositories to minimize exposure to risk.
B Perform automated linting during each developer push to block secrets from getting into the VCS.
C Use Ansible Vault to encrypt secret-related variables inline in host files.
D Use a privately hosted VCS system to minimize mitigation.

Explanation

Ansible Vault is the built-in feature for encrypting sensitive variables (passwords, API keys, tokens, certificates, etc.) so they can be safely stored in version control and still be decrypted at runtime by Ansible using a vault password or key management integration. This satisfies the dual requirement of protecting secrets at rest while still allowing the CI/CD/automation system controlled access to them during playbook execution, which is exactly what encrypting secret-related variables inline in host/variable files with Ansible Vault provides.

Learn more

Ansible Vault documentation

350-901 AUTOCOR: Designing, Deploying, and Managing Network Automation SystemsDemo

AstroTutor

Notes

Readiness

QuestionQ513

Community Discussion