Question 1

What is Ansible, and why is it popular in DevOps?

Accepted Answer

Ansible is an agentless automation tool used for configuration management, application deployment, provisioning, and orchestration. It connects over SSH or WinRM and executes tasks described in YAML playbooks.

It is popular because it is relatively easy to read, simple to get started with, and works well for repeatable infrastructure tasks. In DevOps teams, Ansible is often used to standardize server setup, deploy applications, enforce configuration, and reduce manual operational work.

Question 2

What is idempotency in Ansible?

Accepted Answer

Idempotency means that running the same playbook multiple times should bring the system to the same desired state without causing unintended repeated changes.

This matters because automation is most valuable when it is safe to rerun. For example, a package install task should not reinstall a package unnecessarily, and a file task should only report a change when the file content or permissions actually differ from the target state.

Question 3

What is the difference between ad-hoc commands and playbooks in Ansible?

Accepted Answer

Ad-hoc commands are one-line commands used for quick, one-off tasks, such as checking uptime or restarting a service on a group of hosts. Playbooks are structured YAML files that define repeatable automation workflows.

In interviews, it helps to explain that ad-hoc commands are useful for speed, but playbooks are better for version control, review, documentation, reuse, and consistent operations across environments.

Question 4

What is an Ansible inventory?

Accepted Answer

An inventory is the list of managed hosts and groups that Ansible targets. It can be static, such as an INI or YAML file, or dynamic, such as data pulled from a cloud provider or CMDB.

Inventory is important because it lets you organize systems by role or environment, for example `web`, `db`, `prod`, and `staging`. A strong answer also mentions that inventory can hold variables, but teams should keep it clean and avoid mixing too much business logic into it.

Question 5

What are Ansible roles?

Accepted Answer

Roles are a way to organize playbooks into reusable units. A role typically contains tasks, handlers, templates, files, variables, and defaults in a standard directory structure.

Roles improve maintainability because they make automation modular and easier to share across projects. For example, you might have separate roles for `nginx`, `docker`, `users`, or `monitoring-agent`, and combine them in different playbooks depending on the environment.

Question 6

How do handlers work in Ansible?

Accepted Answer

Handlers are tasks that run only when notified by another task that made a change. They are commonly used for actions like restarting or reloading services after a configuration file is updated.

This is useful because it prevents unnecessary restarts. For example, if a config template task does not change anything, the handler will not run, which keeps automation efficient and reduces avoidable service disruptions.

Question 7

What are facts in Ansible?

Accepted Answer

Facts are details gathered about remote systems, such as hostname, operating system, IP addresses, memory, and CPU information. They are collected using the `setup` module unless fact gathering is disabled.

Facts make playbooks more dynamic. For example, you can use them to choose package names based on the OS family or set configuration values differently on Ubuntu versus Rocky Linux. A good answer also mentions that disabling fact gathering can speed up runs when facts are not needed.

Question 8

How do variables work in Ansible?

Accepted Answer

Variables let you customize playbooks and roles without duplicating logic. They can be defined in inventory, group variables, host variables, role defaults, role vars, playbooks, and extra vars.

In interviews, it is useful to mention that variable precedence matters. If multiple places define the same variable, Ansible follows a precedence order. Understanding that order helps avoid hard-to-debug behavior when values do not match expectations.

Question 9

How do you store sensitive values in Ansible?

Accepted Answer

Sensitive values should be stored using Ansible Vault or an external secret manager rather than in plaintext files. Examples include passwords, API keys, tokens, and private credentials.

The reason is not just secrecy but operational discipline. Secrets should be encrypted, access-controlled, rotated, and prevented from leaking into logs, repositories, or screenshots. A mature setup often combines Ansible with an external vault solution for stronger separation of duties.

Question 10

What is the difference between `command` and `shell` in Ansible?

Accepted Answer

The `command` module runs commands directly without a shell, while the `shell` module runs commands through a shell interpreter such as `/bin/sh`.

`command` is generally safer because it avoids shell parsing and reduces injection risk. `shell` should be used only when you need shell features such as pipes, redirects, variable expansion, or compound commands.

Question 11

What does `--check` mode do in Ansible?

Accepted Answer

`--check` mode performs a dry run and shows what changes Ansible would attempt without actually applying them, although some modules support it better than others.

This is useful for validation before production changes, but it should not be treated as a perfect simulation. Some tasks depend on runtime state or commands that cannot be predicted accurately in check mode, so teams often combine it with linting, testing, and staged rollouts.

Question 12

How do you make Ansible code maintainable in larger environments?

Accepted Answer

I would organize code into reusable roles, keep variables structured by environment and function, use templates instead of copying large static files, and keep playbooks focused on orchestration rather than embedding too much logic.

It also helps to use linting, code review, naming conventions, and test environments. Large Ansible codebases become hard to manage when they mix too many responsibilities together, so clear structure matters as much as the automation itself.

Question 13

What is a common way to validate playbook quality?

Accepted Answer

Teams often use `ansible-playbook --syntax-check`, `ansible-lint`, Molecule, and test environments to validate quality before production execution.

The best answer is broader than just syntax. Good validation checks formatting, logic, idempotency, target compatibility, and operational safety. Ideally, playbooks are tested in isolated environments before they touch real infrastructure.

Question 14

How would you troubleshoot an Ansible playbook that works on some hosts but fails on others?

Accepted Answer

I would compare inventory variables, OS versions, packages, permissions, network connectivity, and gathered facts between working and failing hosts. I would also rerun with more verbosity, such as `-vvv`, to inspect the failing task more closely.

Many Ansible issues are not really “Ansible problems” but differences in target systems. A good answer shows that you understand how to isolate whether the root cause is inventory, environment drift, credentials, facts, or the task logic itself.

Question 15

What is the difference between `include_tasks` and `import_tasks`?

Accepted Answer

`import_tasks` is processed at playbook parse time, while `include_tasks` is evaluated at runtime. That means `include_tasks` is more dynamic and works better when task files depend on conditions or variables known only during execution.

In interviews, it helps to mention that static imports are easier to reason about, while dynamic includes give more flexibility. Knowing when Ansible resolves content is useful for debugging complex playbooks.

Question 16

What are tags in Ansible?

Accepted Answer

Tags let you run only selected parts of a playbook by marking tasks, roles, or blocks with names and using `--tags` or `--skip-tags` at runtime.

They are useful for speeding up targeted runs such as patching only one application component or testing one section of a large automation workflow. Good answers also mention that overusing tags can make playbooks harder to understand.

Question 17

What is the purpose of `become` in Ansible?

Accepted Answer

`become` is used for privilege escalation, typically to run tasks as `root` or another privileged user.

This matters because many system administration tasks require elevated permissions, but you do not want to log in as root directly for every operation. A strong answer may mention `become_user`, least privilege, and auditability.

Question 18

How do you manage different environments like dev, staging, and production in Ansible?

Accepted Answer

I would separate inventory or group variables by environment and keep shared logic in reusable roles. Environment-specific values such as hostnames, credentials, and scaling differences should be defined outside the role logic where possible.

This approach reduces duplication and makes it easier to promote the same automation pattern across environments. Good structure is critical when teams need confidence that production differs only where intended.

Question 19

What is an Ansible template?

Accepted Answer

A template is usually a Jinja2-based file that Ansible renders with variables before copying it to the target host.

Templates are useful for config files that change by host or environment, such as application configs, service unit files, or web server settings. They are much more maintainable than keeping many nearly identical static files.

Question 20

Why is Jinja2 important in Ansible?

Accepted Answer

Jinja2 provides templating, loops, filters, and conditionals that make playbooks and templates more dynamic.

It is powerful, but the best practice is to keep templates readable and avoid turning them into hard-to-maintain programming layers. Good Ansible design balances flexibility with simplicity.

Question 21

What are conditionals in Ansible used for?

Accepted Answer

Conditionals, usually written with `when`, are used to execute tasks only when specific conditions are true.

They are important because infrastructure often differs by OS, environment, or application role. A strong answer might mention using facts and variables to keep playbooks adaptive without duplicating whole task blocks.

Question 22

What is a block in Ansible?

Accepted Answer

A block groups related tasks together so you can apply shared directives like `when`, `become`, or `tags` to all of them.

Blocks are also useful with `rescue` and `always`, which help structure error handling. This becomes especially valuable in more advanced workflows where you need controlled rollback or cleanup behavior.

Question 23

How do `block`, `rescue`, and `always` work?

Accepted Answer

`block` contains the main tasks, `rescue` runs if a task in the block fails, and `always` runs regardless of success or failure.

This pattern is helpful for controlled cleanup, fallback behavior, and better failure handling. It shows that Ansible can support more robust operational flows than a simple list of tasks.

Question 24

What is a handler notification chain?

Accepted Answer

A handler notification chain is when one or more tasks notify a handler, and that handler runs later in the play after all normal tasks complete.

This deferred execution model prevents repeated service restarts and makes configuration changes more efficient. Understanding that handlers run at the end unless flushed is useful during debugging.

Question 25

What does `changed_when` do in Ansible?

Accepted Answer

`changed_when` lets you override whether a task should be reported as changed. This is especially useful for command-based tasks where Ansible cannot infer idempotency automatically.

It helps keep output accurate and ensures handlers are triggered only when real changes occur. A good answer should mention that custom change detection should be used carefully and documented clearly.

Question 26

What does `failed_when` do in Ansible?

Accepted Answer

`failed_when` lets you define custom failure conditions for a task instead of relying only on the return code.

This is useful when a command returns success even though the result is bad, or returns a nonzero code for a condition you want to tolerate. It gives more precise control over automation behavior.

Question 27

How do you speed up slow Ansible runs?

Accepted Answer

I would reduce unnecessary fact gathering, target only required hosts, improve task efficiency, use parallelism carefully, and avoid shell-heavy logic when dedicated modules exist.

It also helps to profile where time is spent. Slow Ansible runs are often caused by inefficient playbook design, serial bottlenecks, or too much work being done on every run.

Question 28

What is Ansible Galaxy used for?

Accepted Answer

Ansible Galaxy is a repository and ecosystem for sharing and consuming Ansible roles and collections.

It helps teams reuse community or internal automation components rather than reinventing everything. A strong answer also mentions the need to review third-party content carefully for quality and security.

Question 29

What are collections in Ansible?

Accepted Answer

Collections package modules, plugins, roles, and documentation together into a distributable unit.

They are now the standard way to organize and distribute larger sets of Ansible functionality. Understanding collections is important for modern Ansible usage beyond simple single-repo playbooks.

Question 30

How do you make Ansible automation safer in production?

Accepted Answer

I would use version control, code review, check mode where appropriate, testing in lower environments, least-privilege credentials, and clear rollback procedures.

Production safety also depends on limiting blast radius. Running against the right inventory, scoping changes carefully, and verifying results afterward are all part of mature automation practice.

Configuration Management (Ansible)

1. What is Ansible, and why is it popular in DevOps?

2. What is idempotency in Ansible?

3. What is the difference between ad-hoc commands and playbooks in Ansible?

4. What is an Ansible inventory?

5. What are Ansible roles?

6. How do handlers work in Ansible?

7. What are facts in Ansible?

8. How do variables work in Ansible?

9. How do you store sensitive values in Ansible?

10. What is the difference between `command` and `shell` in Ansible?

11. What does `--check` mode do in Ansible?

12. How do you make Ansible code maintainable in larger environments?

13. What is a common way to validate playbook quality?

14. How would you troubleshoot an Ansible playbook that works on some hosts but fails on others?

15. What is the difference between `include_tasks` and `import_tasks`?

16. What are tags in Ansible?

17. What is the purpose of `become` in Ansible?

18. How do you manage different environments like dev, staging, and production in Ansible?

19. What is an Ansible template?

20. Why is Jinja2 important in Ansible?

21. What are conditionals in Ansible used for?

22. What is a block in Ansible?

23. How do `block`, `rescue`, and `always` work?

24. What is a handler notification chain?

25. What does `changed_when` do in Ansible?

26. What does `failed_when` do in Ansible?

27. How do you speed up slow Ansible runs?

28. What is Ansible Galaxy used for?

29. What are collections in Ansible?

30. How do you make Ansible automation safer in production?