Ansible Interview Questions for DevOps Engineers: Scenario-Based Answers

1. Why Is Ansible Called Agentless?

The control node connects to managed hosts, commonly over SSH, and transfers or invokes modules without a persistent Ansible agent on each host. Managed systems still need a connection method and usually Python or another module runtime. Agentless reduces daemon lifecycle work; it does not remove authentication, privilege, network, or compatibility requirements.

2. What Makes a Task Idempotent?

It converges the host to a declared state and reports changed only when state moves. A second identical run should normally report no changes. Purpose-built modules compare current and desired state. Shell commands need controls such as creates, removes, and accurate changed_when/failed_when.

3. How Do You Debug Variable Precedence?

Inspect the resolved host with ansible-inventory --host <name>, print the variable deliberately, and search definitions from role defaults through inventory, play vars, included vars, role vars, and extra vars. Remove accidental high-precedence overrides instead of adding an even stronger one.

4. How Do Handlers Work?

A changed task notifies a handler name or listen topic. The handler normally runs once at the end of the play, even after multiple notifications. It will not run if the task reports no change. Use meta: flush_handlers only when later tasks require the new runtime state.

5. copy, template, lineinfile, or blockinfile?

Use copy for a static whole file, template for a generated whole file, lineinfile for one uniquely matched line, and blockinfile for one owned marked block. For application configuration, whole-file templates with validation are often easiest to reason about.

6. What Is Check Mode?

--check asks supporting modules to predict changes without applying them. It is not a transaction and cannot perfectly simulate dependencies or arbitrary commands. Combine it with --diff, explicit handling for unsupported tasks, and real converge/verification on ephemeral hosts.

7. How Should Roles Be Designed?

Give each role one responsibility, a small documented interface in defaults, deterministic tasks, handlers, templates, and tests. Keep environment-specific data in inventory and secret material outside task logic. Prefer composing focused roles over one large role controlled by many flags.

8. Does Ansible Vault Make Secrets Safe?

It protects encrypted files at rest. Decrypted values can still leak through logs, process arguments, templates, controller files, or CI artifacts. Use least privilege, no_log where appropriate, protected vault-password delivery, separate vault IDs, rotation, and external secret managers when scale requires them.

9. How Do You Perform a Safe Rolling Update?

Use serial to cap the batch, preflight assertions before disruption, load-balancer delegation, meaningful application readiness, a zero or explicit failure budget, and a tested rescue/rollback path. Do not return a host to service until its behavior is verified.

10. delegate_to Versus run_once?

delegate_to changes the execution host; it does not reduce how many inventory hosts initiate the task. run_once limits execution cardinality. Some tasks need one, some both, and per-host load-balancer actions need delegation without run-once.

11. How Do You Speed Up Ansible Safely?

Measure first. Tune forks, fact gathering, caching, SSH pipelining, strategy, and task structure. Avoid gathering unused facts or repeatedly calling slow APIs. Preserve serial limits, rate limits, dependency order, and verification even if they constrain maximum concurrency.

12. What Belongs in Ansible CI?

Run YAML and syntax checks, ansible-lint, role or collection tests, check mode where meaningful, a real converge against ephemeral targets, a second idempotency run, and application-level assertions. Pin ansible-core and collection versions and ensure logs never expose vault values.

Turn these answers into evidence through the Ansible course and its 20 hands-on incident labs.