1. Assessment Goal

Deep Dive and Submission Example for Assessment Goal

A complete treatment of Assessment Goal contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Minimal Artifacts for Assessment Goal

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Assessment Goal

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Assessment Goal is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Assessment Goal

This section is not just a definition. In the workshop, Assessment Goal is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Example Flow for Assessment Goal

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Assessment Goal

• Inventory and patterns are narrower than all unless a reason is documented.
• Modules from ansible.builtin or reviewed collections are preferred.
• Shell or command tasks include changed_when, failed_when, or a clear reason.
• Variables are placed predictably and do not override each other surprisingly.
• Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
• The playbook can run repeatedly without unnecessary changes.
• Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Assessment Goal

Operations Note for Assessment Goal

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

This assessment verifies that you can explain, apply, and safely validate threat modeling, least privilege, Vault IDs, secret flows, supply chain, no-log.

2. Prerequisites and Allowed Aids

Deep Dive and Submission Example for Prerequisites and Allowed Aids

A complete treatment of Prerequisites and Allowed Aids contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Minimal Artifacts for Prerequisites and Allowed Aids

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Prerequisites and Allowed Aids

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Prerequisites and Allowed Aids is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Prerequisites and Allowed Aids

This section is not just a definition. In the workshop, Prerequisites and Allowed Aids is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Example Flow for Prerequisites and Allowed Aids

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Prerequisites and Allowed Aids

• Inventory and patterns are narrower than all unless a reason is documented.
• Modules from ansible.builtin or reviewed collections are preferred.
• Shell or command tasks include changed_when, failed_when, or a clear reason.
• Variables are placed predictably and do not override each other surprisingly.
• Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
• The playbook can run repeatedly without unnecessary changes.
• Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Prerequisites and Allowed Aids

Operations Note for Prerequisites and Allowed Aids

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

Official documentation, own notes, ansible-doc, ansible-inventory, syntax check, check mode, and diff mode are allowed. Production hosts, real secrets, and complete model solutions are not allowed.

3. Scenario

Deep Dive and Submission Example for Scenario

A complete treatment of Scenario contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Minimal Artifacts for Scenario

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Scenario

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Scenario is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Scenario

This section is not just a definition. In the workshop, Scenario is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Example Flow for Scenario

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Scenario

• Inventory and patterns are narrower than all unless a reason is documented.
• Modules from ansible.builtin or reviewed collections are preferred.
• Shell or command tasks include changed_when, failed_when, or a clear reason.
• Variables are placed predictably and do not override each other surprisingly.
• Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
• The playbook can run repeatedly without unnecessary changes.
• Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Scenario

Operations Note for Scenario

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

A team wants to operate a small Ansible automation repository. You must model targets, inspect a playbook, execute changes safely, and provide evidence.

4. Expected Submission

Deep Dive and Submission Example for Expected Submission

A complete treatment of Expected Submission contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Minimal Artifacts for Expected Submission

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Expected Submission

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Expected Submission is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Expected Submission

This section is not just a definition. In the workshop, Expected Submission is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Example Flow for Expected Submission

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Expected Submission

• Inventory and patterns are narrower than all unless a reason is documented.
• Modules from ansible.builtin or reviewed collections are preferred.
• Shell or command tasks include changed_when, failed_when, or a clear reason.
• Variables are placed predictably and do not override each other surprisingly.
• Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
• The playbook can run repeatedly without unnecessary changes.
• Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Expected Submission

Operations Note for Expected Submission

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

advanced-security-submission/
  answers.md
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

5. Part A: Knowledge Questions

Deep Dive and Submission Example for Part A: Knowledge Questions

A complete treatment of Part A: Knowledge Questions contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Minimal Artifacts for Part A: Knowledge Questions

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Part A: Knowledge Questions

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Part A: Knowledge Questions is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Part A: Knowledge Questions

This section is not just a definition. In the workshop, Part A: Knowledge Questions is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Example Flow for Part A: Knowledge Questions

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Part A: Knowledge Questions

• Inventory and patterns are narrower than all unless a reason is documented.
• Modules from ansible.builtin or reviewed collections are preferred.
• Shell or command tasks include changed_when, failed_when, or a clear reason.
• Variables are placed predictably and do not override each other surprisingly.
• Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
• The playbook can run repeatedly without unnecessary changes.
• Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Part A: Knowledge Questions

Operations Note for Part A: Knowledge Questions

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

1. Explain threat modeling with purpose, risk, and validation. (5 points)
2. Explain least privilege with purpose, risk, and validation. (5 points)
3. Explain Vault IDs with purpose, risk, and validation. (5 points)
4. Explain secret flows with purpose, risk, and validation. (5 points)
5. Explain supply chain with purpose, risk, and validation. (5 points)
6. Explain no-log with purpose, risk, and validation. (5 points)
7. Explain execution environments with purpose, risk, and validation. (5 points)
8. Explain RBAC with purpose, risk, and validation. (5 points)
9. Explain incident response with purpose, risk, and validation. (3 points)
10. Explain security review with purpose, risk, and validation. (3 points)

6. Part B: Analysis

Deep Dive and Submission Example for Part B: Analysis

A complete treatment of Part B: Analysis contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Minimal Artifacts for Part B: Analysis

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Part B: Analysis

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Part B: Analysis is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Part B: Analysis

This section is not just a definition. In the workshop, Part B: Analysis is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Example Flow for Part B: Analysis

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Part B: Analysis

• Inventory and patterns are narrower than all unless a reason is documented.
• Modules from ansible.builtin or reviewed collections are preferred.
• Shell or command tasks include changed_when, failed_when, or a clear reason.
• Variables are placed predictably and do not override each other surprisingly.
• Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
• The playbook can run repeatedly without unnecessary changes.
• Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Part B: Analysis

Operations Note for Part B: Analysis

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

Analyze a provided inventory and playbook. Review scope, variable sources, module choice, privileges, idempotence, and secret risks.

7. Part C: Practical Task

Deep Dive and Submission Example for Part C: Practical Task

A complete treatment of Part C: Practical Task contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Minimal Artifacts for Part C: Practical Task

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Part C: Practical Task

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Part C: Practical Task is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Part C: Practical Task

This section is not just a definition. In the workshop, Part C: Practical Task is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Example Flow for Part C: Practical Task

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Part C: Practical Task

• Inventory and patterns are narrower than all unless a reason is documented.
• Modules from ansible.builtin or reviewed collections are preferred.
• Shell or command tasks include changed_when, failed_when, or a clear reason.
• Variables are placed predictably and do not override each other surprisingly.
• Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
• The playbook can run repeatedly without unnecessary changes.
• Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Part C: Practical Task

Operations Note for Part C: Practical Task

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

Create or repair a small lab playbook. Run --list-hosts, --syntax-check, --check --diff, a real run, and a second run.

8. Part D: Diagnosis and Operations Note

Deep Dive and Submission Example for Part D: Diagnosis and Operations Note

A complete treatment of Part D: Diagnosis and Operations Note contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Minimal Artifacts for Part D: Diagnosis and Operations Note

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Part D: Diagnosis and Operations Note

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Part D: Diagnosis and Operations Note is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Part D: Diagnosis and Operations Note

This section is not just a definition. In the workshop, Part D: Diagnosis and Operations Note is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Example Flow for Part D: Diagnosis and Operations Note

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Part D: Diagnosis and Operations Note

• Inventory and patterns are narrower than all unless a reason is documented.
• Modules from ansible.builtin or reviewed collections are preferred.
• Shell or command tasks include changed_when, failed_when, or a clear reason.
• Variables are placed predictably and do not override each other surprisingly.
• Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
• The playbook can run repeatedly without unnecessary changes.
• Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Part D: Diagnosis and Operations Note

Operations Note for Part D: Diagnosis and Operations Note

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

Describe a failure mode such as unreachable, failed, wrong variable, or missing collection. Provide diagnostic sequence and minimal fix.

9. Scoring

Deep Dive and Submission Example for Scoring

A complete treatment of Scoring contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Minimal Artifacts for Scoring

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Scoring

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Scoring is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Scoring

This section is not just a definition. In the workshop, Scoring is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Example Flow for Scoring

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Scoring

• Inventory and patterns are narrower than all unless a reason is documented.
• Modules from ansible.builtin or reviewed collections are preferred.
• Shell or command tasks include changed_when, failed_when, or a clear reason.
• Variables are placed predictably and do not override each other surprisingly.
• Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
• The playbook can run repeatedly without unnecessary changes.
• Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Scoring

Operations Note for Scoring

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

10. Hard-Fail Criteria

Deep Dive and Submission Example for Hard-Fail Criteria

A complete treatment of Hard-Fail Criteria contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Minimal Artifacts for Hard-Fail Criteria

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Hard-Fail Criteria

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Hard-Fail Criteria is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Hard-Fail Criteria

This section is not just a definition. In the workshop, Hard-Fail Criteria is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Example Flow for Hard-Fail Criteria

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Hard-Fail Criteria

• Inventory and patterns are narrower than all unless a reason is documented.
• Modules from ansible.builtin or reviewed collections are preferred.
• Shell or command tasks include changed_when, failed_when, or a clear reason.
• Variables are placed predictably and do not override each other surprisingly.
• Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
• The playbook can run repeatedly without unnecessary changes.
• Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Hard-Fail Criteria

Operations Note for Hard-Fail Criteria

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

Production hosts, real secrets, missing scope verification, broad privileges without justification, or no validation after changes cause failure.

11. Examiner Checklist

Deep Dive and Submission Example for Examiner Checklist

A complete treatment of Examiner Checklist contains both a technical artifact and a short domain explanation. The artifact can be an inventory, a playbook, a role, a template, a Vault file with dummy values, a CI configuration, or an evidence file. The explanation states why this path was chosen and which alternative was deliberately not used.

Minimal Artifacts for Examiner Checklist

submission/
  inventory/hosts.yml
  playbooks/site.yml
  evidence.md
  cleanup.md

For roles or collections, the structure expands:

submission/
  ansible.cfg
  collections/requirements.yml
  inventory/hosts.yml
  roles/<role>/defaults/main.yml
  roles/<role>/tasks/main.yml
  roles/<role>/handlers/main.yml
  playbooks/site.yml
  evidence.md

Grading Expectation for Examiner Checklist

A reviewable solution must be understandable to people who did not run it themselves. Screenshots or uncommented terminal output are not enough. Good evidence states context, command, relevant output, and assessment. If a module behaves differently in check mode, that limitation is explicitly documented.

Transfer to Real Teams

In a team context, Examiner Checklist is connected to code review, branch rules, CI, role ownership, release notes, and operational approval. Production-like usage also documents ownership, maintenance window, monitoring, alerting, and rollback criteria.

Practical Relevance of Examiner Checklist

This section is not just a definition. In the workshop, Examiner Checklist is always validated through a concrete flow: inspect inventory, prove target hosts, check the playbook, simulate the change, run the change, evaluate a second run, and document cleanup. This shows whether Ansible really models desired state or merely executes a command successfully once.

Example Flow for Examiner Checklist

ansible-inventory -i inventory/hosts.yml --graph
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --list-hosts
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --syntax-check
ansible-playbook -i inventory/hosts.yml playbooks/site.yml --check --diff
ansible-playbook -i inventory/hosts.yml playbooks/site.yml
ansible-playbook -i inventory/hosts.yml playbooks/site.yml

The flow is intentionally complete. In real teams, some steps are automated but not skipped. CI can run syntax checks and linting; the domain review of scope, privileges, secret flows, and rollout risk remains a human engineering task.

Review Criteria for Examiner Checklist

• Inventory and patterns are narrower than all unless a reason is documented.
• Modules from ansible.builtin or reviewed collections are preferred.
• Shell or command tasks include changed_when, failed_when, or a clear reason.
• Variables are placed predictably and do not override each other surprisingly.
• Secrets do not appear in plaintext, diffs, debug tasks, or CI logs.
• The playbook can run repeatedly without unnecessary changes.
• Cleanup, fix-forward, or controlled acceptance of the target state is documented.

Common Failure Modes for Examiner Checklist

Operations Note for Examiner Checklist

For production-like usage, the lab must become a runbook. The runbook states target systems, owners, prerequisites, stop criteria, expected duration, validation, monitoring, and cleanup. Without those details, a playbook is executable but not operationally mature.

• Scope verified
• Syntax check present
• Check/diff reviewed
• second run present
• secrets protected
• cleanup documented