Question 15

Correct answer: A

A.

This playbook configures the firewall on all managed nodes using the firewalld module to ensure that only SSH and HTTPS traffic is allowed while all other incoming traffic is blocked. It achieves this by first allowing the SSH and HTTPS services, then setting a default firewall zone to drop all other traffic. The firewall rules are enforced permanently to ensure they persist even after a reboot.

Line-by-Line Explanation

1. - hosts: all

   • This line specifies that the tasks will be executed on all hosts defined in the Ansible inventory.

2. tasks:

   • This marks the start of the tasks section where specific actions will be performed on the hosts.

3. - name: Allow SSH and HTTPS traffic

   • This task description indicates that SSH and HTTPS traffic will be allowed on the hosts.

4. ansible.builtin.firewalld:

   • This is the firewalld module from Ansible that is used to configure the firewall on the managed nodes.

5. service: "{{ item }}"

   • This tells Ansible to iterate through the services specified in the loop (SSH and HTTPS) and apply the firewall rule to allow them.

6. state: enabled

   • This ensures that the service (SSH or HTTPS) is enabled in the firewall, allowing the traffic through.

7. permanent: yes

   • This ensures the rule is permanent and will persist even after a system reboot.

8. loop:

   • This indicates that the task will be repeated for each item in the following list (SSH and HTTPS).

9. - ssh

   • This specifies that the SSH service will be allowed by the firewall.

10. - https

    • This specifies that the HTTPS service will be allowed by the firewall.

11. - name: Set default zone to drop all other traffic

    • This task sets a default firewall rule to block all other incoming traffic except the specified services.

12. ansible.builtin.firewalld:

    • Again, the firewalld module is used to configure the firewall.

13. default_zone: drop

    • This defines the default zone as "drop," which means that any incoming traffic not explicitly allowed will be dropped.

14. state: enabled

    • This ensures that the default rule (to drop other traffic) is enabled in the firewall.

This Ansible playbook configures a firewall on all managed nodes to allow only SSH and HTTPS traffic, blocking all other incoming traffic. The rules are applied permanently to ensure they remain effective even after a reboot. The playbook achieves this by using Ansible's firewalld module to manage firewall services and set a default zone to drop traffic.