This VM is the control node. The lab installs ansible-core and creates the user greg (password Lab-Pass-1), who has an SSH key. Work as greg (su - greg as root), in /home/greg/ansible: its ansible.cfg reads the inventory inventory, which has node1 in the group nodes, and logs in as ansible. Answers go in /root/lab-answers/<task>, which the lab creates; write them as root.

The managed node node1 (10.99.1.11) is an AlmaLinux 10 container with its own users and packages, reached over SSH by name. The user ansible accepts greg's key and may use sudo without a password. For a root shell on it, sudo podman exec -it node1 bash.

Tasks

As greg, install the ansible.posix collection from Ansible Galaxy. Then, using only ansible-doc, find the module that manages SELinux booleans and the option that makes the change persistent. Write the module's full name and the option's name to /root/lab-answers/1.
Find an example in ansible.builtin.lineinfile's page that changes a line matched by a regular expression, and adapt it in /home/greg/ansible/sshd.yml to set PermitRootLogin no in node1's /etc/ssh/sshd_config. The task runs, and a second run reports ok.
List the filters available on the control node and find the one that hashes passwords. Write its name to /root/lab-answers/3.

Hints

ansible-galaxy collection install ansible.posix (it needs the internet); ansible-doc -l | grep -i selinux, then ansible-doc MODULE. For a module that isn't installed, ansible-doc only warns.
In the pager, /EXAMPLES jumps to the examples. The task needs become: true, and sshd reads the change only after a reload (a handler).
The node's sshd also reads /etc/ssh/sshd_config.d/01-le-lab.conf, which lets root log in for the lab and wins over the main file; leave it. sshd -T | grep -i permitroot shows what sshd really uses.
ansible-doc -t filter -l | grep -i password.