diff --git a/awx/main/tests/unit/models/test_survey_models.py b/awx/main/tests/unit/models/test_survey_models.py
index d283c57081..abd0b5fbba 100644
--- a/awx/main/tests/unit/models/test_survey_models.py
+++ b/awx/main/tests/unit/models/test_survey_models.py
@@ -2,6 +2,7 @@ import tempfile
 import pytest
 import json
 
+from awx.main.utils.encryption import encrypt_value
 from awx.main.tasks import RunJob
 from awx.main.models import (
     Job,
@@ -9,6 +10,8 @@ from awx.main.models import (
     WorkflowJobTemplate
 )
 
+ENCRYPTED_SECRET = encrypt_value('secret')
+
 
 @pytest.fixture
 def job(mocker):
@@ -143,6 +146,46 @@ def test_optional_survey_question_defaults(
         assert 'c' not in defaulted_extra_vars['extra_vars']
 
 
+@pytest.mark.survey
+@pytest.mark.parametrize("question_type,default,maxlen,kwargs,expected", [
+    ('text', None, 5, {}, {}),
+    ('text', '', 5, {}, {'x': ''}),
+    ('text', 'y', 5, {}, {'x': 'y'}),
+    ('text', 'too-long', 5, {}, {}),
+    ('password', None, 5, {}, {}),
+    ('password', '', 5, {}, {'x': ''}),
+    ('password', ENCRYPTED_SECRET, 5, {}, {}),  # len(secret) == 6, invalid
+    ('password', ENCRYPTED_SECRET, 10, {}, {'x': ENCRYPTED_SECRET}),  # len(secret) < 10, valid
+    ('password', None, 5, {'extra_vars': {'x': '$encrypted$'}}, {}),
+    ('password', '', 5, {'extra_vars': {'x': '$encrypted$'}}, {'x': ''}),
+    ('password', None, 5, {'extra_vars': {'x': 'y'}}, {'x': 'y'}),
+    ('password', '', 5, {'extra_vars': {'x': 'y'}}, {'x': 'y'}),
+    ('password', 'foo', 5, {'extra_vars': {'x': 'y'}}, {'x': 'y'}),
+    ('password', None, 5, {'extra_vars': {'x': ''}}, {'x': ''}),
+    ('password', '', 5, {'extra_vars': {'x': ''}}, {'x': ''}),
+    ('password', 'foo', 5, {'extra_vars': {'x': ''}}, {'x': ''}),
+    ('password', ENCRYPTED_SECRET, 5, {'extra_vars': {'x': '$encrypted$'}}, {}),
+    ('password', ENCRYPTED_SECRET, 10, {'extra_vars': {'x': '$encrypted$'}}, {'x': ENCRYPTED_SECRET}),
+])
+def test_survey_encryption_defaults(survey_spec_factory, question_type, default, maxlen, kwargs, expected):
+    spec = survey_spec_factory([
+        {
+            "required": True,
+            "variable": "x",
+            "min": 0,
+            "max": maxlen,
+            "type": question_type
+        },
+    ])
+    if default is not None:
+        spec['spec'][0]['default'] = default
+    else:
+        spec['spec'][0].pop('default', None)
+    jt = JobTemplate(name="test-jt", survey_spec=spec, survey_enabled=True)
+    extra_vars = json.loads(jt._update_unified_job_kwargs({}, kwargs).get('extra_vars'))
+    assert extra_vars == expected
+
+
 @pytest.mark.survey
 class TestWorkflowSurveys:
     def test_update_kwargs_survey_defaults(self, survey_spec_factory):